From 9ae8487a8096a547d47e22b6648c008e16ea52dc Mon Sep 17 00:00:00 2001 From: criyle Date: Thu, 20 Feb 2025 23:13:57 -0500 Subject: [PATCH] linuxc: fix cgroup fd & add clean up to containers when exit criyle/go-sandbox#13 --- env/env_linux.go | 10 +++++++++- env/pool/interface.go | 9 +++++++++ go.mod | 2 +- go.sum | 4 ++-- worker/worker.go | 2 ++ 5 files changed, 23 insertions(+), 4 deletions(-) diff --git a/env/env_linux.go b/env/env_linux.go index 8320576..1a7e539 100644 --- a/env/env_linux.go +++ b/env/env_linux.go @@ -34,6 +34,7 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) { mountBuilder *mount.Builder symbolicLinks []container.SymbolicLink maskPaths []string + unshareCgroup bool = true ) mc, err := readMountConfig(c.MountConf) if err != nil { @@ -77,8 +78,9 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) { unshareFlags ^= syscall.CLONE_NEWNET } major, minor := kernelVersion() + unshareFlags ^= unix.CLONE_NEWCGROUP if major < 4 || (major == 4 && minor < 6) { - unshareFlags ^= unix.CLONE_NEWCGROUP + unshareCgroup = false c.Info("Kernel version (", major, ".", minor, ") < 4.6, don't unshare cgroup") } @@ -125,6 +127,8 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) { WorkDir: workDir, ContainerUID: cUID, ContainerGID: cGID, + + UnshareCgroupBeforeExec: unshareCgroup, } cgb, ct, err := newCgroup(c) if err != nil { @@ -176,6 +180,10 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) { defer e.Destroy() p, err := e.Execve(context.TODO(), envexec.ExecveParam{ Args: []string{"/usr/bin/env"}, + Limit: envexec.Limit{ + Memory: 256 << 20, + Proc: 1, + }, }) if err != nil { c.Info("Environment run failed: ", err) diff --git a/env/pool/interface.go b/env/pool/interface.go index d8bd86b..9c2d1a4 100644 --- a/env/pool/interface.go +++ b/env/pool/interface.go @@ -61,3 +61,12 @@ func (p *pool) Put(env envexec.Environment) { p.env = append(p.env, e) } + +func (p *pool) Destroy() { + p.mu.Lock() + defer p.mu.Unlock() + + for _, e := range p.env { + e.Destroy() + } +} diff --git a/go.mod b/go.mod index 23d6220..ef19129 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.23 require ( github.com/coreos/go-systemd/v22 v22.5.0 github.com/creack/pty v1.1.24 - github.com/criyle/go-sandbox v0.11.0 + github.com/criyle/go-sandbox v0.11.1 github.com/elastic/go-seccomp-bpf v1.5.0 github.com/elastic/go-ucfg v0.8.8 github.com/gin-contrib/zap v1.1.4 diff --git a/go.sum b/go.sum index c5a1d3e..3a2d412 100644 --- a/go.sum +++ b/go.sum @@ -18,8 +18,8 @@ github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s= github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE= -github.com/criyle/go-sandbox v0.11.0 h1:1jkfLigilxQza3zPyF1aIGR5WdDuiMYE1rzVYWlJC9I= -github.com/criyle/go-sandbox v0.11.0/go.mod h1:9IZSv7cxcDkVaPSRufhMPLUg+7M7lTPAt8hjd/iMKFo= +github.com/criyle/go-sandbox v0.11.1 h1:f6Qsel6XZ5eGQG9Ek2e1O8EZZfsdfKSI42Vkwzojzno= +github.com/criyle/go-sandbox v0.11.1/go.mod h1:9IZSv7cxcDkVaPSRufhMPLUg+7M7lTPAt8hjd/iMKFo= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= diff --git a/worker/worker.go b/worker/worker.go index c023640..1e80d72 100644 --- a/worker/worker.go +++ b/worker/worker.go @@ -19,6 +19,7 @@ const maxWaiting = 512 type EnvironmentPool interface { Get() (envexec.Environment, error) Put(envexec.Environment) + Destroy() } // Config defines worker configuration @@ -152,6 +153,7 @@ func (w *worker) Shutdown() { w.stopOnce.Do(func() { close(w.done) w.wg.Wait() + w.envPool.Destroy() }) }