[libvirt] [PATCH] lxc: don't try to hide parent cgroups inside container
On the host when we start a container, it will be
placed in a cgroup path of
/machine.slice/machine-lxc\x2ddemo.scope
under /sys/fs/cgroup/*
Inside the containers' namespace we need to setup
/sys/fs/cgroup mounts, and currently will bind
mount /machine.slice/machine-lxc\x2ddemo.scope on
the host to appear as / in the container.
While this may sound nice, it confuses applications
dealing with cgroups, because /proc/$PID/cgroup
now does not match the directory in /sys/fs/cgroup
This particularly causes problems for systems and
will make it create repeated path components in
the cgroup for apps run in the container eg
/machine.slice/machine-lxc\x2ddemo.scope/machine.slice/machine-lxc\x2ddemo.scope/user.slice/user-0.slice/session-61.scope
This also causes any systemd service that uses
sd-notify to fail to start, because when systemd
receives the notification it won't be able to
identify the corresponding unit it came from.
In particular this break rabbitmq-server startup
Future kernels will provide proper cgroup namespacing
which will handle this problem, but until that time
we should not try to play games with hiding parent
cgroups.
Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com>
---
src/libvirt_private.syms | 2 +-
src/lxc/lxc_container.c | 2 +-
src/util/vircgroup.c | 9 ++++-----
src/util/vircgroup.h | 6 +++---
4 files changed, 9 insertions(+), 10 deletions(-)
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 5e05a98..1732421 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -1194,6 +1194,7 @@ virCgroupAllowDevice;
virCgroupAllowDeviceMajor;
virCgroupAllowDevicePath;
virCgroupAvailable;
+virCgroupBindMount;
virCgroupControllerAvailable;
virCgroupControllerTypeFromString;
virCgroupControllerTypeToString;
@@ -1231,7 +1232,6 @@ virCgroupGetMemSwapUsage;
virCgroupGetPercpuStats;
virCgroupHasController;
virCgroupHasEmptyTasks;
-virCgroupIsolateMount;
virCgroupKill;
virCgroupKillPainfully;
virCgroupKillRecursive;
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
index c5a70a1..a6805ac 100644
--- a/src/lxc/lxc_container.c
+++ b/src/lxc/lxc_container.c
@@ -1827,7 +1827,7 @@ static int lxcContainerSetupPivotRoot(virDomainDefPtr vmDef,
/* Now we can re-mount the cgroups controllers in the
* same configuration as before */
- if (virCgroupIsolateMount(cgroup, "/.oldroot/", sec_mount_options) < 0)
+ if (virCgroupBindMount(cgroup, "/.oldroot/", sec_mount_options) < 0)
goto cleanup;
/* Mounts /dev */
diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c
index 7584ee4..d7f4065 100644
--- a/src/util/vircgroup.c
+++ b/src/util/vircgroup.c
@@ -3917,8 +3917,8 @@ virCgroupGetFreezerState(virCgroupPtr group, char **state)
int
-virCgroupIsolateMount(virCgroupPtr group, const char *oldroot,
- const char *mountopts)
+virCgroupBindMount(virCgroupPtr group, const char *oldroot,
+ const char *mountopts)
{
int ret = -1;
size_t i;
@@ -3954,10 +3954,9 @@ virCgroupIsolateMount(virCgroupPtr group, const char *oldroot,
if (!virFileExists(group->controllers[i].mountPoint)) {
char *src;
- if (virAsprintf(&src, "%s%s%s",
+ if (virAsprintf(&src, "%s%s",
oldroot,
- group->controllers[i].mountPoint,
- group->controllers[i].placement) < 0)
+ group->controllers[i].mountPoint) < 0)
goto cleanup;
VIR_DEBUG("Create mount point '%s'",
diff --git a/src/util/vircgroup.h b/src/util/vircgroup.h
index 63a9e1c..d754b1f 100644
--- a/src/util/vircgroup.h
+++ b/src/util/vircgroup.h
@@ -286,9 +286,9 @@ int virCgroupKill(virCgroupPtr group, int signum);
int virCgroupKillRecursive(virCgroupPtr group, int signum);
int virCgroupKillPainfully(virCgroupPtr group);
-int virCgroupIsolateMount(virCgroupPtr group,
- const char *oldroot,
- const char *mountopts);
+int virCgroupBindMount(virCgroupPtr group,
+ const char *oldroot,
+ const char *mountopts);
bool virCgroupSupportsCpuBW(virCgroupPtr cgroup);
--
2.5.0