From 3eb7387bb741cc16a126a99f267e4dd078692a95 Mon Sep 17 00:00:00 2001 From: Jeremi Piotrowski Date: Fri, 10 Feb 2023 14:50:54 +0100 Subject: [PATCH] agent: always use cgroupfs when running as init The logic to decide which cgroup driver is used is currently based on the cgroup path that the host provides. This requires host and guest to use the same cgroup driver. If the guest uses kata-agent as init, then systemd can't be used as the cgroup driver. If the host requests a systemd cgroup, this currently results in a rustjail panic: thread 'tokio-runtime-worker' panicked at 'called `Result::unwrap()` on an `Err` value: I/O error: No such file or directory (os error 2) Caused by: No such file or directory (os error 2)', rustjail/src/cgroups/systemd/manager.rs:44:51 stack backtrace: 0: 0x7ff0fe77a793 - std::backtrace_rs::backtrace::libunwind::trace::h8c197fa9a679d134 at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/../../backtrace/src/backtrace/libunwind.rs:93:5 1: 0x7ff0fe77a793 - std::backtrace_rs::backtrace::trace_unsynchronized::h9ee19d58b6d5934a at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5 2: 0x7ff0fe77a793 - std::sys_common::backtrace::_print_fmt::h4badc450600fc417 at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/sys_common/backtrace.rs:65:5 3: 0x7ff0fe77a793 - ::fmt::had334ddb529a2169 at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/sys_common/backtrace.rs:44:22 4: 0x7ff0fdce815e - core::fmt::write::h1aa7694f03e44db2 at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/core/src/fmt/mod.rs:1209:17 5: 0x7ff0fe74e0c4 - std::io::Write::write_fmt::h61b2bdc565be41b5 at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/io/mod.rs:1682:15 6: 0x7ff0fe77cd3f - std::sys_common::backtrace::_print::h4ec69798b72ff254 at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/sys_common/backtrace.rs:47:5 7: 0x7ff0fe77cd3f - std::sys_common::backtrace::print::h0e6c02048dec3c77 at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/sys_common/backtrace.rs:34:9 8: 0x7ff0fe77c93f - std::panicking::default_hook::{{closure}}::hcdb7e705dc37ea6e at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/panicking.rs:267:22 9: 0x7ff0fe77d9b8 - std::panicking::default_hook::he03a933a0f01790f at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/panicking.rs:286:9 10: 0x7ff0fe77d9b8 - std::panicking::rust_panic_with_hook::he26b680bfd953008 at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/panicking.rs:688:13 11: 0x7ff0fe77d482 - std::panicking::begin_panic_handler::{{closure}}::h559120d2dd1c6180 at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/panicking.rs:579:13 12: 0x7ff0fe77d3ec - std::sys_common::backtrace::__rust_end_short_backtrace::h36db621fc93b005a at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/sys_common/backtrace.rs:137:18 13: 0x7ff0fe77d3c1 - rust_begin_unwind at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/panicking.rs:575:5 14: 0x7ff0fda52ee2 - core::panicking::panic_fmt::he7679b415d25c5f4 at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/core/src/panicking.rs:65:14 15: 0x7ff0fda53182 - core::result::unwrap_failed::hb71caff146724b6b at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/core/src/result.rs:1791:5 16: 0x7ff0fe5bd738 - ::apply::hd46958d9d807d2ca 17: 0x7ff0fe606d80 - ::start::{{closure}}::h1de806d91fcb878f 18: 0x7ff0fe604a76 - as core::future::future::Future>::poll::h1749c148adcc235f 19: 0x7ff0fdc0c992 - kata_agent::rpc::AgentService::do_create_container::{{closure}}::{{closure}}::hc1b87a15dfdf2f64 20: 0x7ff0fdb80ae4 - as core::future::future::Future>::poll::h846a8c9e4fb67707 21: 0x7ff0fe3bb816 - as core::future::future::Future>::poll::h53de16ff66ed3972 22: 0x7ff0fdb519cb - as core::future::future::Future>::poll::h1cbece980286c0f4 23: 0x7ff0fdf4019c - as core::future::future::Future>::poll::hc8e72d155feb8d1f 24: 0x7ff0fdfa5fd8 - tokio::loom::std::unsafe_cell::UnsafeCell::with_mut::h0a407ffe2559449a 25: 0x7ff0fdf033a1 - tokio::runtime::task::raw::poll::h1045d9f1db9742de 26: 0x7ff0fe7a8ce2 - tokio::runtime::scheduler::multi_thread::worker::Context::run_task::h4924ae3464af7fbd 27: 0x7ff0fe7afb85 - tokio::runtime::task::raw::poll::h5c843be39646b833 28: 0x7ff0fe7a05ee - std::sys_common::backtrace::__rust_begin_short_backtrace::ha7777c55b98a9bd1 29: 0x7ff0fe7a9bdb - core::ops::function::FnOnce::call_once{{vtable.shim}}::h27ec83c953360cdd 30: 0x7ff0fe7801d5 - as core::ops::function::FnOnce>::call_once::hed812350c5aef7a8 at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/alloc/src/boxed.rs:1987:9 31: 0x7ff0fe7801d5 - as core::ops::function::FnOnce>::call_once::hc7df8e435a658960 at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/alloc/src/boxed.rs:1987:9 32: 0x7ff0fe7801d5 - std::sys::unix::thread::Thread::new::thread_start::h575491a8a17dbb33 at /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/sys/unix/thread.rs:108:17 Forward the value of "init_mode" to AgentService, so that we can force cgroupfs when systemd is unavailable. Fixes: #5779 Signed-off-by: Jeremi Piotrowski (cherry picked from commit 192df845885f5dab27abf78751b3035f68e3d786) Signed-off-by: Greg Kurz --- src/agent/rustjail/src/container.rs | 9 ++++----- src/agent/src/main.rs | 2 +- src/agent/src/rpc.rs | 21 +++++++++++++++++---- 3 files changed, 22 insertions(+), 10 deletions(-) diff --git a/src/agent/rustjail/src/container.rs b/src/agent/rustjail/src/container.rs index ed69ef60d1..15b7d39cef 100644 --- a/src/agent/rustjail/src/container.rs +++ b/src/agent/rustjail/src/container.rs @@ -1482,12 +1482,11 @@ impl LinuxContainer { } else { linux.cgroups_path.clone() } + } else if linux.cgroups_path.is_empty() { + format!("/{}", id.as_str()) } else { - if linux.cgroups_path.is_empty() { - format!("/{}", id.as_str()) - } else { - linux.cgroups_path.clone() - } + // if we have a systemd cgroup path we need to convert it to a fs cgroup path + linux.cgroups_path.replace(':', "/") }; let cgroup_manager: Box = if config.use_systemd_cgroup { diff --git a/src/agent/src/main.rs b/src/agent/src/main.rs index 2c1f41defe..d8e9fc828b 100644 --- a/src/agent/src/main.rs +++ b/src/agent/src/main.rs @@ -339,7 +339,7 @@ async fn start_sandbox( sandbox.lock().await.sender = Some(tx); // vsock:///dev/vsock, port - let mut server = rpc::start(sandbox.clone(), config.server_addr.as_str())?; + let mut server = rpc::start(sandbox.clone(), config.server_addr.as_str(), init_mode)?; server.start().await?; rx.await?; diff --git a/src/agent/src/rpc.rs b/src/agent/src/rpc.rs index 0081765416..3be8fed5c8 100644 --- a/src/agent/src/rpc.rs +++ b/src/agent/src/rpc.rs @@ -137,6 +137,7 @@ macro_rules! is_allowed { #[derive(Clone, Debug)] pub struct AgentService { sandbox: Arc>, + init_mode: bool, } impl AgentService { @@ -213,8 +214,13 @@ impl AgentService { // determine which cgroup driver to take and then assign to use_systemd_cgroup // systemd: "[slice]:[prefix]:[name]" // fs: "/path_a/path_b" + // If agent is init we can't use systemd cgroup mode, no matter what the host tells us let cgroups_path = oci.linux.as_ref().map_or("", |linux| &linux.cgroups_path); - let use_systemd_cgroup = SYSTEMD_CGROUP_PATH_FORMAT.is_match(cgroups_path); + let use_systemd_cgroup = if self.init_mode { + false + } else { + SYSTEMD_CGROUP_PATH_FORMAT.is_match(cgroups_path) + }; let opts = CreateOpts { cgroup_name: "".to_string(), @@ -1679,9 +1685,11 @@ async fn read_stream(reader: Arc>>, l: usize) -> Resu Ok(content) } -pub fn start(s: Arc>, server_address: &str) -> Result { - let agent_service = - Box::new(AgentService { sandbox: s }) as Box; +pub fn start(s: Arc>, server_address: &str, init_mode: bool) -> Result { + let agent_service = Box::new(AgentService { + sandbox: s, + init_mode, + }) as Box; let agent_worker = Arc::new(agent_service); @@ -2157,6 +2165,7 @@ mod tests { let agent_service = Box::new(AgentService { sandbox: Arc::new(Mutex::new(sandbox)), + init_mode: true, }); let req = protocols::agent::UpdateInterfaceRequest::default(); @@ -2174,6 +2183,7 @@ mod tests { let agent_service = Box::new(AgentService { sandbox: Arc::new(Mutex::new(sandbox)), + init_mode: true, }); let req = protocols::agent::UpdateRoutesRequest::default(); @@ -2191,6 +2201,7 @@ mod tests { let agent_service = Box::new(AgentService { sandbox: Arc::new(Mutex::new(sandbox)), + init_mode: true, }); let req = protocols::agent::AddARPNeighborsRequest::default(); @@ -2324,6 +2335,7 @@ mod tests { let agent_service = Box::new(AgentService { sandbox: Arc::new(Mutex::new(sandbox)), + init_mode: true, }); let result = agent_service @@ -2804,6 +2816,7 @@ OtherField:other let sandbox = Sandbox::new(&logger).unwrap(); let agent_service = Box::new(AgentService { sandbox: Arc::new(Mutex::new(sandbox)), + init_mode: true, }); let ctx = mk_ttrpc_context();