mirror of
https://github.com/criyle/go-judge.git
synced 2025-09-26 22:39:12 +08:00
linuxc: fix cgroup fd & add clean up to containers when exit
Some checks failed
Build / Goreleaser (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, darwin) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, linux) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, windows) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, darwin) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, linux) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, windows) (push) Has been cancelled
Some checks failed
Build / Goreleaser (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, darwin) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, linux) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, windows) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, darwin) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, linux) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, windows) (push) Has been cancelled
criyle/go-sandbox#13
This commit is contained in:
parent
8b9b6f33dc
commit
9ae8487a80
10
env/env_linux.go
vendored
10
env/env_linux.go
vendored
@ -34,6 +34,7 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) {
|
|||||||
mountBuilder *mount.Builder
|
mountBuilder *mount.Builder
|
||||||
symbolicLinks []container.SymbolicLink
|
symbolicLinks []container.SymbolicLink
|
||||||
maskPaths []string
|
maskPaths []string
|
||||||
|
unshareCgroup bool = true
|
||||||
)
|
)
|
||||||
mc, err := readMountConfig(c.MountConf)
|
mc, err := readMountConfig(c.MountConf)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
@ -77,8 +78,9 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) {
|
|||||||
unshareFlags ^= syscall.CLONE_NEWNET
|
unshareFlags ^= syscall.CLONE_NEWNET
|
||||||
}
|
}
|
||||||
major, minor := kernelVersion()
|
major, minor := kernelVersion()
|
||||||
|
unshareFlags ^= unix.CLONE_NEWCGROUP
|
||||||
if major < 4 || (major == 4 && minor < 6) {
|
if major < 4 || (major == 4 && minor < 6) {
|
||||||
unshareFlags ^= unix.CLONE_NEWCGROUP
|
unshareCgroup = false
|
||||||
c.Info("Kernel version (", major, ".", minor, ") < 4.6, don't unshare cgroup")
|
c.Info("Kernel version (", major, ".", minor, ") < 4.6, don't unshare cgroup")
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -125,6 +127,8 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) {
|
|||||||
WorkDir: workDir,
|
WorkDir: workDir,
|
||||||
ContainerUID: cUID,
|
ContainerUID: cUID,
|
||||||
ContainerGID: cGID,
|
ContainerGID: cGID,
|
||||||
|
|
||||||
|
UnshareCgroupBeforeExec: unshareCgroup,
|
||||||
}
|
}
|
||||||
cgb, ct, err := newCgroup(c)
|
cgb, ct, err := newCgroup(c)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
@ -176,6 +180,10 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) {
|
|||||||
defer e.Destroy()
|
defer e.Destroy()
|
||||||
p, err := e.Execve(context.TODO(), envexec.ExecveParam{
|
p, err := e.Execve(context.TODO(), envexec.ExecveParam{
|
||||||
Args: []string{"/usr/bin/env"},
|
Args: []string{"/usr/bin/env"},
|
||||||
|
Limit: envexec.Limit{
|
||||||
|
Memory: 256 << 20,
|
||||||
|
Proc: 1,
|
||||||
|
},
|
||||||
})
|
})
|
||||||
if err != nil {
|
if err != nil {
|
||||||
c.Info("Environment run failed: ", err)
|
c.Info("Environment run failed: ", err)
|
||||||
|
9
env/pool/interface.go
vendored
9
env/pool/interface.go
vendored
@ -61,3 +61,12 @@ func (p *pool) Put(env envexec.Environment) {
|
|||||||
|
|
||||||
p.env = append(p.env, e)
|
p.env = append(p.env, e)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func (p *pool) Destroy() {
|
||||||
|
p.mu.Lock()
|
||||||
|
defer p.mu.Unlock()
|
||||||
|
|
||||||
|
for _, e := range p.env {
|
||||||
|
e.Destroy()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
2
go.mod
2
go.mod
@ -5,7 +5,7 @@ go 1.23
|
|||||||
require (
|
require (
|
||||||
github.com/coreos/go-systemd/v22 v22.5.0
|
github.com/coreos/go-systemd/v22 v22.5.0
|
||||||
github.com/creack/pty v1.1.24
|
github.com/creack/pty v1.1.24
|
||||||
github.com/criyle/go-sandbox v0.11.0
|
github.com/criyle/go-sandbox v0.11.1
|
||||||
github.com/elastic/go-seccomp-bpf v1.5.0
|
github.com/elastic/go-seccomp-bpf v1.5.0
|
||||||
github.com/elastic/go-ucfg v0.8.8
|
github.com/elastic/go-ucfg v0.8.8
|
||||||
github.com/gin-contrib/zap v1.1.4
|
github.com/gin-contrib/zap v1.1.4
|
||||||
|
4
go.sum
4
go.sum
@ -18,8 +18,8 @@ github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8
|
|||||||
github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
|
github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
|
||||||
github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
|
github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
|
||||||
github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
|
github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
|
||||||
github.com/criyle/go-sandbox v0.11.0 h1:1jkfLigilxQza3zPyF1aIGR5WdDuiMYE1rzVYWlJC9I=
|
github.com/criyle/go-sandbox v0.11.1 h1:f6Qsel6XZ5eGQG9Ek2e1O8EZZfsdfKSI42Vkwzojzno=
|
||||||
github.com/criyle/go-sandbox v0.11.0/go.mod h1:9IZSv7cxcDkVaPSRufhMPLUg+7M7lTPAt8hjd/iMKFo=
|
github.com/criyle/go-sandbox v0.11.1/go.mod h1:9IZSv7cxcDkVaPSRufhMPLUg+7M7lTPAt8hjd/iMKFo=
|
||||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
@ -19,6 +19,7 @@ const maxWaiting = 512
|
|||||||
type EnvironmentPool interface {
|
type EnvironmentPool interface {
|
||||||
Get() (envexec.Environment, error)
|
Get() (envexec.Environment, error)
|
||||||
Put(envexec.Environment)
|
Put(envexec.Environment)
|
||||||
|
Destroy()
|
||||||
}
|
}
|
||||||
|
|
||||||
// Config defines worker configuration
|
// Config defines worker configuration
|
||||||
@ -152,6 +153,7 @@ func (w *worker) Shutdown() {
|
|||||||
w.stopOnce.Do(func() {
|
w.stopOnce.Do(func() {
|
||||||
close(w.done)
|
close(w.done)
|
||||||
w.wg.Wait()
|
w.wg.Wait()
|
||||||
|
w.envPool.Destroy()
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user