diff --git a/internal/pkg/runtime/launcher/oci/launcher_linux.go b/internal/pkg/runtime/launcher/oci/launcher_linux.go index 5f0e486ac0..4e6675c812 100644 --- a/internal/pkg/runtime/launcher/oci/launcher_linux.go +++ b/internal/pkg/runtime/launcher/oci/launcher_linux.go @@ -21,6 +21,7 @@ import ( "github.com/container-orchestrated-devices/container-device-interface/pkg/cdi" "github.com/google/uuid" + lccgroups "github.com/opencontainers/runc/libcontainer/cgroups" "github.com/opencontainers/runtime-spec/specs-go" "github.com/sylabs/singularity/internal/pkg/buildcfg" "github.com/sylabs/singularity/internal/pkg/cache" @@ -498,9 +499,10 @@ func (l *Launcher) getCgroup() (path string, resources *specs.LinuxResources, er return path, resources, nil } -// crunNestCgroup will check whether we are using crun, and enter a cgroup if running as a non-root user. -// This is required to satisfy a common user-owned ancestor cgroup requirement on e.g. bare ssh logins. -// See: https://github.com/sylabs/singularity/issues/1538 +// crunNestCgroup will check whether we are using crun, and enter a cgroup if +// running as a non-root user under cgroups v2, with systemd. This is required +// to satisfy a common user-owned ancestor cgroup requirement on e.g. bare ssh +// logins. See: https://github.com/sylabs/singularity/issues/1538 func (l *Launcher) crunNestCgroup() error { r, err := runtime() if err != nil { @@ -517,6 +519,12 @@ func (l *Launcher) crunNestCgroup() error { return nil } + // We can only create a new cgroup under cgroups v2 with systemd as manager. + // Generally we won't hit the issue that needs a workaround under cgroups v1, so no-op instead of a warning here. + if !(lccgroups.IsCgroup2UnifiedMode() && l.singularityConf.SystemdCgroups) { + return nil + } + // We are running crun as a user. Enter a cgroup now. pid := os.Getpid() sylog.Debugf("crun workaround - adding process %d to sibling cgroup", pid)