@@ -59,7 +59,7 @@ clone git github.com/miekg/pkcs11 80f102b5cac759de406949c47f0928b99bd64cdf

 clone git github.com/docker/go v1.5.1-1-1-gbaf439e

 clone git github.com/agl/ed25519 d2b94fd789ea21d12fac1a4443dd3a3f79cda72c

-clone git github.com/opencontainers/runc 3d8a20bb772defc28c355534d83486416d1719b4 # libcontainer

+clone git github.com/opencontainers/runc ce72f86a2b54bc114d6ffb51f6500479b2d42154 # libcontainer

 clone git github.com/seccomp/libseccomp-golang 1b506fc7c24eec5a3693cdcbed40d9c226cfc6a1

 # libcontainer deps (see src/github.com/opencontainers/runc/Godeps/Godeps.json)

 clone git github.com/coreos/go-systemd v4

@@ -10,80 +10,165 @@ host system and which is (optionally) isolated from other containers in the syst

 #### Using libcontainer

-To create a container you first have to initialize an instance of a factory

-that will handle the creation and initialization for a container.

+Because containers are spawned in a two step process you will need a binary that

+will be executed as the init process for the container. In libcontainer, we use

+the current binary (/proc/self/exe) to be executed as the init process, and use

+arg "init", we call the first step process "bootstrap", so you always need a "init"

+function as the entry of "bootstrap".

-Because containers are spawned in a two step process you will need to provide

-arguments to a binary that will be executed as the init process for the container.

-To use the current binary that is spawning the containers and acting as the parent

-you can use `os.Args[0]` and we have a command called `init` setup.

+```go

+func init() {

+	if len(os.Args) > 1 && os.Args[1] == "init" {

+		runtime.GOMAXPROCS(1)

+		runtime.LockOSThread()

+		factory, _ := libcontainer.New("")

+		if err := factory.StartInitialization(); err != nil {

+			logrus.Fatal(err)

+		}

+		panic("--this line should have never been executed, congratulations--")

+	}

+}

+```

+

+Then to create a container you first have to initialize an instance of a factory

+that will handle the creation and initialization for a container.

 ```go

-root, err := libcontainer.New("/var/lib/container", libcontainer.InitArgs(os.Args[0], "init"))

+factory, err := libcontainer.New("/var/lib/container", libcontainer.Cgroupfs, libcontainer.InitArgs(os.Args[0], "init"))

 if err != nil {

-    log.Fatal(err)

+	logrus.Fatal(err)

+	return

 }

 ```

 Once you have an instance of the factory created we can create a configuration

-struct describing how the container is to be created.  A sample would look similar to this:

+struct describing how the container is to be created. A sample would look similar to this:

 ```go

+defaultMountFlags := syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV

 config := &configs.Config{

-    Rootfs: rootfs,

-    Capabilities: []string{

-        "CAP_CHOWN",

-        "CAP_DAC_OVERRIDE",

-        "CAP_FSETID",

-        "CAP_FOWNER",

-        "CAP_MKNOD",

-        "CAP_NET_RAW",

-        "CAP_SETGID",

-        "CAP_SETUID",

-        "CAP_SETFCAP",

-        "CAP_SETPCAP",

-        "CAP_NET_BIND_SERVICE",

-        "CAP_SYS_CHROOT",

-        "CAP_KILL",

-        "CAP_AUDIT_WRITE",

-    },

-    Namespaces: configs.Namespaces([]configs.Namespace{

-        {Type: configs.NEWNS},

-        {Type: configs.NEWUTS},

-        {Type: configs.NEWIPC},

-        {Type: configs.NEWPID},

-        {Type: configs.NEWNET},

-    }),

-    Cgroups: &configs.Cgroup{

-        Name:            "test-container",

-        Parent:          "system",

-        AllowAllDevices: false,

-        AllowedDevices:  configs.DefaultAllowedDevices,

-    },

-

-    Devices:  configs.DefaultAutoCreatedDevices,

-    Hostname: "testing",

-    Networks: []*configs.Network{

-        {

-            Type:    "loopback",

-            Address: "127.0.0.1/0",

-            Gateway: "localhost",

-        },

-    },

-    Rlimits: []configs.Rlimit{

-        {

-            Type: syscall.RLIMIT_NOFILE,

-            Hard: uint64(1024),

-            Soft: uint64(1024),

-        },

-    },

+	Rootfs: "/your/path/to/rootfs",

+	Capabilities: []string{

+		"CAP_CHOWN",

+		"CAP_DAC_OVERRIDE",

+		"CAP_FSETID",

+		"CAP_FOWNER",

+		"CAP_MKNOD",

+		"CAP_NET_RAW",

+		"CAP_SETGID",

+		"CAP_SETUID",

+		"CAP_SETFCAP",

+		"CAP_SETPCAP",

+		"CAP_NET_BIND_SERVICE",

+		"CAP_SYS_CHROOT",

+		"CAP_KILL",

+		"CAP_AUDIT_WRITE",

+	},

+	Namespaces: configs.Namespaces([]configs.Namespace{

+		{Type: configs.NEWNS},

+		{Type: configs.NEWUTS},

+		{Type: configs.NEWIPC},

+		{Type: configs.NEWPID},

+		{Type: configs.NEWUSER},

+		{Type: configs.NEWNET},

+	}),

+	Cgroups: &configs.Cgroup{

+		Name:   "test-container",

+		Parent: "system",

+		Resources: &configs.Resources{

+			MemorySwappiness: -1,

+			AllowAllDevices:  false,

+			AllowedDevices:   configs.DefaultAllowedDevices,

+		},

+	},

+	MaskPaths: []string{

+		"/proc/kcore",

+	},

+	ReadonlyPaths: []string{

+		"/proc/sys", "/proc/sysrq-trigger", "/proc/irq", "/proc/bus",

+	},

+	Devices:  configs.DefaultAutoCreatedDevices,

+	Hostname: "testing",

+	Mounts: []*configs.Mount{

+		{

+			Source:      "proc",

+			Destination: "/proc",

+			Device:      "proc",

+			Flags:       defaultMountFlags,

+		},

+		{

+			Source:      "tmpfs",

+			Destination: "/dev",

+			Device:      "tmpfs",

+			Flags:       syscall.MS_NOSUID | syscall.MS_STRICTATIME,

+			Data:        "mode=755",

+		},

+		{

+			Source:      "devpts",

+			Destination: "/dev/pts",

+			Device:      "devpts",

+			Flags:       syscall.MS_NOSUID | syscall.MS_NOEXEC,

+			Data:        "newinstance,ptmxmode=0666,mode=0620,gid=5",

+		},

+		{

+			Device:      "tmpfs",

+			Source:      "shm",

+			Destination: "/dev/shm",

+			Data:        "mode=1777,size=65536k",

+			Flags:       defaultMountFlags,

+		},

+		{

+			Source:      "mqueue",

+			Destination: "/dev/mqueue",

+			Device:      "mqueue",

+			Flags:       defaultMountFlags,

+		},

+		{

+			Source:      "sysfs",

+			Destination: "/sys",

+			Device:      "sysfs",

+			Flags:       defaultMountFlags | syscall.MS_RDONLY,

+		},

+	},

+	UidMappings: []configs.IDMap{

+		{

+			ContainerID: 0,

+			Host: 1000,

+			size: 65536,

+		},

+	},

+	GidMappings: []configs.IDMap{

+		{

+			ContainerID: 0,

+			Host: 1000,

+			size: 65536,

+		},

+	},

+	Networks: []*configs.Network{

+		{

+			Type:    "loopback",

+			Address: "127.0.0.1/0",

+			Gateway: "localhost",

+		},

+	},

+	Rlimits: []configs.Rlimit{

+		{

+			Type: syscall.RLIMIT_NOFILE,

+			Hard: uint64(1025),

+			Soft: uint64(1025),

+		},

+	},

 }

 ```

 Once you have the configuration populated you can create a container:

 ```go

-container, err := root.Create("container-id", config)

+container, err := factory.Create("container-id", config)

+if err != nil {

+	logrus.Fatal(err)

+	return

+}

 ```

 To spawn bash as the initial process inside the container and have the

@@ -91,23 +176,25 @@ processes pid returned in order to wait, signal, or kill the process:

 ```go

 process := &libcontainer.Process{

-    Args:   []string{"/bin/bash"},

-    Env:    []string{"PATH=/bin"},

-    User:   "daemon",

-    Stdin:  os.Stdin,

-    Stdout: os.Stdout,

-    Stderr: os.Stderr,

+	Args:   []string{"/bin/bash"},

+	Env:    []string{"PATH=/bin"},

+	User:   "daemon",

+	Stdin:  os.Stdin,

+	Stdout: os.Stdout,

+	Stderr: os.Stderr,

 }

 err := container.Start(process)

 if err != nil {

-    log.Fatal(err)

+	logrus.Fatal(err)

+	container.Destroy()

+	return

 }

 // wait for the process to finish.

-status, err := process.Wait()

+_, err := process.Wait()

 if err != nil {

-    log.Fatal(err)

+	logrus.Fatal(err)

 }

 // destroy the container.

@@ -124,7 +211,6 @@ processes, err := container.Processes()

 // it's processes.

 stats, err := container.Stats()

-

 // pause all processes inside the container.

 container.Pause()

@@ -60,7 +60,7 @@ are required to be mounted within the rootfs that the runtime will setup.

 After a container's filesystems are mounted within the newly created 

 mount namespace `/dev` will need to be populated with a set of device nodes.

 It is expected that a rootfs does not need to have any device nodes specified

-for `/dev` witin the rootfs as the container will setup the correct devices

+for `/dev` within the rootfs as the container will setup the correct devices

 that are required for executing a container's process.

 |      Path    | Mode |   Access   |

@@ -142,6 +142,7 @@ system resources like cpu, memory, and device access.

 | perf_event | 1       |

 | freezer    | 1       |

 | hugetlb    | 1       |

+| pids       | 1       |

 All cgroup subsystem are joined so that statistics can be collected from

@@ -199,7 +200,7 @@ provide a good default for security and flexibility for the applications.

 | CAP_SYS_BOOT         | 0       |

 | CAP_LEASE            | 0       |

 | CAP_WAKE_ALARM       | 0       |

-| CAP_BLOCK_SUSPE      | 0       |

+| CAP_BLOCK_SUSPEND    | 0       |

 Additional security layers like [apparmor](https://wiki.ubuntu.com/AppArmor)

@@ -15,6 +15,9 @@ type Manager interface {

 	// Returns the PIDs inside the cgroup set

 	GetPids() ([]int, error)

+	// Returns the PIDs inside the cgroup set & all sub-cgroups

+	GetAllPids() ([]int, error)

+

 	// Returns statistics for the cgroup set

 	GetStats() (*Stats, error)

@@ -14,6 +14,7 @@ import (

 	"github.com/opencontainers/runc/libcontainer/cgroups"

 	"github.com/opencontainers/runc/libcontainer/configs"

+	libcontainerUtils "github.com/opencontainers/runc/libcontainer/utils"

 )

 var (

@@ -23,6 +24,7 @@ var (

 		&MemoryGroup{},

 		&CpuGroup{},

 		&CpuacctGroup{},

+		&PidsGroup{},

 		&BlkioGroup{},

 		&HugetlbGroup{},

 		&NetClsGroup{},

@@ -93,11 +95,10 @@ func getCgroupRoot() (string, error) {

 }

 type cgroupData struct {

-	root   string

-	parent string

-	name   string

-	config *configs.Cgroup

-	pid    int

+	root      string

+	innerPath string

+	config    *configs.Cgroup

+	pid       int

 }

 func (m *Manager) Apply(pid int) (err error) {

@@ -112,6 +113,22 @@ func (m *Manager) Apply(pid int) (err error) {

 		return err

 	}

+	if c.Paths != nil {

+		paths := make(map[string]string)

+		for name, path := range c.Paths {

+			_, err := d.path(name)

+			if err != nil {

+				if cgroups.IsNotFound(err) {

+					continue

+				}

+				return err

+			}

+			paths[name] = path

+		}

+		m.Paths = paths

+		return cgroups.EnterPid(m.Paths, pid)

+	}

+

 	paths := make(map[string]string)

 	defer func() {

 		if err != nil {

@@ -135,17 +152,13 @@ func (m *Manager) Apply(pid int) (err error) {

 		paths[sys.Name()] = p

 	}

 	m.Paths = paths

-

-	if paths["cpu"] != "" {

-		if err := CheckCpushares(paths["cpu"], c.Resources.CpuShares); err != nil {

-			return err

-		}

-	}

-

 	return nil

 }

 func (m *Manager) Destroy() error {

+	if m.Cgroups.Paths != nil {

+		return nil

+	}

 	m.mu.Lock()

 	defer m.mu.Unlock()

 	if err := cgroups.RemovePaths(m.Paths); err != nil {

@@ -179,15 +192,28 @@ func (m *Manager) GetStats() (*cgroups.Stats, error) {

 }

 func (m *Manager) Set(container *configs.Config) error {

-	for name, path := range m.Paths {

-		sys, err := subsystems.Get(name)

-		if err == errSubsystemDoesNotExist || !cgroups.PathExists(path) {

-			continue

+	for _, sys := range subsystems {

+		// Generate fake cgroup data.

+		d, err := getCgroupData(container.Cgroups, -1)

+		if err != nil {

+			return err

+		}

+		// Get the path, but don't error out if the cgroup wasn't found.

+		path, err := d.path(sys.Name())

+		if err != nil && !cgroups.IsNotFound(err) {

+			return err

 		}

+

 		if err := sys.Set(path, container.Cgroups); err != nil {

 			return err

 		}

 	}

+

+	if m.Paths["cpu"] != "" {

+		if err := CheckCpushares(m.Paths["cpu"], container.Cgroups.Resources.CpuShares); err != nil {

+			return err

+		}

+	}

 	return nil

 }

@@ -217,41 +243,28 @@ func (m *Manager) Freeze(state configs.FreezerState) error {

 }

 func (m *Manager) GetPids() ([]int, error) {

-	d, err := getCgroupData(m.Cgroups, 0)

+	dir, err := getCgroupPath(m.Cgroups)

 	if err != nil {

 		return nil, err

 	}

+	return cgroups.GetPids(dir)

+}

-	dir, err := d.path("devices")

+func (m *Manager) GetAllPids() ([]int, error) {

+	dir, err := getCgroupPath(m.Cgroups)

 	if err != nil {

 		return nil, err

 	}

-

-	return cgroups.GetPids(dir)

+	return cgroups.GetAllPids(dir)

 }

-// pathClean makes a path safe for use with filepath.Join. This is done by not

-// only cleaning the path, but also (if the path is relative) adding a leading

-// '/' and cleaning it (then removing the leading '/'). This ensures that a

-// path resulting from prepending another path will always resolve to lexically

-// be a subdirectory of the prefixed path. This is all done lexically, so paths

-// that include symlinks won't be safe as a result of using pathClean.

-func pathClean(path string) string {

-	// Ensure that all paths are cleaned (especially problematic ones like

-	// "/../../../../../" which can cause lots of issues).

-	path = filepath.Clean(path)

-

-	// If the path isn't absolute, we need to do more processing to fix paths

-	// such as "../../../../<etc>/some/path". We also shouldn't convert absolute

-	// paths to relative ones.

-	if !filepath.IsAbs(path) {

-		path = filepath.Clean(string(os.PathSeparator) + path)

-		// This can't fail, as (by definition) all paths are relative to root.

-		path, _ = filepath.Rel(string(os.PathSeparator), path)

-	}

-

-	// Clean the path again for good measure.

-	return filepath.Clean(path)

+func getCgroupPath(c *configs.Cgroup) (string, error) {

+	d, err := getCgroupData(c, 0)

+	if err != nil {

+		return "", err

+	}

+

+	return d.path("devices")

 }

 func getCgroupData(c *configs.Cgroup, pid int) (*cgroupData, error) {

@@ -260,15 +273,25 @@ func getCgroupData(c *configs.Cgroup, pid int) (*cgroupData, error) {

 		return nil, err

 	}

-	// Clean the parent slice path.

-	c.Parent = pathClean(c.Parent)

+	if (c.Name != "" || c.Parent != "") && c.Path != "" {

+		return nil, fmt.Errorf("cgroup: either Path or Name and Parent should be used")

+	}

+

+	// XXX: Do not remove this code. Path safety is important! -- cyphar

+	cgPath := libcontainerUtils.CleanPath(c.Path)

+	cgParent := libcontainerUtils.CleanPath(c.Parent)

+	cgName := libcontainerUtils.CleanPath(c.Name)

+

+	innerPath := cgPath

+	if innerPath == "" {

+		innerPath = filepath.Join(cgParent, cgName)

+	}

 	return &cgroupData{

-		root:   root,

-		parent: c.Parent,

-		name:   c.Name,

-		config: c,

-		pid:    pid,

+		root:      root,

+		innerPath: innerPath,

+		config:    c,

+		pid:       pid,

 	}, nil

 }

@@ -296,11 +319,10 @@ func (raw *cgroupData) path(subsystem string) (string, error) {

 		return "", err

 	}

-	cgPath := filepath.Join(raw.parent, raw.name)

 	// If the cgroup name/path is absolute do not look relative to the cgroup of the init process.

-	if filepath.IsAbs(cgPath) {

+	if filepath.IsAbs(raw.innerPath) {

 		// Sometimes subsystems can be mounted togethger as 'cpu,cpuacct'.

-		return filepath.Join(raw.root, filepath.Base(mnt), cgPath), nil

+		return filepath.Join(raw.root, filepath.Base(mnt), raw.innerPath), nil

 	}

 	parentPath, err := raw.parentPath(subsystem, mnt, root)

@@ -308,7 +330,7 @@ func (raw *cgroupData) path(subsystem string) (string, error) {

 		return "", err

 	}

-	return filepath.Join(parentPath, cgPath), nil

+	return filepath.Join(parentPath, raw.innerPath), nil

 }

 func (raw *cgroupData) join(subsystem string) (string, error) {

@@ -22,15 +22,10 @@ func (s *BlkioGroup) Name() string {

 }

 func (s *BlkioGroup) Apply(d *cgroupData) error {

-	dir, err := d.join("blkio")

+	_, err := d.join("blkio")

 	if err != nil && !cgroups.IsNotFound(err) {

 		return err

 	}

-

-	if err := s.Set(dir, d.config); err != nil {

-		return err

-	}

-

 	return nil

 }

@@ -22,15 +22,10 @@ func (s *CpuGroup) Name() string {

 func (s *CpuGroup) Apply(d *cgroupData) error {

 	// We always want to join the cpu group, to allow fair cpu scheduling

 	// on a container basis

-	dir, err := d.join("cpu")

+	_, err := d.join("cpu")

 	if err != nil && !cgroups.IsNotFound(err) {

 		return err

 	}

-

-	if err := s.Set(dir, d.config); err != nil {

-		return err

-	}

-

 	return nil

 }

@@ -12,6 +12,7 @@ import (

 	"github.com/opencontainers/runc/libcontainer/cgroups"

 	"github.com/opencontainers/runc/libcontainer/configs"

+	libcontainerUtils "github.com/opencontainers/runc/libcontainer/utils"

 )

 type CpusetGroup struct {

@@ -64,11 +65,6 @@ func (s *CpusetGroup) ApplyDir(dir string, cgroup *configs.Cgroup, pid int) erro

 	if err := s.ensureParent(dir, root); err != nil {

 		return err

 	}

-	// the default values inherit from parent cgroup are already set in

-	// s.ensureParent, cover these if we have our own

-	if err := s.Set(dir, cgroup); err != nil {

-		return err

-	}

 	// because we are not using d.join we need to place the pid into the procs file

 	// unlike the other subsystems

 	if err := writeFile(dir, "cgroup.procs", strconv.Itoa(pid)); err != nil {

@@ -93,7 +89,7 @@ func (s *CpusetGroup) getSubsystemSettings(parent string) (cpus []byte, mems []b

 // it's parent.

 func (s *CpusetGroup) ensureParent(current, root string) error {

 	parent := filepath.Dir(current)

-	if filepath.Clean(parent) == root {

+	if libcontainerUtils.CleanPath(parent) == root {

 		return nil

 	}

 	// Avoid infinite recursion.

@@ -15,21 +15,29 @@ func (s *DevicesGroup) Name() string {

 }

 func (s *DevicesGroup) Apply(d *cgroupData) error {

-	dir, err := d.join("devices")

+	_, err := d.join("devices")

 	if err != nil {

 		// We will return error even it's `not found` error, devices

 		// cgroup is hard requirement for container's security.

 		return err

 	}

-

-	if err := s.Set(dir, d.config); err != nil {

-		return err

-	}

-

 	return nil

 }

 func (s *DevicesGroup) Set(path string, cgroup *configs.Cgroup) error {

+	devices := cgroup.Resources.Devices

+	if len(devices) > 0 {

+		for _, dev := range devices {

+			file := "devices.deny"

+			if dev.Allow {

+				file = "devices.allow"

+			}

+			if err := writeFile(path, file, dev.CgroupString()); err != nil {

+				return err

+			}

+		}

+		return nil

+	}

 	if !cgroup.Resources.AllowAllDevices {

 		if err := writeFile(path, "devices.deny", "a"); err != nil {

 			return err

@@ -19,15 +19,10 @@ func (s *FreezerGroup) Name() string {

 }

 func (s *FreezerGroup) Apply(d *cgroupData) error {

-	dir, err := d.join("freezer")

+	_, err := d.join("freezer")

 	if err != nil && !cgroups.IsNotFound(err) {

 		return err

 	}

-

-	if err := s.Set(dir, d.config); err != nil {

-		return err

-	}

-

 	return nil

 }

@@ -19,15 +19,10 @@ func (s *HugetlbGroup) Name() string {

 }

 func (s *HugetlbGroup) Apply(d *cgroupData) error {

-	dir, err := d.join("hugetlb")

+	_, err := d.join("hugetlb")

 	if err != nil && !cgroups.IsNotFound(err) {

 		return err

 	}

-

-	if err := s.Set(dir, d.config); err != nil {

-		return err

-	}

-

 	return nil

 }

@@ -32,8 +32,9 @@ func (s *MemoryGroup) Apply(d *cgroupData) (err error) {

 				return err

 			}

 		}

-

-		if err := s.Set(path, d.config); err != nil {

+		// We have to set kernel memory here, as we can't change it once

+		// processes have been attached.

+		if err := s.SetKernelMemory(path, d.config); err != nil {

 			return err

 		}

 	}

@@ -50,7 +51,17 @@ func (s *MemoryGroup) Apply(d *cgroupData) (err error) {

 	if err != nil && !cgroups.IsNotFound(err) {

 		return err

 	}

+	return nil

+}

+func (s *MemoryGroup) SetKernelMemory(path string, cgroup *configs.Cgroup) error {

+	// This has to be done separately because it has special constraints (it

+	// can't be done after there are processes attached to the cgroup).

+	if cgroup.Resources.KernelMemory > 0 {

+		if err := writeFile(path, "memory.kmem.limit_in_bytes", strconv.FormatInt(cgroup.Resources.KernelMemory, 10)); err != nil {

+			return err

+		}

+	}

 	return nil

 }

@@ -70,12 +81,6 @@ func (s *MemoryGroup) Set(path string, cgroup *configs.Cgroup) error {

 			return err

 		}

 	}

-	if cgroup.Resources.KernelMemory > 0 {

-		if err := writeFile(path, "memory.kmem.limit_in_bytes", strconv.FormatInt(cgroup.Resources.KernelMemory, 10)); err != nil {

-			return err

-		}

-	}

-

 	if cgroup.Resources.OomKillDisable {

 		if err := writeFile(path, "memory.oom_control", "1"); err != nil {

 			return err

@@ -157,6 +162,7 @@ func getMemoryData(path, name string) (cgroups.MemoryData, error) {

 	usage := strings.Join([]string{moduleName, "usage_in_bytes"}, ".")

 	maxUsage := strings.Join([]string{moduleName, "max_usage_in_bytes"}, ".")

 	failcnt := strings.Join([]string{moduleName, "failcnt"}, ".")

+	limit := strings.Join([]string{moduleName, "limit_in_bytes"}, ".")

 	value, err := getCgroupParamUint(path, usage)

 	if err != nil {

@@ -182,6 +188,14 @@ func getMemoryData(path, name string) (cgroups.MemoryData, error) {

 		return cgroups.MemoryData{}, fmt.Errorf("failed to parse %s - %v", failcnt, err)

 	}

 	memoryData.Failcnt = value

+	value, err = getCgroupParamUint(path, limit)

+	if err != nil {

+		if moduleName != "memory" && os.IsNotExist(err) {

+			return cgroups.MemoryData{}, nil

+		}

+		return cgroups.MemoryData{}, fmt.Errorf("failed to parse %s - %v", limit, err)

+	}

+	memoryData.Limit = value

 	return memoryData, nil

 }

@@ -15,15 +15,10 @@ func (s *NetClsGroup) Name() string {

 }

 func (s *NetClsGroup) Apply(d *cgroupData) error {

-	dir, err := d.join("net_cls")

+	_, err := d.join("net_cls")

 	if err != nil && !cgroups.IsNotFound(err) {

 		return err

 	}

-

-	if err := s.Set(dir, d.config); err != nil {

-		return err

-	}

-

 	return nil

 }

@@ -15,15 +15,10 @@ func (s *NetPrioGroup) Name() string {

 }

 func (s *NetPrioGroup) Apply(d *cgroupData) error {

-	dir, err := d.join("net_prio")

+	_, err := d.join("net_prio")

 	if err != nil && !cgroups.IsNotFound(err) {

 		return err

 	}

-

-	if err := s.Set(dir, d.config); err != nil {

-		return err

-	}

-

 	return nil

 }

new file mode 100644

@@ -0,0 +1,57 @@

+// +build linux

+

+package fs

+

+import (

+	"fmt"

+	"strconv"

+

+	"github.com/opencontainers/runc/libcontainer/cgroups"

+	"github.com/opencontainers/runc/libcontainer/configs"

+)

+

+type PidsGroup struct {

+}

+

+func (s *PidsGroup) Name() string {

+	return "pids"

+}

+

+func (s *PidsGroup) Apply(d *cgroupData) error {

+	_, err := d.join("pids")

+	if err != nil && !cgroups.IsNotFound(err) {

+		return err

+	}

+	return nil

+}

+

+func (s *PidsGroup) Set(path string, cgroup *configs.Cgroup) error {

+	if cgroup.Resources.PidsLimit != 0 {

+		// "max" is the fallback value.

+		limit := "max"

+

+		if cgroup.Resources.PidsLimit > 0 {

+			limit = strconv.FormatInt(cgroup.Resources.PidsLimit, 10)

+		}

+

+		if err := writeFile(path, "pids.max", limit); err != nil {

+			return err

+		}

+	}

+

+	return nil

+}

+

+func (s *PidsGroup) Remove(d *cgroupData) error {

+	return removePath(d.path("pids"))

+}

+

+func (s *PidsGroup) GetStats(path string, stats *cgroups.Stats) error {

+	value, err := getCgroupParamUint(path, "pids.current")

+	if err != nil {

+		return fmt.Errorf("failed to parse pids.current - %s", err)

+	}

+

+	stats.PidsStats.Current = value

+	return nil

+}

@@ -36,7 +36,9 @@ type MemoryData struct {

 	Usage    uint64 `json:"usage,omitempty"`

 	MaxUsage uint64 `json:"max_usage,omitempty"`

 	Failcnt  uint64 `json:"failcnt"`

+	Limit    uint64 `json:"limit"`

 }

+

 type MemoryStats struct {

 	// memory used for cache

 	Cache uint64 `json:"cache,omitempty"`

@@ -49,6 +51,11 @@ type MemoryStats struct {

 	Stats       map[string]uint64 `json:"stats,omitempty"`

 }

+type PidsStats struct {

+	// number of pids in the cgroup

+	Current uint64 `json:"current,omitempty"`

+}

+

 type BlkioStatEntry struct {

 	Major uint64 `json:"major,omitempty"`

 	Minor uint64 `json:"minor,omitempty"`

@@ -80,6 +87,7 @@ type HugetlbStats struct {

 type Stats struct {

 	CpuStats    CpuStats    `json:"cpu_stats,omitempty"`

 	MemoryStats MemoryStats `json:"memory_stats,omitempty"`

+	PidsStats   PidsStats   `json:"pids_stats,omitempty"`

 	BlkioStats  BlkioStats  `json:"blkio_stats,omitempty"`

 	// the map is in the format "size of hugepage: stats of the hugepage"

 	HugetlbStats map[string]HugetlbStats `json:"hugetlb_stats,omitempty"`

@@ -26,6 +26,10 @@ func (m *Manager) GetPids() ([]int, error) {

 	return nil, fmt.Errorf("Systemd not supported")

 }