docker-tests: mount hierarchies and make symlinks for subsystems
Docker does not know about our named cpuacct,cpu,cpuset cgroup
hierarchy with multiple subsystems in it. So to use them with docker
in integration-cli test TestRunWithCpuset inside docker container
we need to add symlinks to them in hack/dind script.
Example:
old version of parser will do:
cat /proc/1/cgroup
11:cpu,cpuacct,name=my_cpu_cpuacct:/
...
and create and mount this hierarchy to directory
/cgroup/cpu,cpuacct,name=my_cpu_cpuacct/
so docker cannot find it because it has strange name
in new parser directory will be same as on host
/cgroup/my_cpu_cpuacct
and have symlinks for docker to find it
/cgroup/cpu -> /cgroup/my_cpu_cpuacct
/cgroup/cpuacct -> /cgroup/my_cpu_cpuacct
in other case if where is no name
cat /proc/1/cgroup
11:cpu,cpuacct:/
...
mount will be same for both parsers
/cgroup/cpu,cpuacct
and new one will also create symlinks
/cgroup/cpu -> /cgroup/cpu,cpuacct
/cgroup/cpuacct -> /cgroup/cpu,cpuacct
Signed-off-by: Pavel Tikhomirov <ptikhomirov@parallels.com>
Pavel Tikhomirov authored on 2015/01/21 23:09:53Showing 1 changed files
| ... | ... |
@@ -33,28 +33,35 @@ if [ -d /sys/kernel/security ] && ! mountpoint -q /sys/kernel/security; then |
| 33 | 33 |
fi |
| 34 | 34 |
|
| 35 | 35 |
# Mount the cgroup hierarchies exactly as they are in the parent system. |
| 36 |
-for SUBSYS in $(cut -d: -f2 /proc/1/cgroup); do |
|
| 37 |
- mkdir -p "$CGROUP/$SUBSYS" |
|
| 38 |
- if ! mountpoint -q $CGROUP/$SUBSYS; then |
|
| 39 |
- mount -n -t cgroup -o "$SUBSYS" cgroup "$CGROUP/$SUBSYS" |
|
| 40 |
- fi |
|
| 36 |
+for HIER in $(cut -d: -f2 /proc/1/cgroup); do |
|
| 41 | 37 |
|
| 42 |
- # The two following sections address a bug which manifests itself |
|
| 38 |
+ # The following sections address a bug which manifests itself |
|
| 43 | 39 |
# by a cryptic "lxc-start: no ns_cgroup option specified" when |
| 44 |
- # trying to start containers withina container. |
|
| 40 |
+ # trying to start containers within a container. |
|
| 45 | 41 |
# The bug seems to appear when the cgroup hierarchies are not |
| 46 | 42 |
# mounted on the exact same directories in the host, and in the |
| 47 | 43 |
# container. |
| 48 | 44 |
|
| 45 |
+ SUBSYSTEMS="${HIER%name=*}"
|
|
| 46 |
+ |
|
| 47 |
+ # If cgroup hierarchy is named(mounted with "-o name=foo") we |
|
| 48 |
+ # need to mount it in $CGROUP/foo to create exect same |
|
| 49 |
+ # directoryes as on host. Else we need to mount it as is e.g. |
|
| 50 |
+ # "subsys1,subsys2" if it has two subsystems |
|
| 51 |
+ |
|
| 49 | 52 |
# Named, control-less cgroups are mounted with "-o name=foo" |
| 50 | 53 |
# (and appear as such under /proc/<pid>/cgroup) but are usually |
| 51 | 54 |
# mounted on a directory named "foo" (without the "name=" prefix). |
| 52 | 55 |
# Systemd and OpenRC (and possibly others) both create such a |
| 53 |
- # cgroup. To avoid the aforementioned bug, we symlink "foo" to |
|
| 54 |
- # "name=foo". This shouldn't have any adverse effect. |
|
| 55 |
- name="${SUBSYS#name=}"
|
|
| 56 |
- if [ "$name" != "$SUBSYS" ]; then |
|
| 57 |
- ln -s "$SUBSYS" "$CGROUP/$name" |
|
| 56 |
+ # cgroup. So just mount them on directory $CGROUP/foo. |
|
| 57 |
+ |
|
| 58 |
+ OHIER=$HIER |
|
| 59 |
+ HIER="${HIER#*name=}"
|
|
| 60 |
+ |
|
| 61 |
+ mkdir -p "$CGROUP/$HIER" |
|
| 62 |
+ |
|
| 63 |
+ if ! mountpoint -q $CGROUP/$HIER; then |
|
| 64 |
+ mount -n -t cgroup -o "$OHIER" cgroup "$CGROUP/$HIER" |
|
| 58 | 65 |
fi |
| 59 | 66 |
|
| 60 | 67 |
# Likewise, on at least one system, it has been reported that |
| ... | ... |
@@ -62,8 +69,25 @@ for SUBSYS in $(cut -d: -f2 /proc/1/cgroup); do |
| 62 | 62 |
# (respectively "cpu" and "cpuacct") with "-o cpuacct,cpu" |
| 63 | 63 |
# but on a directory called "cpu,cpuacct" (note the inversion |
| 64 | 64 |
# in the order of the groups). This tries to work around it. |
| 65 |
- if [ "$SUBSYS" = 'cpuacct,cpu' ]; then |
|
| 66 |
- ln -s "$SUBSYS" "$CGROUP/cpu,cpuacct" |
|
| 65 |
+ |
|
| 66 |
+ if [ "$HIER" = 'cpuacct,cpu' ]; then |
|
| 67 |
+ ln -s "$HIER" "$CGROUP/cpu,cpuacct" |
|
| 68 |
+ fi |
|
| 69 |
+ |
|
| 70 |
+ # If hierarchy has multiple subsystems, in /proc/<pid>/cgroup |
|
| 71 |
+ # we will see ":subsys1,subsys2,subsys3,name=foo:" substring, |
|
| 72 |
+ # we need to mount it to "$CGROUP/foo" and if there were no |
|
| 73 |
+ # name to "$CGROUP/subsys1,subsys2,subsys3", so we must create |
|
| 74 |
+ # symlinks for docker daemon to find these subsystems: |
|
| 75 |
+ # ln -s $CGROUP/foo $CGROUP/subsys1 |
|
| 76 |
+ # ln -s $CGROUP/subsys1,subsys2,subsys3 $CGROUP/subsys1 |
|
| 77 |
+ |
|
| 78 |
+ if [ "$SUBSYSTEMS" != "${SUBSYSTEMS//,/ }" ]; then
|
|
| 79 |
+ SUBSYSTEMS="${SUBSYSTEMS//,/ }"
|
|
| 80 |
+ for SUBSYS in $SUBSYSTEMS |
|
| 81 |
+ do |
|
| 82 |
+ ln -s "$CGROUP/$HIER" "$CGROUP/$SUBSYS" |
|
| 83 |
+ done |
|
| 67 | 84 |
fi |
| 68 | 85 |
done |
| 69 | 86 |
|