mirror of
https://github.com/criyle/go-judge.git
synced 2025-09-26 22:39:12 +08:00
linuxc: fix cgroup fd & add clean up to containers when exit
Some checks failed
Build / Goreleaser (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, darwin) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, linux) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, windows) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, darwin) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, linux) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, windows) (push) Has been cancelled
Some checks failed
Build / Goreleaser (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, darwin) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, linux) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, windows) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, darwin) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, linux) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, windows) (push) Has been cancelled
criyle/go-sandbox#13
This commit is contained in:
parent
8b9b6f33dc
commit
9ae8487a80
10
env/env_linux.go
vendored
10
env/env_linux.go
vendored
@ -34,6 +34,7 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) {
|
||||
mountBuilder *mount.Builder
|
||||
symbolicLinks []container.SymbolicLink
|
||||
maskPaths []string
|
||||
unshareCgroup bool = true
|
||||
)
|
||||
mc, err := readMountConfig(c.MountConf)
|
||||
if err != nil {
|
||||
@ -77,8 +78,9 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) {
|
||||
unshareFlags ^= syscall.CLONE_NEWNET
|
||||
}
|
||||
major, minor := kernelVersion()
|
||||
unshareFlags ^= unix.CLONE_NEWCGROUP
|
||||
if major < 4 || (major == 4 && minor < 6) {
|
||||
unshareFlags ^= unix.CLONE_NEWCGROUP
|
||||
unshareCgroup = false
|
||||
c.Info("Kernel version (", major, ".", minor, ") < 4.6, don't unshare cgroup")
|
||||
}
|
||||
|
||||
@ -125,6 +127,8 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) {
|
||||
WorkDir: workDir,
|
||||
ContainerUID: cUID,
|
||||
ContainerGID: cGID,
|
||||
|
||||
UnshareCgroupBeforeExec: unshareCgroup,
|
||||
}
|
||||
cgb, ct, err := newCgroup(c)
|
||||
if err != nil {
|
||||
@ -176,6 +180,10 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) {
|
||||
defer e.Destroy()
|
||||
p, err := e.Execve(context.TODO(), envexec.ExecveParam{
|
||||
Args: []string{"/usr/bin/env"},
|
||||
Limit: envexec.Limit{
|
||||
Memory: 256 << 20,
|
||||
Proc: 1,
|
||||
},
|
||||
})
|
||||
if err != nil {
|
||||
c.Info("Environment run failed: ", err)
|
||||
|
9
env/pool/interface.go
vendored
9
env/pool/interface.go
vendored
@ -61,3 +61,12 @@ func (p *pool) Put(env envexec.Environment) {
|
||||
|
||||
p.env = append(p.env, e)
|
||||
}
|
||||
|
||||
func (p *pool) Destroy() {
|
||||
p.mu.Lock()
|
||||
defer p.mu.Unlock()
|
||||
|
||||
for _, e := range p.env {
|
||||
e.Destroy()
|
||||
}
|
||||
}
|
||||
|
2
go.mod
2
go.mod
@ -5,7 +5,7 @@ go 1.23
|
||||
require (
|
||||
github.com/coreos/go-systemd/v22 v22.5.0
|
||||
github.com/creack/pty v1.1.24
|
||||
github.com/criyle/go-sandbox v0.11.0
|
||||
github.com/criyle/go-sandbox v0.11.1
|
||||
github.com/elastic/go-seccomp-bpf v1.5.0
|
||||
github.com/elastic/go-ucfg v0.8.8
|
||||
github.com/gin-contrib/zap v1.1.4
|
||||
|
4
go.sum
4
go.sum
@ -18,8 +18,8 @@ github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8
|
||||
github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
|
||||
github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
|
||||
github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
|
||||
github.com/criyle/go-sandbox v0.11.0 h1:1jkfLigilxQza3zPyF1aIGR5WdDuiMYE1rzVYWlJC9I=
|
||||
github.com/criyle/go-sandbox v0.11.0/go.mod h1:9IZSv7cxcDkVaPSRufhMPLUg+7M7lTPAt8hjd/iMKFo=
|
||||
github.com/criyle/go-sandbox v0.11.1 h1:f6Qsel6XZ5eGQG9Ek2e1O8EZZfsdfKSI42Vkwzojzno=
|
||||
github.com/criyle/go-sandbox v0.11.1/go.mod h1:9IZSv7cxcDkVaPSRufhMPLUg+7M7lTPAt8hjd/iMKFo=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
|
@ -19,6 +19,7 @@ const maxWaiting = 512
|
||||
type EnvironmentPool interface {
|
||||
Get() (envexec.Environment, error)
|
||||
Put(envexec.Environment)
|
||||
Destroy()
|
||||
}
|
||||
|
||||
// Config defines worker configuration
|
||||
@ -152,6 +153,7 @@ func (w *worker) Shutdown() {
|
||||
w.stopOnce.Do(func() {
|
||||
close(w.done)
|
||||
w.wg.Wait()
|
||||
w.envPool.Destroy()
|
||||
})
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user