cgroups v2 support (apply from v1 / OCI spec)

CHANGELOG.md

@@ -61,11 +61,18 @@
   capabilities. `--nvccli` is not currently supported in the hybrid fakeroot
   (setuid install + `--fakeroot`) workflow. Please see documentation for more
   details.
+- The `--apply-cgroups` flag can be used to apply cgroups resource and device
+  restrictions on a system using the v2 unified cgroups hierarchy. The resource
+  restrictions must still be specified in the v1 / OCI format, which will be
+  translated into v2 cgroups resource restrictions, and eBPF device
+  restrictions.
 
 ### Bug fixes
 
 - Fix regression when files `source`d from `%environment` contain `\` escaped
   shell builtins (fixes issue with `source` of conda profile.d script).
+- The `oci` commands will operate on systems that use the v2 unified cgroups
+  hierarchy.
 
 ## v3.8.2 \[2021-08-19\]
 

go.sum

@@ -169,6 +169,7 @@ github.com/cilium/ebpf v0.0.0-20200110133405-4032b1d8aae3/go.mod h1:MA5e5Lr8slmE
 github.com/cilium/ebpf v0.0.0-20200702112145-1c8d4c9ef775/go.mod h1:7cR51M8ViRLIdUjrmSXlK9pkrsDlLHbO8jiB8X8JnOc=
 github.com/cilium/ebpf v0.2.0/go.mod h1:To2CFviqOWL/M0gIMsvSMlqe7em/l1ALkX1PyjrX2Qs=
 github.com/cilium/ebpf v0.4.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
+github.com/cilium/ebpf v0.6.2 h1:iHsfF/t4aW4heW2YKfeHrVPGdtYTL4C4KocpM8KTSnI=
 github.com/cilium/ebpf v0.6.2/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
@@ -362,6 +363,7 @@ github.com/fatih/color v1.12.0 h1:mRhaKNwANqRgUBGKmnI5ZxEk7QXmjQeCcuYFMX2bfcc=
 github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
+github.com/frankban/quicktest v1.11.3 h1:8sXhOn0uLys67V8EsXLc6eszDs8VXWxL3iRvebPhedY=
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=

internal/app/singularity/oci_update_linux.go

@@ -1,4 +1,4 @@
-// Copyright (c) 2018-2019, Sylabs Inc. All rights reserved.
+// Copyright (c) 2018-2021, Sylabs Inc. All rights reserved.
 // This software is licensed under a 3-clause BSD license. Please consult the
 // LICENSE.md file distributed with the sources of this project regarding your
 // rights to use or distribute this software.
@@ -35,7 +35,10 @@ func OciUpdate(containerID string, args *OciArgs) error {
 	}
 
 	resources := &specs.LinuxResources{}
-	manager := &cgroups.Manager{Pid: state.State.Pid}
+	manager, err := cgroups.GetManagerFromPid(state.State.Pid)
+	if err != nil {
+		return fmt.Errorf("failed to get cgroups manager: %v", err)
+	}
 
 	if args.FromFile == "-" {
 		reader = os.Stdin