linuxc: fix cgroup fd & add clean up to containers when exit
Some checks failed
Build / Goreleaser (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, darwin) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, linux) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (amd64_v3, windows) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, darwin) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, linux) (push) Has been cancelled
Build / Upload artifacts-${{ matrix.os }}-${{ matrix.arch }} (arm64_v8.0, windows) (push) Has been cancelled

criyle/go-sandbox#13
This commit is contained in:
criyle 2025-02-20 23:13:57 -05:00
parent 8b9b6f33dc
commit 9ae8487a80
5 changed files with 23 additions and 4 deletions

10
env/env_linux.go vendored
View File

@ -34,6 +34,7 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) {
mountBuilder *mount.Builder
symbolicLinks []container.SymbolicLink
maskPaths []string
unshareCgroup bool = true
)
mc, err := readMountConfig(c.MountConf)
if err != nil {
@ -77,8 +78,9 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) {
unshareFlags ^= syscall.CLONE_NEWNET
}
major, minor := kernelVersion()
unshareFlags ^= unix.CLONE_NEWCGROUP
if major < 4 || (major == 4 && minor < 6) {
unshareFlags ^= unix.CLONE_NEWCGROUP
unshareCgroup = false
c.Info("Kernel version (", major, ".", minor, ") < 4.6, don't unshare cgroup")
}
@ -125,6 +127,8 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) {
WorkDir: workDir,
ContainerUID: cUID,
ContainerGID: cGID,
UnshareCgroupBeforeExec: unshareCgroup,
}
cgb, ct, err := newCgroup(c)
if err != nil {
@ -176,6 +180,10 @@ func NewBuilder(c Config) (pool.EnvBuilder, map[string]any, error) {
defer e.Destroy()
p, err := e.Execve(context.TODO(), envexec.ExecveParam{
Args: []string{"/usr/bin/env"},
Limit: envexec.Limit{
Memory: 256 << 20,
Proc: 1,
},
})
if err != nil {
c.Info("Environment run failed: ", err)

View File

@ -61,3 +61,12 @@ func (p *pool) Put(env envexec.Environment) {
p.env = append(p.env, e)
}
func (p *pool) Destroy() {
p.mu.Lock()
defer p.mu.Unlock()
for _, e := range p.env {
e.Destroy()
}
}

2
go.mod
View File

@ -5,7 +5,7 @@ go 1.23
require (
github.com/coreos/go-systemd/v22 v22.5.0
github.com/creack/pty v1.1.24
github.com/criyle/go-sandbox v0.11.0
github.com/criyle/go-sandbox v0.11.1
github.com/elastic/go-seccomp-bpf v1.5.0
github.com/elastic/go-ucfg v0.8.8
github.com/gin-contrib/zap v1.1.4

4
go.sum
View File

@ -18,8 +18,8 @@ github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8
github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
github.com/criyle/go-sandbox v0.11.0 h1:1jkfLigilxQza3zPyF1aIGR5WdDuiMYE1rzVYWlJC9I=
github.com/criyle/go-sandbox v0.11.0/go.mod h1:9IZSv7cxcDkVaPSRufhMPLUg+7M7lTPAt8hjd/iMKFo=
github.com/criyle/go-sandbox v0.11.1 h1:f6Qsel6XZ5eGQG9Ek2e1O8EZZfsdfKSI42Vkwzojzno=
github.com/criyle/go-sandbox v0.11.1/go.mod h1:9IZSv7cxcDkVaPSRufhMPLUg+7M7lTPAt8hjd/iMKFo=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

View File

@ -19,6 +19,7 @@ const maxWaiting = 512
type EnvironmentPool interface {
Get() (envexec.Environment, error)
Put(envexec.Environment)
Destroy()
}
// Config defines worker configuration
@ -152,6 +153,7 @@ func (w *worker) Shutdown() {
w.stopOnce.Do(func() {
close(w.done)
w.wg.Wait()
w.envPool.Destroy()
})
}