Add support for cgroups managed by systemd

src/capabilities.rs

@@ -1,6 +1,4 @@
-use crate::{
-    command::Command,
-};
+use crate::command::Command;
 use caps::*;
 
 use anyhow::Result;

src/cgroups/blkio.rs

@@ -4,9 +4,7 @@ use std::{
     path::Path,
 };
 
-use crate::{
-    cgroups::Controller,
-};
+use crate::cgroups::Controller;
 use oci_spec::{LinuxBlockIo, LinuxResources};
 
 const CGROUP_BLKIO_THROTTLE_READ_BPS: &str = "blkio.throttle.read_bps_device";

src/cgroups/cgroupsfs_manager.rs

@@ -0,0 +1,107 @@
+use crate::cgroups::Manager;
+use std::{collections::HashMap, path::PathBuf};
+use std::{fs::remove_dir, path::Path};
+
+use anyhow::Result;
+use nix::unistd::Pid;
+use procfs::process::Process;
+
+use super::{
+    blkio::Blkio, devices::Devices, hugetlb::Hugetlb, memory::Memory,
+    network_classifier::NetworkClassifier, network_priority::NetworkPriority, pids::Pids,
+    Controller,
+};
+use crate::{cgroups::ControllerType, utils::PathBufExt};
+use oci_spec::LinuxResources;
+
+const CONTROLLERS: &[ControllerType] = &[
+    ControllerType::Devices,
+    ControllerType::HugeTlb,
+    ControllerType::Memory,
+    ControllerType::Pids,
+    ControllerType::Blkio,
+    ControllerType::NetworkPriority,
+    ControllerType::NetworkClassifier,
+];
+
+pub struct CGroupsFSManager {
+    subsystems: HashMap<String, PathBuf>,
+}
+
+impl CGroupsFSManager {
+    pub fn new(cgroup_path: PathBuf) -> Result<Self> {
+        let mut subsystems = HashMap::<String, PathBuf>::new();
+        for subsystem in CONTROLLERS.iter().map(|c| c.to_string()) {
+            subsystems.insert(
+                subsystem.to_owned(),
+                Self::get_subsystem_path(&cgroup_path, &subsystem)?,
+            );
+        }
+
+        Ok(CGroupsFSManager { subsystems })
+    }
+
+    fn get_subsystem_path(cgroup_path: &Path, subsystem: &str) -> anyhow::Result<PathBuf> {
+        log::debug!("Get path for subsystem: {}", subsystem);
+        let mount = Process::myself()?
+            .mountinfo()?
+            .into_iter()
+            .find(|m| {
+                if m.fs_type == "cgroup" {
+                    // Some systems mount net_prio and net_cls in the same directory
+                    // other systems mount them in their own diretories. This
+                    // should handle both cases.
+                    if subsystem == "net_cls" || subsystem == "net_prio" {
+                        return m.mount_point.ends_with("net_cls,net_prio")
+                            || m.mount_point.ends_with("net_prio,net_cls");
+                    }
+                }
+                m.mount_point.ends_with(subsystem)
+            })
+            .unwrap();
+
+        let cgroup = Process::myself()?
+            .cgroups()?
+            .into_iter()
+            .find(|c| c.controllers.contains(&subsystem.to_owned()))
+            .unwrap();
+
+        let p = if cgroup_path.to_string_lossy().into_owned().is_empty() {
+            mount
+                .mount_point
+                .join_absolute_path(Path::new(&cgroup.pathname))?
+        } else {
+            mount.mount_point.join_absolute_path(&cgroup_path)?
+        };
+
+        Ok(p)
+    }
+}
+
+impl Manager for CGroupsFSManager {
+    fn apply(&self, linux_resources: &LinuxResources, pid: Pid) -> Result<()> {
+        for subsys in &self.subsystems {
+            match subsys.0.as_str() {
+                "devices" => Devices::apply(linux_resources, &subsys.1, pid)?,
+                "hugetlb" => Hugetlb::apply(linux_resources, &subsys.1, pid)?,
+                "memory" => Memory::apply(linux_resources, &subsys.1, pid)?,
+                "pids" => Pids::apply(linux_resources, &subsys.1, pid)?,
+                "blkio" => Blkio::apply(linux_resources, &subsys.1, pid)?,
+                "net_prio" => NetworkPriority::apply(linux_resources, &subsys.1, pid)?,
+                "net_cls" => NetworkClassifier::apply(linux_resources, &subsys.1, pid)?,
+                _ => continue,
+            }
+        }
+        Ok(())
+    }
+
+    fn remove(&self) -> Result<()> {
+        for cgroup_path in &self.subsystems {
+            if cgroup_path.1.exists() {
+                log::debug!("remove cgroup {:?}", cgroup_path.1);
+                remove_dir(&cgroup_path.1)?;
+            }
+        }
+        Ok(())
+    }
+}

src/cgroups/devices.rs

@@ -7,10 +7,7 @@ use std::{
 use anyhow::Result;
 use nix::unistd::Pid;
 
-use crate::{
-    cgroups::Controller,
-    rootfs::default_devices,
-};
+use crate::{cgroups::Controller, rootfs::default_devices};
 use oci_spec::{LinuxDeviceCgroup, LinuxDeviceType, LinuxResources};
 
 pub struct Devices {}

src/cgroups/hugetlb.rs

@@ -7,9 +7,7 @@ use std::{
 use anyhow::anyhow;
 use regex::Regex;
 
-use crate::{
-    cgroups::Controller,
-};
+use crate::cgroups::Controller;
 use oci_spec::{LinuxHugepageLimit, LinuxResources};
 
 pub struct Hugetlb {}

src/cgroups/manager.rs

@@ -1,106 +1,11 @@
-use std::{collections::HashMap, path::PathBuf};
-use std::{fs::remove_dir, path::Path};
-
 use anyhow::Result;
 use nix::unistd::Pid;
 use procfs::process::Process;
 
 use crate::{cgroups::ControllerType,  utils::PathBufExt};
 use oci_spec::LinuxResources;
-use super::{
-    blkio::Blkio, devices::Devices, hugetlb::Hugetlb, memory::Memory,
-    network_classifier::NetworkClassifier, network_priority::NetworkPriority, pids::Pids,
-    Controller,
-};
-
-const CONTROLLERS: &[ControllerType] = &[
-    ControllerType::Devices,
-    ControllerType::HugeTlb,
-    ControllerType::Memory,
-    ControllerType::Pids,
-    ControllerType::Blkio,
-    ControllerType::NetworkPriority,
-    ControllerType::NetworkClassifier,
-];
-
-pub struct Manager {
-    subsystems: HashMap<String, PathBuf>,
-}
-
-impl Manager {
-    pub fn new(cgroup_path: PathBuf) -> Result<Self> {
-        let mut subsystems = HashMap::<String, PathBuf>::new();
-        for subsystem in CONTROLLERS.iter().map(|c| c.to_string()) {
-            subsystems.insert(
-                subsystem.to_owned(),
-                Self::get_subsystem_path(&cgroup_path, &subsystem)?,
-            );
-        }
-
-        Ok(Manager { subsystems })
-    }
-
-    pub fn apply(&self, linux_resources: &LinuxResources, pid: Pid) -> Result<()> {
-        for subsys in &self.subsystems {
-            match subsys.0.as_str() {
-                "devices" => Devices::apply(linux_resources, &subsys.1, pid)?,
-                "hugetlb" => Hugetlb::apply(linux_resources, &subsys.1, pid)?,
-                "memory" => Memory::apply(linux_resources, &subsys.1, pid)?,
-                "pids" => Pids::apply(linux_resources, &subsys.1, pid)?,
-                "blkio" => Blkio::apply(linux_resources, &subsys.1, pid)?,
-                "net_prio" => NetworkPriority::apply(linux_resources, &subsys.1, pid)?,
-                "net_cls" => NetworkClassifier::apply(linux_resources, &subsys.1, pid)?,
-                _ => continue,
-            }
-        }
-
-        Ok(())
-    }
-
-    pub fn remove(&self) -> Result<()> {
-        for cgroup_path in &self.subsystems {
-            if cgroup_path.1.exists() {
-                log::debug!("remove cgroup {:?}", cgroup_path.1);
-                remove_dir(&cgroup_path.1)?;
-            }
-        }
-
-        Ok(())
-    }
-
-    fn get_subsystem_path(cgroup_path: &Path, subsystem: &str) -> anyhow::Result<PathBuf> {
-        log::debug!("Get path for subsystem: {}", subsystem);
-        let mount = Process::myself()?
-            .mountinfo()?
-            .into_iter()
-            .find(|m| {
-                if m.fs_type == "cgroup" {
-                    // Some systems mount net_prio and net_cls in the same directory
-                    // other systems mount them in their own diretories. This
-                    // should handle both cases.
-                    if subsystem == "net_cls" || subsystem == "net_prio" {
-                        return m.mount_point.ends_with("net_cls,net_prio")
-                            || m.mount_point.ends_with("net_prio,net_cls");
-                    }
-                }
-                m.mount_point.ends_with(subsystem)
-            })
-            .unwrap();
-
-        let cgroup = Process::myself()?
-            .cgroups()?
-            .into_iter()
-            .find(|c| c.controllers.contains(&subsystem.to_owned()))
-            .unwrap();
-
-        let p = if cgroup_path.to_string_lossy().into_owned().is_empty() {
-            mount
-                .mount_point
-                .join_absolute_path(Path::new(&cgroup.pathname))?
-        } else {
-            mount.mount_point.join_absolute_path(&cgroup_path)?
-        };
 
-        Ok(p)
-    }
+pub trait Manager {
+    fn apply(&self, linux_resources: &LinuxResources, pid: Pid) -> Result<()>;
+    fn remove(&self) -> Result<()>;
 }

src/cgroups/memory.rs

@@ -7,9 +7,7 @@ use std::{
 use anyhow::{Result, *};
 use nix::{errno::Errno, unistd::Pid};
 
-use crate::{
-    cgroups::Controller,
-};
+use crate::cgroups::Controller;
 use oci_spec::{LinuxMemory, LinuxResources};
 
 const CGROUP_MEMORY_SWAP_LIMIT: &str = "memory.memsw.limit_in_bytes";

src/cgroups/mod.rs

@@ -1,13 +1,17 @@
+mod blkio;
+mod cgroupsfs_manager;
 mod controller;
 mod controller_type;
 mod devices;
 mod hugetlb;
-mod blkio;
 mod manager;
 mod memory;
 mod network_classifier;
 mod network_priority;
 mod pids;
+mod systemd_manager;
+pub use cgroupsfs_manager::CGroupsFSManager;
 pub use controller::Controller;
 pub use controller_type::ControllerType;
 pub use manager::Manager;
+pub use systemd_manager::SystemDCGroupManager;

src/cgroups/network_classifier.rs

@@ -7,9 +7,7 @@ use std::{
 use anyhow::Result;
 use nix::unistd::Pid;
 
-use crate::{
-    cgroups::Controller,
-};
+use crate::cgroups::Controller;
 use oci_spec::{LinuxNetwork, LinuxResources};
 
 pub struct NetworkClassifier {}

src/cgroups/pids.rs

@@ -6,9 +6,7 @@ use std::{
 
 use anyhow::Result;
 
-use crate::{
-    cgroups::Controller,
-};
+use crate::cgroups::Controller;
 use oci_spec::{LinuxPids, LinuxResources};
 
 pub struct Pids {}

src/cgroups/systemd_manager.rs

@@ -0,0 +1,16 @@
+use crate::cgroups::Manager;
+use anyhow::Result;
+use nix::unistd::Pid;
+use oci_spec::LinuxResources;
+
+pub struct SystemDCGroupManager;
+
+impl Manager for SystemDCGroupManager {
+    fn apply(&self, linux_resources: &LinuxResources, pid: Pid) -> Result<()> {
+        Ok(())
+    }
+
+    fn remove(&self) -> Result<()> {
+        Ok(())
+    }
+}

src/create.rs

@@ -102,7 +102,10 @@ fn run_container<P: AsRef<Path>>(
     let linux = spec.linux.as_ref().unwrap();
     let namespaces: Namespaces = linux.namespaces.clone().into();
 
-    let cmanager = cgroups::Manager::new(linux.cgroups_path.clone())?;
+    let cmanager: Box<dyn cgroups::Manager> = match systemd_cgroup {
+        true => Box::new(cgroups::SystemDCGroupManager),
+        false => Box::new(cgroups::CGroupsFSManager::new(linux.cgroups_path.clone())?),
+    };
 
     match fork::fork_first(
         pid_file,

src/main.rs

@@ -9,11 +9,12 @@ use anyhow::{bail, Result};
 use clap::Clap;
 use nix::sys::signal as nix_signal;
 
+use youki::cgroups::{CGroupsFSManager, Manager, SystemDCGroupManager};
+use youki::command::linux::LinuxCommand;
 use youki::container::{Container, ContainerStatus};
 use youki::create;
 use youki::signal;
 use youki::start;
-use youki::{cgroups::Manager, command::linux::LinuxCommand};
 
 /// High-level commandline option definition
 /// This takes global options as well as individual commands as specified in [OCI runtime-spec](https://github.com/opencontainers/runtime-spec/blob/master/runtime.md)
@@ -146,8 +147,11 @@ fn main() -> Result<()> {
                     // remove the cgroup created for the container
                     // check https://man7.org/linux/man-pages/man7/cgroups.7.html
                     // creating and removing cgroups section for more information on cgroups
-
-                    let cmanager = Manager::new(spec.linux.unwrap().cgroups_path)?;
+
+                    let cmanager: Box<dyn Manager> = match systemd_cgroup {
+                        true => Box::new(SystemDCGroupManager),
+                        false => Box::new(CGroupsFSManager::new(spec.linux.unwrap().cgroups_path)?),
+                    };
                     cmanager.remove()?;
                 }
                 std::process::exit(0)

src/namespaces.rs

@@ -6,9 +6,7 @@ use nix::{
     unistd::{self, Gid, Uid},
 };
 
-use crate::{
-    command::{linux::LinuxCommand, test::TestHelperCommand, Command},
-};
+use crate::command::{linux::LinuxCommand, test::TestHelperCommand, Command};
 use oci_spec::{LinuxNamespace, LinuxNamespaceType};
 
 pub struct Namespaces {

src/process/fork.rs

@@ -15,9 +15,9 @@ use nix::unistd;
 use crate::cgroups::Manager;
 use crate::container::ContainerStatus;
 use crate::process::{child, init, parent, Process};
-use oci_spec;
 use crate::utils;
 use crate::{cond::Cond, container::Container};
+use oci_spec;
 
 pub fn fork_first<P: AsRef<Path>>(
     pid_file: Option<P>,