Runc: cgroupv2 support meta issue

[kolyshkin]

This is a list of cgroupv2 issues and PRs needed to make cgroupv2 a first-class citizen in runc. This is in addition to https://github.com/opencontainers/runc/issues/2209.

| Issue description | PR | Status |
|---------|---------------|----------|
| add integration tests | https://github.com/opencontainers/runc/pull/2295 | :green_circle: merged |
| use "max" for negative values | #2272, #2300 | :green_circle: merged |
| don't try to set kmem for systemd case | #2270 | :green_circle: merged |
| fix setting MemorySwap | #2288 | :green_circle: merged |
| fix fs2 driver initialization | #2299 | :green_circle: merged |
| #2298 fs2 driver does not work with default cgroups path | #2305 | :green_circle: merged |
| #2287 runc --systemd-cgroup update does not update systemd scope | #2343 | :green_circle: merged |
| refactor (remove v1 Paths from v2 code) | #2282, #2299, #2386, #2411 | :green_circle: merged |
| #2351 port events to v2 | #2352 | :green_circle: merged |
| #2328 checkpoint of cgroup2 fs is not working | #2335 | :green_circle: merged |
| #2313 runc --systemd-cgroup run: need to check that StartTransientUnit succeeds
#2309 Check the error return from StopUnit() in UnifiedManager#Destroy() | #2331 | :green_circle: |
| #2163 support rootless systemd | #2281 | :green_circle: merged |
| #2316 eBPF failure on s390x | #2381 | :green_circle: merged |
| #2339 rootless: \"open /sys/fs/cgroup/cgroup.subtree_control: permission denied\"": unknown | #2340 | :green_circle: merged |
| #2356 nest: move PID 1 process to non-initial cgroup? | #2416 | :green_circle: merged |
| #2367 nest: revert "CreateCgroupPath: only enable needed controllers"? | #2395 | :green_circle: merged |
| #2366 support updating devices | N/A | 🔴 (Low priority, as rarely used) |
| #2403 nest: Manager.Destroy() should recursively delete subgroups | #2412 |:green_circle: merged |
| #2563 Implement LinuxResources.Unified proposal | #2584 | :green_circle: merged |
| #2602 change systemd drivers to use sub-cgroups | N/A | 🔴 |

EDIT (by @AkihiroSuda ):

• runc supports cgroup v2 since v1.0.0-rc91
• The items with 🔴 are not required in most cases and not blockers toward v1.0.0 GA
• See also issues and PRs labeled with area/cgroupv2

[AkihiroSuda]

force use of systemd driver if system runs systemd

I'm not sure runc should force this, though Moby/Podman/containerd/CRI-O may force it.

[AkihiroSuda]

@kolyshkin Can we remove "force use of systemd driver if system runs systemd" ?

[kolyshkin]

Can we remove "force use of systemd driver if system runs systemd" ?

done

I think there's something that needs to be done here, but I'm not yet quite sure what. Maybe if systemd is running but is not used by runc, runc should check that the cgroup path we're operating on is not managed by systemd (i.e. this cgroup or its parents were not created by systemd).

Anyway, I need to think more about it. Removed for now.

[Werkov]

The systemd compatible way to use cgroupfs directly is if runc operates in a delegated cgroup.

[giuseppe]

GetOwnCgroup is currently not supported for cgroup v2. Do I open a new issue to track it?

[AkihiroSuda]

Yes please @giuseppe

[wwalker]

For the next person with this problem, here is a workaround that works for me:

I have the same problem in Fedora 32, runc 1.0.0 and docker 19.03.11

_strata_ on freenode #docker suggested adding this to the grub kernel line:

systemd.unified_cgroup_hierarchy=0

That fixed it for me :-)

[h-vetinari]

The list in the OP could probably use updating. Any (other) open topics here @kolyshkin @AkihiroSuda?

[AkihiroSuda]

Added https://github.com/opencontainers/runtime-spec/pull/1040 to the list

[AkihiroSuda]

Can we close this? Keeping this issue open seems to give people false sense as if cgroup v2 support hadn't landed in.

We can still keep pinning this issue.