merge #4897 into opencontainers/runc:release-1.3

(Backported by Jared Ledvina.)

dependabot[bot]:
  build(deps): bump github.com/opencontainers/cgroups from 0.0.3 to 0.0.4

Kir Kolyshkin (4):
  deps: bump cgroups to v0.0.3, fix tests
  libct: State: ensure Resources is not nil
  deps: bump opencontainers/cgroups to v0.0.2
  tests/int: simplify using check_cpu_quota

LGTMs: kolyshkin cyphar

Author: cyphar

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/moby/sys/user v0.3.0
 	github.com/moby/sys/userns v0.1.0
 	github.com/mrunalp/fileutils v0.5.1
-	github.com/opencontainers/cgroups v0.0.1
+	github.com/opencontainers/cgroups v0.0.4
 	github.com/opencontainers/runtime-spec v1.2.1
 	github.com/opencontainers/selinux v1.11.1
 	github.com/seccomp/libseccomp-golang v0.10.0

go.sum

@@ -49,8 +49,8 @@ github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/mrunalp/fileutils v0.5.1 h1:F+S7ZlNKnrwHfSwdlgNSkKo67ReVf8o9fel6C3dkm/Q=
 github.com/mrunalp/fileutils v0.5.1/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
-github.com/opencontainers/cgroups v0.0.1 h1:MXjMkkFpKv6kpuirUa4USFBas573sSAY082B4CiHEVA=
-github.com/opencontainers/cgroups v0.0.1/go.mod h1:s8lktyhlGUqM7OSRL5P7eAW6Wb+kWPNvt4qvVfzA5vs=
+github.com/opencontainers/cgroups v0.0.4 h1:XVj8P/IHVms/j+7eh8ggdkTLAxjz84ZzuFyGoE28DR4=
+github.com/opencontainers/cgroups v0.0.4/go.mod h1:s8lktyhlGUqM7OSRL5P7eAW6Wb+kWPNvt4qvVfzA5vs=
 github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
 github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.11.1 h1:nHFvthhM0qY8/m+vfhJylliSshm8G1jJ2jDMcgULaH8=

libcontainer/factory_linux.go

@@ -164,6 +164,10 @@ func loadState(root string) (*State, error) {
 	if err := json.NewDecoder(f).Decode(&state); err != nil {
 		return nil, err
 	}
+	// Cgroup v1 fs manager expect Resources to never be nil.
+	if state.Config.Cgroups.Resources == nil {
+		state.Config.Cgroups.Resources = &cgroups.Resources{}
+	}
 	return state, nil
 }
 

tests/integration/cgroups.bats

@@ -328,7 +328,7 @@ convert_hugetlb_size() {
 	check_systemd_value "MemoryHigh" 5242880
 	check_systemd_value "MemoryMax" 10485760
 	check_systemd_value "TasksMax" 99
-	check_cpu_quota 10000 100000 "100ms"
+	check_cpu_quota 10000 100000
 	check_cpu_weight 42
 }
 
@@ -390,7 +390,7 @@ convert_hugetlb_size() {
 	[ "$output" = '42' ]
 	check_systemd_value "TasksMax" 42
 
-	check_cpu_quota 5000 50000 "100ms"
+	check_cpu_quota 5000 50000
 
 	check_cpu_weight 42
 }

tests/integration/helpers.bash

@@ -302,7 +302,33 @@ function check_systemd_value() {
 function check_cpu_quota() {
 	local quota=$1
 	local period=$2
-	local sd_quota=$3
+	local sd_quota
+
+	if [ -v RUNC_USE_SYSTEMD ]; then
+		if [ "$quota" = "-1" ]; then
+			sd_quota="infinity"
+		else
+			# In systemd world, quota (CPUQuotaPerSec) is measured in ms
+			# (per second), and systemd rounds it up to 10ms. For example,
+			# given quota=4000 and period=10000, systemd value is 400ms.
+			#
+			# Calculate milliseconds (quota/period * 1000).
+			# First multiply by 1000 to get milliseconds,
+			# then add half of period for proper rounding.
+			local ms=$(((quota * 1000 + period / 2) / period))
+			# Round up to nearest 10ms.
+			ms=$(((ms + 5) / 10 * 10))
+			sd_quota="${ms}ms"
+
+			# Recalculate quota based on systemd value.
+			# Convert ms back to quota units.
+			quota=$((ms * period / 1000))
+
+		fi
+
+		# Systemd values are the same for v1 and v2.
+		check_systemd_value "CPUQuotaPerSecUSec" "$sd_quota"
+	fi
 
 	if [ -v CGROUP_V2 ]; then
 		if [ "$quota" = "-1" ]; then
@@ -313,8 +339,6 @@ function check_cpu_quota() {
 		check_cgroup_value "cpu.cfs_quota_us" "$quota"
 		check_cgroup_value "cpu.cfs_period_us" "$period"
 	fi
-	# systemd values are the same for v1 and v2
-	check_systemd_value "CPUQuotaPerSecUSec" "$sd_quota"
 
 	# CPUQuotaPeriodUSec requires systemd >= v242
 	[ "$(systemd_version)" -lt 242 ] && return
@@ -344,7 +368,18 @@ function check_cpu_shares() {
 	local shares=$1
 
 	if [ -v CGROUP_V2 ]; then
-		local weight=$((1 + ((shares - 2) * 9999) / 262142))
+		# Same formula as ConvertCPUSharesToCgroupV2Value.
+		local weight
+		weight=$(awk -v shares="$shares" '
+		BEGIN {
+			if (shares == 0) { print 0; exit }
+			if (shares <= 2) { print 1; exit }
+			if (shares >= 262144) { print 10000; exit }
+			l = log(shares) / log(2)
+			exponent = (l*l + 125*l) / 612.0 - 7.0/34.0
+			print int(exp(exponent * log(10)) + 0.99)
+		}')
+
 		check_cpu_weight "$weight"
 	else
 		check_cgroup_value "cpu.shares" "$shares"

tests/integration/update.bats

@@ -263,26 +263,26 @@ EOF
 	runc run -d --console-socket "$CONSOLE_SOCKET" test_update
 	[ "$status" -eq 0 ]
 
-	# check that initial values were properly set
-	check_cpu_quota 500000 1000000 "500ms"
+	# Check that initial values were properly set.
+	check_cpu_quota 500000 1000000
 	check_cpu_shares 100
 
-	# update cpu period
+	# Update cpu period.
 	runc update test_update --cpu-period 900000
 	[ "$status" -eq 0 ]
-	check_cpu_quota 500000 900000 "560ms"
+	check_cpu_quota 500000 900000
 
-	# update cpu quota
+	# Update cpu quota.
 	runc update test_update --cpu-quota 600000
 	[ "$status" -eq 0 ]
-	check_cpu_quota 600000 900000 "670ms"
+	check_cpu_quota 600000 900000
 
-	# remove cpu quota
+	# Remove cpu quota.
 	runc update test_update --cpu-quota -1
 	[ "$status" -eq 0 ]
-	check_cpu_quota -1 900000 "infinity"
+	check_cpu_quota -1 900000
 
-	# update cpu-shares
+	# Update cpu-shares.
 	runc update test_update --cpu-share 200
 	[ "$status" -eq 0 ]
 	check_cpu_shares 200
@@ -298,21 +298,21 @@ EOF
 }
 EOF
 	[ "$status" -eq 0 ]
-	check_cpu_quota 500000 1000000 "500ms"
+	check_cpu_quota 500000 1000000
 
-	# redo all the changes at once
+	# Redo all the changes at once.
 	runc update test_update \
 		--cpu-period 900000 --cpu-quota 600000 --cpu-share 200
 	[ "$status" -eq 0 ]
-	check_cpu_quota 600000 900000 "670ms"
+	check_cpu_quota 600000 900000
 	check_cpu_shares 200
 
-	# remove cpu quota and reset the period
+	# Remove cpu quota and reset the period.
 	runc update test_update --cpu-quota -1 --cpu-period 100000
 	[ "$status" -eq 0 ]
-	check_cpu_quota -1 100000 "infinity"
+	check_cpu_quota -1 100000
 
-	# reset to initial test value via json file
+	# Reset to initial test values via json file.
 	cat <<EOF >"$BATS_RUN_TMPDIR"/runc-cgroups-integration-test.json
 {
   "cpu": {
@@ -326,7 +326,7 @@ EOF
 
 	runc update -r "$BATS_RUN_TMPDIR"/runc-cgroups-integration-test.json test_update
 	[ "$status" -eq 0 ]
-	check_cpu_quota 500000 1000000 "500ms"
+	check_cpu_quota 500000 1000000
 	check_cpu_shares 100
 }
 
@@ -363,7 +363,7 @@ EOF
 	runc run -d --console-socket "$CONSOLE_SOCKET" test_update
 	[ "$status" -eq 0 ]
 
-	check_cpu_quota -1 1000000 "infinity"
+	check_cpu_quota -1 1000000
 }
 
 @test "set cpu period with no quota (invalid period)" {
@@ -382,7 +382,7 @@ EOF
 
 	runc run -d --console-socket "$CONSOLE_SOCKET" test_update
 	[ "$status" -eq 0 ]
-	check_cpu_quota 5000 100000 "50ms"
+	check_cpu_quota 5000 100000
 }
 
 @test "update cpu period with no previous period/quota set" {
@@ -393,10 +393,10 @@ EOF
 	runc run -d --console-socket "$CONSOLE_SOCKET" test_update
 	[ "$status" -eq 0 ]
 
-	# update the period alone, no old values were set
+	# Update the period alone, no old values were set.
 	runc update --cpu-period 50000 test_update
 	[ "$status" -eq 0 ]
-	check_cpu_quota -1 50000 "infinity"
+	check_cpu_quota -1 50000
 }
 
 @test "update cpu quota with no previous period/quota set" {
@@ -407,10 +407,10 @@ EOF
 	runc run -d --console-socket "$CONSOLE_SOCKET" test_update
 	[ "$status" -eq 0 ]
 
-	# update the quota alone, no old values were set
+	# Update the quota alone, no old values were set.
 	runc update --cpu-quota 30000 test_update
 	[ "$status" -eq 0 ]
-	check_cpu_quota 30000 100000 "300ms"
+	check_cpu_quota 30000 100000
 }
 
 @test "update cpu period in a pod cgroup with pod limit set" {
@@ -445,7 +445,7 @@ EOF
 	# Finally, the test itself: set 30% limit but with lower period.
 	runc update --cpu-period 10000 --cpu-quota 3000 test_update
 	[ "$status" -eq 0 ]
-	check_cpu_quota 3000 10000 "300ms"
+	check_cpu_quota 3000 10000
 }
 
 @test "update cgroup cpu.idle" {
@@ -545,10 +545,9 @@ EOF
 	runc run -d --console-socket "$CONSOLE_SOCKET" test_update
 	[ "$status" -eq 0 ]
 
-	# check that initial values were properly set
-	check_cpu_quota 500000 1000000 "500ms"
-	# initial cpu shares of 100 corresponds to weight of 4
-	check_cpu_weight 4
+	# Check that initial values (from setup) were properly set.
+	check_cpu_quota 500000 1000000
+	check_cpu_shares 100
 	check_systemd_value "TasksMax" 20
 
 	runc update -r - test_update <<EOF
@@ -561,8 +560,8 @@ EOF
 }
 EOF
 
-	# check the updated systemd unit properties
-	check_cpu_quota -1 100000 "infinity"
+	# Check the updated systemd unit properties.
+	check_cpu_quota -1 100000
 	check_cpu_weight 16
 	check_systemd_value "TasksMax" 10
 }