runc run/create: refuse non-empty cgroup; runc exec: refuse frozen cgroup

contrib/cmd/sd-helper/helper.go

@@ -57,9 +57,9 @@ func main() {
 	}
 }
 
-func newManager(config *configs.Cgroup) cgroups.Manager {
+func newManager(config *configs.Cgroup) (cgroups.Manager, error) {
 	if cgroups.IsCgroup2UnifiedMode() {
-		return systemd.NewUnifiedManager(config, "", false)
+		return systemd.NewUnifiedManager(config, "")
 	}
 	return systemd.NewLegacyManager(config, nil)
 }
@@ -70,7 +70,10 @@ func unitCommand(cmd, name, parent string) error {
 		Parent:    parent,
 		Resources: &configs.Resources{},
 	}
-	pm := newManager(podConfig)
+	pm, err := newManager(podConfig)
+	if err != nil {
+		return err
+	}
 
 	switch cmd {
 	case "start":

exec.go

@@ -114,8 +114,8 @@ func execProcess(context *cli.Context) (int, error) {
 	if err != nil {
 		return -1, err
 	}
-	if status == libcontainer.Stopped {
-		return -1, errors.New("cannot exec a container that has stopped")
+	if status == libcontainer.Stopped || status == libcontainer.Paused {
+		return -1, fmt.Errorf("cannot exec in a %s container", status)
 	}
 	path := context.String("process")
 	if path == "" && len(context.Args()) == 1 {

libcontainer/cgroups/fs/blkio.go

@@ -20,8 +20,8 @@ func (s *BlkioGroup) Name() string {
 	return "blkio"
 }
 
-func (s *BlkioGroup) Apply(path string, d *cgroupData) error {
-	return join(path, d.pid)
+func (s *BlkioGroup) Apply(path string, _ *configs.Resources, pid int) error {
+	return apply(path, pid)
 }
 
 func (s *BlkioGroup) Set(path string, r *configs.Resources) error {