vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #641 from mrunalp/pids_limit

Browse source 
Pids limit
This commit is contained in:
Antonio Murdaca 2017-07-12 12:39:54 +02:00 • committed by GitHub
commit 17584facf0
8 changed files with 81 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
server/container_create.go
View file

@ -18,6 +18,7 @@ import (
"github.com/kubernetes-incubator/cri-o/server/apparmor"
"github.com/kubernetes-incubator/cri-o/server/seccomp"
"github.com/opencontainers/image-spec/specs-go/v1"
"github.com/opencontainers/runc/libcontainer/cgroups"
"github.com/opencontainers/runc/libcontainer/devices"
"github.com/opencontainers/runc/libcontainer/user"
rspec "github.com/opencontainers/runtime-spec/specs-go"
@ -323,6 +324,9 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
return nil, err
}
// Add cgroup mount so container process can introspect its own limits
specgen.AddCgroupsMount("ro")
if err := addDevices(sb, containerConfig, &specgen); err != nil {
return nil, err
}
@ -673,6 +677,12 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
}
}
// Set up pids limit if pids cgroup is mounted
_, err = cgroups.FindCgroupMountpoint("pids")
if err == nil {
specgen.SetLinuxResourcesPidsLimit(s.config.PidsLimit)
}
// by default, the root path is an empty string. set it now.
specgen.SetRootPath(mountPoint)