T6406: Container CPU limits

[nvollmar]

Change Summary

Add container config option for cpu limits

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

https://vyos.dev/T6406

Related PR(s)

• T6406: enables CONFIG_CFS_BANDWIDTH for cpu cgroup limits vyos-build#645
• T6406: document cpu limit config option vyos-documentation#1462

Component(s) name

container

Proposed changes

Add option to enable cpu limits per container similar to memory l imits

How to test

set container name c1 image hello-world
set container name c1 allow-host-networks
set container name c1 cpus 1.5

Smoketest result

vyos@vyos:~$ /usr/libexec/vyos/tests/smoke/cli/test_container.py
test_basic (__main__.TestContainer.test_basic) ... ok
test_cpu_limit (__main__.TestContainer.test_cpu_limit) ... ok
test_dual_stack_network (__main__.TestContainer.test_dual_stack_network) ... 
IP address "192.0.2.1" can not be used for a container, reserved for the
container engine!

ok
test_ipv4_network (__main__.TestContainer.test_ipv4_network) ... 
IP address "192.0.2.1" can not be used for a container, reserved for the
container engine!

ok
test_ipv6_network (__main__.TestContainer.test_ipv6_network) ... 
IP address "2001:db8::1" can not be used for a container, reserved for
the container engine!

ok
test_uid_gid (__main__.TestContainer.test_uid_gid) ... 
Cannot set "gid" without "uid" for container

ok

----------------------------------------------------------------------
Ran 6 tests in 165.714s

OK

vyos@vyos:~$ /usr/libexec/vyos/tests/smoke/system/test_kernel_options.py
test_bond_interface (__main__.TestKernelModules.test_bond_interface) ... ok
test_bridge_interface (__main__.TestKernelModules.test_bridge_interface) ... ok
test_container_cgroup_support (__main__.TestKernelModules.test_container_cgroup_support) ... ok
test_container_cpu (__main__.TestKernelModules.test_container_cpu) ... ok
test_dropmon_enabled (__main__.TestKernelModules.test_dropmon_enabled) ... ok
test_ip_routing_support (__main__.TestKernelModules.test_ip_routing_support) ... ok
test_qemu_support (__main__.TestKernelModules.test_qemu_support) ... ok
test_synproxy_enabled (__main__.TestKernelModules.test_synproxy_enabled) ... ok
test_vfio (__main__.TestKernelModules.test_vfio) ... ok
test_vmware_support (__main__.TestKernelModules.test_vmware_support) ... ok

----------------------------------------------------------------------
Ran 10 tests in 0.068s

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[dmbaturin]

Please add a PR description rather than just a task number to the title.

[sever-sever]

Does “cpus 1.5” means
that you want allocate core 1 and core 5 to the container? Or core 0 and core 4? Or is it CPU period and CPU quota?
It is not clear from the description

https://docs.podman.io/en/latest/markdown/podman-run.1.html#cpus-number

[nvollmar]

It is a quota how much CPU resources a container can use.
1.5 CPUs means it can use 1.5 threads worth of the CPU time.

I try to reword the description to make that clearer.

[sever-sever]

Will you add --cpuset-cpus option? If yes, it will probably be more clear something like this

set container name c1 cpu 0-3
set container name c1 cpu-quota 1.25

[nvollmar]

I didn't yet see the need for cpuset on a routing platform.
At least in my case all containers are pretty lightweight and I just want to make sure a bug in one of them can't eat all CPUs.

But renaming it to cpu-quota makes sense so we can easily add cpu pinning later if someone has a need for it.

[c-po]

@Mergifyio backport sagitta

[mergify]

backport sagitta

✅ Backports have been created

• #3535 T6406: Container CPU limits (backport #3530) has been created for branch sagitta