runc --systemd-cgroup update does not update systemd scope

[kolyshkin]

A repro

1. Prepare a bundle and a spec. Amend the config.json with

        "pids": {
                "limit": 55
        }

in the linux.resources section, and a long-lived process such as sleep.

2. Start the container:

# runc --systemd-cgroup run -d keke

3. Check its pids limit in cgroups scope, as well as in cgroupfs:

# systemctl show runc-keke.scope | grep 'Task'
TasksCurrent=2
TasksAccounting=yes
TasksMax=55

# cat /sys/fs/cgroup/system.slice/runc-keke.scope/pids.max 
55

4. Update the limit:

# runc --systemd-cgroup update keke --pids-limit 66

5. Check again:

# systemctl show runc-keke.scope | grep 'Task'
TasksCurrent=2
TasksAccounting=yes
TasksMax=55

# cat /sys/fs/cgroup/system.slice/runc-keke.scope/pids.max 
66

As we can see, the kernel and the systemd is now in disagreement about the limit.

6. Check that the limit can in principal be updated:

# systemctl show runc-keke.scope | grep 'Task'
TasksCurrent=2
TasksAccounting=yes
TasksMax=77
DropInPaths=/run/systemd/transient/runc-keke.scope.d/50-TasksMax.conf
# cat /sys/fs/cgroup/system.slice/runc-keke.scope/pids.max 
77

In the above example, we set/check/update pids.limit, but all the other resources behave in a similar way.

The cause of this is Set() method of systemd.UnifiedManager, which only uses fsManager to set the updated values.

[kolyshkin]

This might also be pointed out to at #2007