GNU bug report logs - #52887
[PATCH staging] containers: Add CLONE_NEWCGROUP cgroup namespace support

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 52887 in the body.
You can then email your comments to 52887 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Ryan Sundberg <ryan <at> arctype.co>
To: guix-patches <at> gnu.org
Cc: Ryan Sundberg <ryan <at> arctype.co>
Subject: [PATCH staging] containers: Add CLONE_NEWCGROUP cgroup namespace
 support
Date: Wed, 29 Dec 2021 19:52:16 -0800

Adds low-level support for launching linux containers with cgroup namespaces.

gnu/build/linux-container.scm (%namespaces): Add 'cgroup
guix/build/syscalls.scm (CLONE_NEWCGROUP): Add flag definition
---
 gnu/build/linux-container.scm | 3 ++-
 guix/build/syscalls.scm       | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm
index 4a8bed5a9a..bdeca2cdb9 100644
--- a/gnu/build/linux-container.scm
+++ b/gnu/build/linux-container.scm
@@ -52,7 +52,7 @@ exists."
   (file-exists? "/proc/self/setgroups"))
 
 (define %namespaces
-  '(mnt pid ipc uts user net))
+  '(cgroup mnt pid ipc uts user net))
 
 (define (call-with-clean-exit thunk)
   "Apply THUNK, but exit with a status code of 1 if it fails."
@@ -210,6 +210,7 @@ corresponds to the symbols in NAMESPACES."
   ;; Use the same flags as fork(3) in addition to the namespace flags.
   (apply logior SIGCHLD
          (map (match-lambda
+               ('cgroup  CLONE_NEWCGROUP)
                ('mnt  CLONE_NEWNS)
                ('uts  CLONE_NEWUTS)
                ('ipc  CLONE_NEWIPC)
diff --git a/guix/build/syscalls.scm b/guix/build/syscalls.scm
index 45f95c509d..a7401fd73f 100644
--- a/guix/build/syscalls.scm
+++ b/guix/build/syscalls.scm
@@ -132,6 +132,7 @@
 
             CLONE_CHILD_CLEARTID
             CLONE_CHILD_SETTID
+            CLONE_NEWCGROUP
             CLONE_NEWNS
             CLONE_NEWUTS
             CLONE_NEWIPC
@@ -1025,6 +1026,7 @@ caller lacks root privileges."
 ;; Linux clone flags, from linux/sched.h
 (define CLONE_CHILD_CLEARTID #x00200000)
 (define CLONE_CHILD_SETTID   #x01000000)
+(define CLONE_NEWCGROUP      #x02000000)
 (define CLONE_NEWNS          #x00020000)
 (define CLONE_NEWUTS         #x04000000)
 (define CLONE_NEWIPC         #x08000000)
-- 
2.31.1

Message #10 received at 52887-done <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Ryan Sundberg <ryan <at> arctype.co>
Cc: 52887-done <at> debbugs.gnu.org
Subject: Re: bug#52887: [PATCH staging] containers: Add CLONE_NEWCGROUP
 cgroup namespace support
Date: Wed, 05 Jan 2022 22:58:36 +0100

Hi,

Ryan Sundberg <ryan <at> arctype.co> skribis:

> Adds low-level support for launching linux containers with cgroup namespaces.
>
> gnu/build/linux-container.scm (%namespaces): Add 'cgroup
> guix/build/syscalls.scm (CLONE_NEWCGROUP): Add flag definition

I tweaked the commit log and applied to ‘master’, thanks!

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.