Greg Kurz 600b951afd agent: Run container workload in its own cgroup namespace ...

When cgroup v2 is in use, a container should only see its part of the
unified hierarchy in `/sys/fs/cgroup`, not the full hierarchy created
at the OS level. Similarly, `/proc/self/cgroup` inside the container
should display `0::/`, rather than a full path such as :

0::/kubepods.slice/kubepods-besteffort.slice/kubepods-besteffort-podde291f58_8f20_4d44_aa89_c9e538613d85.slice/crio-9e1823d09627f3c2d42f30d76f0d2933abdbc033a630aab732339c90334fbc5f.scope

What is needed here is isolation from the OS. Do that by running the
container in its own cgroup namespace. This matches what runc and
other non VM based runtimes do.

Fixes #9124

Signed-off-by: Greg Kurz <groug@kaod.org>

2024-02-21 13:14:13 +01:00

..

src

agent: Run container workload in its own cgroup namespace

2024-02-21 13:14:13 +01:00

Cargo.toml

agent,runtime-rs,runk: fix fmt and clippy warnings

2024-01-31 21:07:48 +08:00