diff --git a/src/agent/rustjail/src/cgroups/fs/mod.rs b/src/agent/rustjail/src/cgroups/fs/mod.rs index becc560363..6eaa9870df 100644 --- a/src/agent/rustjail/src/cgroups/fs/mod.rs +++ b/src/agent/rustjail/src/cgroups/fs/mod.rs @@ -267,6 +267,10 @@ impl CgroupManager for Manager { fn as_any(&self) -> Result<&dyn Any> { Ok(self) } + + fn name(&self) -> &str { + "cgroupfs" + } } fn set_network_resources( diff --git a/src/agent/rustjail/src/cgroups/mock.rs b/src/agent/rustjail/src/cgroups/mock.rs index fbad6d6642..3bcc99955c 100644 --- a/src/agent/rustjail/src/cgroups/mock.rs +++ b/src/agent/rustjail/src/cgroups/mock.rs @@ -66,6 +66,10 @@ impl CgroupManager for Manager { fn as_any(&self) -> Result<&dyn Any> { Ok(self) } + + fn name(&self) -> &str { + "mock" + } } impl Manager { diff --git a/src/agent/rustjail/src/cgroups/mod.rs b/src/agent/rustjail/src/cgroups/mod.rs index 24275c3148..c4e3b178b5 100644 --- a/src/agent/rustjail/src/cgroups/mod.rs +++ b/src/agent/rustjail/src/cgroups/mod.rs @@ -52,10 +52,12 @@ pub trait Manager { fn as_any(&self) -> Result<&dyn Any> { Err(anyhow!("not supported!")) } + + fn name(&self) -> &str; } impl Debug for dyn Manager + Send + Sync { fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result { - write!(f, "CgroupManager") + write!(f, "{}", self.name()) } } diff --git a/src/agent/rustjail/src/cgroups/systemd/manager.rs b/src/agent/rustjail/src/cgroups/systemd/manager.rs index 481ef1e60e..c52e727e4c 100644 --- a/src/agent/rustjail/src/cgroups/systemd/manager.rs +++ b/src/agent/rustjail/src/cgroups/systemd/manager.rs @@ -101,6 +101,10 @@ impl CgroupManager for Manager { fn as_any(&self) -> Result<&dyn Any> { Ok(self) } + + fn name(&self) -> &str { + "systemd" + } } impl Manager { diff --git a/src/agent/rustjail/src/container.rs b/src/agent/rustjail/src/container.rs index 0ded5a093a..60b936557d 100644 --- a/src/agent/rustjail/src/container.rs +++ b/src/agent/rustjail/src/container.rs @@ -1473,7 +1473,7 @@ impl LinuxContainer { pub fn new + Display + Clone>( id: T, base: T, - mut config: Config, + config: Config, logger: &Logger, ) -> Result { let base = base.into(); @@ -1499,26 +1499,18 @@ impl LinuxContainer { .context(format!("Cannot change owner of container {} root", id))?; let spec = config.spec.as_ref().unwrap(); - let linux = spec.linux.as_ref().unwrap(); - - // determine which cgroup driver to take and then assign to config.use_systemd_cgroup - // systemd: "[slice]:[prefix]:[name]" - // fs: "/path_a/path_b" - let cpath = if SYSTEMD_CGROUP_PATH_FORMAT.is_match(linux.cgroups_path.as_str()) { - config.use_systemd_cgroup = true; + let cpath = if config.use_systemd_cgroup { if linux.cgroups_path.len() == 2 { format!("system.slice:kata_agent:{}", id.as_str()) } else { linux.cgroups_path.clone() } + } else if linux.cgroups_path.is_empty() { + format!("/{}", id.as_str()) } else { - config.use_systemd_cgroup = false; - if linux.cgroups_path.is_empty() { - format!("/{}", id.as_str()) - } else { - linux.cgroups_path.clone() - } + // if we have a systemd cgroup path we need to convert it to a fs cgroup path + linux.cgroups_path.replace(':', "/") }; let cgroup_manager: Box = if config.use_systemd_cgroup { diff --git a/src/agent/src/main.rs b/src/agent/src/main.rs index 2c1f41defe..d8e9fc828b 100644 --- a/src/agent/src/main.rs +++ b/src/agent/src/main.rs @@ -339,7 +339,7 @@ async fn start_sandbox( sandbox.lock().await.sender = Some(tx); // vsock:///dev/vsock, port - let mut server = rpc::start(sandbox.clone(), config.server_addr.as_str())?; + let mut server = rpc::start(sandbox.clone(), config.server_addr.as_str(), init_mode)?; server.start().await?; rx.await?; diff --git a/src/agent/src/rpc.rs b/src/agent/src/rpc.rs index bb34c0f5eb..3c0bc54c75 100644 --- a/src/agent/src/rpc.rs +++ b/src/agent/src/rpc.rs @@ -36,7 +36,7 @@ use protocols::health::{ use protocols::types::Interface; use protocols::{agent_ttrpc_async as agent_ttrpc, health_ttrpc_async as health_ttrpc}; use rustjail::cgroups::notifier; -use rustjail::container::{BaseContainer, Container, LinuxContainer}; +use rustjail::container::{BaseContainer, Container, LinuxContainer, SYSTEMD_CGROUP_PATH_FORMAT}; use rustjail::process::Process; use rustjail::specconv::CreateOpts; @@ -137,6 +137,7 @@ macro_rules! is_allowed { #[derive(Clone, Debug)] pub struct AgentService { sandbox: Arc>, + init_mode: bool, } impl AgentService { @@ -210,9 +211,20 @@ impl AgentService { // restore the cwd for kata-agent process. defer!(unistd::chdir(&olddir).unwrap()); + // determine which cgroup driver to take and then assign to use_systemd_cgroup + // systemd: "[slice]:[prefix]:[name]" + // fs: "/path_a/path_b" + // If agent is init we can't use systemd cgroup mode, no matter what the host tells us + let cgroups_path = oci.linux.as_ref().map_or("", |linux| &linux.cgroups_path); + let use_systemd_cgroup = if self.init_mode { + false + } else { + SYSTEMD_CGROUP_PATH_FORMAT.is_match(cgroups_path) + }; + let opts = CreateOpts { cgroup_name: "".to_string(), - use_systemd_cgroup: false, + use_systemd_cgroup, no_pivot_root: s.no_pivot_root, no_new_keyring: false, spec: Some(oci.clone()), @@ -1673,9 +1685,11 @@ async fn read_stream(reader: Arc>>, l: usize) -> Resu Ok(content) } -pub fn start(s: Arc>, server_address: &str) -> Result { - let agent_service = - Box::new(AgentService { sandbox: s }) as Box; +pub fn start(s: Arc>, server_address: &str, init_mode: bool) -> Result { + let agent_service = Box::new(AgentService { + sandbox: s, + init_mode, + }) as Box; let agent_worker = Arc::new(agent_service); @@ -2146,6 +2160,7 @@ mod tests { let agent_service = Box::new(AgentService { sandbox: Arc::new(Mutex::new(sandbox)), + init_mode: true, }); let req = protocols::agent::UpdateInterfaceRequest::default(); @@ -2163,6 +2178,7 @@ mod tests { let agent_service = Box::new(AgentService { sandbox: Arc::new(Mutex::new(sandbox)), + init_mode: true, }); let req = protocols::agent::UpdateRoutesRequest::default(); @@ -2180,6 +2196,7 @@ mod tests { let agent_service = Box::new(AgentService { sandbox: Arc::new(Mutex::new(sandbox)), + init_mode: true, }); let req = protocols::agent::AddARPNeighborsRequest::default(); @@ -2313,6 +2330,7 @@ mod tests { let agent_service = Box::new(AgentService { sandbox: Arc::new(Mutex::new(sandbox)), + init_mode: true, }); let result = agent_service @@ -2793,6 +2811,7 @@ OtherField:other let sandbox = Sandbox::new(&logger).unwrap(); let agent_service = Box::new(AgentService { sandbox: Arc::new(Mutex::new(sandbox)), + init_mode: true, }); let ctx = mk_ttrpc_context();