WIP

sylabs · Aug 31, 2021 · 7f5d874 · 7f5d874
1 parent 4ead115
commit 7f5d874
Show file tree

Hide file tree

Showing 22 changed files with 875 additions and 334 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -61,11 +61,18 @@
   capabilities. `--nvccli` is not currently supported in the hybrid fakeroot
   (setuid install + `--fakeroot`) workflow. Please see documentation for more
   details.
+- The `--apply-cgroups` flag can be used to apply cgroups resource and device
+  restrictions on a system using the v2 unified cgroups hierarchy. The resource
+  restrictions must still be specified in the v1 / OCI format, which will be
+  translated into v2 cgroups resource restrictions, and eBPF device
+  restrictions.
 
 ### Bug fixes
 
 - Fix regression when files `source`d from `%environment` contain `\` escaped
   shell builtins (fixes issue with `source` of conda profile.d script).
+- The `oci` commands will operate on systems that use the v2 unified cgroups
+  hierarchy.
 
 ## v3.8.2 \[2021-08-19\]
 

diff --git a/go.sum b/go.sum
@@ -163,6 +163,7 @@ github.com/cilium/ebpf v0.0.0-20200110133405-4032b1d8aae3/go.mod h1:MA5e5Lr8slmE
 github.com/cilium/ebpf v0.0.0-20200702112145-1c8d4c9ef775/go.mod h1:7cR51M8ViRLIdUjrmSXlK9pkrsDlLHbO8jiB8X8JnOc=
 github.com/cilium/ebpf v0.2.0/go.mod h1:To2CFviqOWL/M0gIMsvSMlqe7em/l1ALkX1PyjrX2Qs=
 github.com/cilium/ebpf v0.4.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
+github.com/cilium/ebpf v0.6.2 h1:iHsfF/t4aW4heW2YKfeHrVPGdtYTL4C4KocpM8KTSnI=
 github.com/cilium/ebpf v0.6.2/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
@@ -354,6 +355,7 @@ github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL
 github.com/fatih/color v1.12.0 h1:mRhaKNwANqRgUBGKmnI5ZxEk7QXmjQeCcuYFMX2bfcc=
 github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
 github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
+github.com/frankban/quicktest v1.11.3 h1:8sXhOn0uLys67V8EsXLc6eszDs8VXWxL3iRvebPhedY=
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=

diff --git a/internal/app/singularity/oci_update_linux.go b/internal/app/singularity/oci_update_linux.go
@@ -35,7 +35,10 @@ func OciUpdate(containerID string, args *OciArgs) error {
 	}
 
 	resources := &specs.LinuxResources{}
-	manager := &cgroups.Manager{Pid: state.State.Pid}
+	manager, err := cgroups.GetManagerFromPid(state.State.Pid)
+	if err != nil {
+		return fmt.Errorf("failed to get cgroups manager: %v", err)
+	}
 
 	if args.FromFile == "-" {
 		reader = os.Stdin

diff --git a/internal/pkg/cgroups/cgroups_linux_test.go b/internal/pkg/cgroups/cgroups_linux_test.go
diff --git a/internal/pkg/cgroups/config_linux.go b/internal/pkg/cgroups/config_linux.go
@@ -12,6 +12,13 @@ import (
 	"github.com/pelletier/go-toml"
 )
 
+func Int64ptr(i int) *int64 {
+	t := int64(i)
+	return &t
+}
+
+var wildcard = Int64ptr(-1)
+
 // LinuxHugepageLimit structure corresponds to limiting kernel hugepages
 type LinuxHugepageLimit struct {
 	// Pagesize is the hugepage size
@@ -160,6 +167,8 @@ type Config struct {
 	// Limits are a set of key value pairs that define RDMA resource limits,
 	// where the key is device name and value is resource limits.
 	Rdma map[string]LinuxRdma `toml:"rdma" json:"rdma,omitempty"`
+	// TODO: Enable support for native cgroup v2 resource specifications
+	// Unified map[string]string `toml:"unified" json:"unified,omitempty"`
 }
 
 // LoadConfig opens cgroups controls config file and unmarshals it into structures

diff --git a/internal/pkg/cgroups/example/cgroups-no-hugetlb.toml b/internal/pkg/cgroups/example/cgroups-no-hugetlb.toml
@@ -18,6 +18,7 @@
 #  realtimePeriod = 0
   cpus = "0"
   mems = "0"
+  shares = 1024
 
 
 # Memory restriction configuration

diff --git a/internal/pkg/cgroups/example/cgroups.toml b/internal/pkg/cgroups/example/cgroups.toml
@@ -11,13 +11,13 @@
 # - cpus: CPUs to use within the cpuset. Default is to use any CPU available.
 # - mems: list of memory nodes in the cpuset. Default is to use any available memory node
 [cpu]
-#  shares = 512
 #  quotas = 0
 #  period = 0
 #  realtimeRuntime = 0
 #  realtimePeriod = 0
   cpus = "0"
   mems = "0"
+  shares = 1024
 
 
 # Memory restriction configuration