Place playground processes into a systemd slice

This allows us to influence the OOM killer's behavior, hopefully
killing our processes instead of something more important to the
system.

ansible/roles/playground/handlers/main.yml

@@ -6,6 +6,12 @@
     state: restarted
     daemon_reload: true
 
+- name: restart-containerd
+  systemd:
+    name: containerd
+    state: restarted
+    daemon_reload: true
+
 - name: start-playground-update
   systemd:
     name: playground-update

ansible/roles/playground/tasks/main.yml

@@ -1,5 +1,16 @@
 ---
 
+# Create a Systemd slice to manage resources (Memory, CPU) across the
+# processes spawned by the playground.
+
+- name: Configure playground slice
+  template:
+    src: playground.slice
+    dest: /etc/systemd/system/playground.slice
+    mode: 0644
+
+# --------------------
+
 - name: Add Docker APT repository GPG key
   apt_key:
     state: present
@@ -30,6 +41,20 @@
     mode: 0600
   notify: restart-docker
 
+- name: Add Docker to the Playground slice
+  template:
+    src: docker-override.conf
+    dest: /etc/systemd/system/docker.service.d/override.conf
+    mode: 0600
+  notify: restart-docker
+
+- name: Add ContainerD to the Playground slice
+  template:
+    src: containerd-override.conf
+    dest: /etc/systemd/system/containerd.service.d/override.conf
+    mode: 0600
+  notify: restart-containerd
+
 # --------------------
 
 # Set up a partition with limited space to avoid temporary

ansible/roles/playground/templates/containerd-override.conf

@@ -0,0 +1,2 @@
+[Service]
+Slice=playground.slice

ansible/roles/playground/templates/daemon.json

@@ -1,3 +1,4 @@
 {
+  "cgroup-parent": "playground.slice",
   "storage-driver": "overlay2"
 }

ansible/roles/playground/templates/docker-override.conf

@@ -0,0 +1,2 @@
+[Service]
+Slice=playground.slice

ansible/roles/playground/templates/playground.service

@@ -6,6 +6,8 @@
 Description=The Rust Playground
 
 [Service]
+Slice=playground.slice
+
 Restart=on-failure
 
 Environment=TMPDIR={{ vars_playground_mountpoint_path }}

ansible/roles/playground/templates/playground.slice

@@ -0,0 +1,3 @@
+[Unit]
+Description=Resource management group for playground processes
+Before=slices.target