From dfb3496c174377b860b62872ce6af951364cc3ac Mon Sep 17 00:00:00 2001 From: Lokesh Mandvekar Date: Tue, 12 Dec 2017 13:22:42 +0530 Subject: [PATCH] Revert "Apply cgroups earlier" This reverts commit 7062c7556b71188abc18d7516441ff4b03fbc1fc. --- libcontainer/process_linux.go | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-) diff --git a/libcontainer/process_linux.go b/libcontainer/process_linux.go index 149b1126..b8a395af 100644 --- a/libcontainer/process_linux.go +++ b/libcontainer/process_linux.go @@ -272,6 +272,20 @@ func (p *initProcess) start() error { p.process.ops = nil return newSystemErrorWithCause(err, "starting init process command") } + if _, err := io.Copy(p.parentPipe, p.bootstrapData); err != nil { + return newSystemErrorWithCause(err, "copying bootstrap data to pipe") + } + if err := p.execSetns(); err != nil { + return newSystemErrorWithCause(err, "running exec setns process for init") + } + // Save the standard descriptor names before the container process + // can potentially move them (e.g., via dup2()). If we don't do this now, + // we won't know at checkpoint time which file descriptor to look up. + fds, err := getPipeFds(p.pid()) + if err != nil { + return newSystemErrorWithCausef(err, "getting pipe fds for pid %d", p.pid()) + } + p.setExternalDescriptors(fds) // Do this before syncing with child so that no children can escape the // cgroup. We don't need to worry about not doing this and not being root // because we'd be using the rootless cgroup manager in that case. @@ -292,23 +306,6 @@ func (p *initProcess) start() error { } } }() - - if _, err := io.Copy(p.parentPipe, p.bootstrapData); err != nil { - return newSystemErrorWithCause(err, "copying bootstrap data to pipe") - } - - if err := p.execSetns(); err != nil { - return newSystemErrorWithCause(err, "running exec setns process for init") - } - - // Save the standard descriptor names before the container process - // can potentially move them (e.g., via dup2()). If we don't do this now, - // we won't know at checkpoint time which file descriptor to look up. - fds, err := getPipeFds(p.pid()) - if err != nil { - return newSystemErrorWithCausef(err, "getting pipe fds for pid %d", p.pid()) - } - p.setExternalDescriptors(fds) if err := p.createNetworkInterfaces(); err != nil { return newSystemErrorWithCause(err, "creating network interfaces") } -- 2.14.3