Skip to content

Commit 7b49876

Browse files
committed
Fix cgroup checks for containers
So far, from what I've noticed, is that you can perfectly fine run processes with a cgroup line of 0::/. I've been playing around with a non-systemd distro to see how they behave. I picked Alpine, which uses OpenRC. When you open a shell, you are actually in the 0::/ cgroup. But, as soon as you launch it on boot using the init system, it assigns you a cgroups service is running. As time is limited, I assume that most init systems will assign a cgroup with prefix if you run a service when cgroups are enabled. Therefore, we now assume that we have an invalid configuration if the cgroup prefix is empty.
1 parent 95df1de commit 7b49876

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

judge/create_cgroups.in

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,8 @@ You can try using cgroup V1 by adding systemd.unified_cgroup_hierarchy=0 to the
3434
if ! echo "+cpuset" >> /sys/fs/cgroup/cgroup.subtree_control; then
3535
cgroup_error_and_usage "Error: Cannot add +cpuset to cgroup.subtree_control; check kernel params."
3636
fi
37-
if ! grep -q "slice" /proc/self/cgroup; then
38-
cgroup_error_and_usage "Error: Cgroups not configured properly, missing systemd slice under /proc/self/cgroup. If running under docker, make sure to set cgroupns=host."
37+
if grep -q ":/$" /proc/self/cgroup; then
38+
cgroup_error_and_usage "Error: Cgroups not configured properly, missing cgroup hierarchy prefix under /proc/self/cgroup. If running in a container, make sure to set cgroupns=host."
3939
fi
4040

4141
else # Trying cgroup V1:

0 commit comments

Comments
 (0)