runc exec: refuze paused container/cgroup #727
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This is a minor refactor, adding call to libcrun_get_cgroup_mode() in libcrun_cgroup_is_container_paused(), instead of having a caller do it, and dropping the int cgroup_mode argument. Signed-off-by: Kir Kolyshkin <[email protected]>
In case the container is paused, crun exec is stuck without any diagnostics, and this is hard to debug by end user. Add a check, and refuse to exec in a paused container/cgroup. Signed-off-by: Kir Kolyshkin <[email protected]>
giuseppe
approved these changes
Sep 1, 2021
| @@ -65,8 +65,7 @@ LIBCRUN_PUBLIC int libcrun_move_process_to_cgroup (pid_t pid, pid_t init_pid, ch | |||
| LIBCRUN_PUBLIC int libcrun_update_cgroup_resources (int cgroup_mode, | |||
| runtime_spec_schema_config_linux_resources *resources, char *path, | |||
| libcrun_error_t *err); | |||
| LIBCRUN_PUBLIC int libcrun_cgroup_is_container_paused (const char *cgroup_path, int cgroup_mode, bool *paused, | |||
| libcrun_error_t *err); | |||
| LIBCRUN_PUBLIC int libcrun_cgroup_is_container_paused (const char *cgroup_path, bool *paused, libcrun_error_t *err); | |||
There was a problem hiding this comment.
it is a breaking change in a public libcrun function, but I guess we probably don't hurt anyone :-) and the API is nicer
There was a problem hiding this comment.
Debian packaging might complain about it (I barely remember they actually check that).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In case the container is paused, crun exec is stuck without
any diagnostics, and this is hard to debug by end user.
Add a check, and refuse to exec in a paused container/cgroup.
Before:
(crun exec stuck, it's unclear what is going on, and there is nothing we can do from this terminal)
After: