|
 |
1f5593 |
From dfb3496c174377b860b62872ce6af951364cc3ac Mon Sep 17 00:00:00 2001
|
|
|
1f5593 |
From: Lokesh Mandvekar <lsm5@fedoraproject.org>
|
|
|
1f5593 |
Date: Tue, 12 Dec 2017 13:22:42 +0530
|
|
|
1f5593 |
Subject: [PATCH] Revert "Apply cgroups earlier"
|
|
|
1f5593 |
|
|
|
1f5593 |
This reverts commit 7062c7556b71188abc18d7516441ff4b03fbc1fc.
|
|
|
1f5593 |
---
|
|
|
1f5593 |
libcontainer/process_linux.go | 31 ++++++++++++++-----------------
|
|
|
1f5593 |
1 file changed, 14 insertions(+), 17 deletions(-)
|
|
|
1f5593 |
|
|
|
1f5593 |
diff --git a/libcontainer/process_linux.go b/libcontainer/process_linux.go
|
|
|
1f5593 |
index 149b1126..b8a395af 100644
|
|
|
1f5593 |
--- a/libcontainer/process_linux.go
|
|
|
1f5593 |
+++ b/libcontainer/process_linux.go
|
|
|
1f5593 |
@@ -272,6 +272,20 @@ func (p *initProcess) start() error {
|
|
|
1f5593 |
p.process.ops = nil
|
|
|
1f5593 |
return newSystemErrorWithCause(err, "starting init process command")
|
|
|
1f5593 |
}
|
|
|
1f5593 |
+ if _, err := io.Copy(p.parentPipe, p.bootstrapData); err != nil {
|
|
|
1f5593 |
+ return newSystemErrorWithCause(err, "copying bootstrap data to pipe")
|
|
|
1f5593 |
+ }
|
|
|
1f5593 |
+ if err := p.execSetns(); err != nil {
|
|
|
1f5593 |
+ return newSystemErrorWithCause(err, "running exec setns process for init")
|
|
|
1f5593 |
+ }
|
|
|
1f5593 |
+ // Save the standard descriptor names before the container process
|
|
|
1f5593 |
+ // can potentially move them (e.g., via dup2()). If we don't do this now,
|
|
|
1f5593 |
+ // we won't know at checkpoint time which file descriptor to look up.
|
|
|
1f5593 |
+ fds, err := getPipeFds(p.pid())
|
|
|
1f5593 |
+ if err != nil {
|
|
|
1f5593 |
+ return newSystemErrorWithCausef(err, "getting pipe fds for pid %d", p.pid())
|
|
|
1f5593 |
+ }
|
|
|
1f5593 |
+ p.setExternalDescriptors(fds)
|
|
|
1f5593 |
// Do this before syncing with child so that no children can escape the
|
|
|
1f5593 |
// cgroup. We don't need to worry about not doing this and not being root
|
|
|
1f5593 |
// because we'd be using the rootless cgroup manager in that case.
|
|
|
1f5593 |
@@ -292,23 +306,6 @@ func (p *initProcess) start() error {
|
|
|
1f5593 |
}
|
|
|
1f5593 |
}
|
|
|
1f5593 |
}()
|
|
|
1f5593 |
-
|
|
|
1f5593 |
- if _, err := io.Copy(p.parentPipe, p.bootstrapData); err != nil {
|
|
|
1f5593 |
- return newSystemErrorWithCause(err, "copying bootstrap data to pipe")
|
|
|
1f5593 |
- }
|
|
|
1f5593 |
-
|
|
|
1f5593 |
- if err := p.execSetns(); err != nil {
|
|
|
1f5593 |
- return newSystemErrorWithCause(err, "running exec setns process for init")
|
|
|
1f5593 |
- }
|
|
|
1f5593 |
-
|
|
|
1f5593 |
- // Save the standard descriptor names before the container process
|
|
|
1f5593 |
- // can potentially move them (e.g., via dup2()). If we don't do this now,
|
|
|
1f5593 |
- // we won't know at checkpoint time which file descriptor to look up.
|
|
|
1f5593 |
- fds, err := getPipeFds(p.pid())
|
|
|
1f5593 |
- if err != nil {
|
|
|
1f5593 |
- return newSystemErrorWithCausef(err, "getting pipe fds for pid %d", p.pid())
|
|
|
1f5593 |
- }
|
|
|
1f5593 |
- p.setExternalDescriptors(fds)
|
|
|
1f5593 |
if err := p.createNetworkInterfaces(); err != nil {
|
|
|
1f5593 |
return newSystemErrorWithCause(err, "creating network interfaces")
|
|
|
1f5593 |
}
|
|
|
1f5593 |
--
|
|
|
1f5593 |
2.14.3
|
|
|
1f5593 |
|