Conversation
CRIU must run in the container cgroup so that, in the "ignore" cgroup mode, the tasks it restores are created there. Since CRIU is spawned by libcriu as a child of the caller, this was done by moving crun itself and moving it back once the restore was over. Move the call into a throw-away child process instead: it joins the container cgroup, asks CRIU to restore, and exits. Nothing has to be undone afterwards, so the reconstruction of the original cgroups (which is best-effort, and lossy with cgroup v1 named hierarchies) goes away. The process tree CRIU restores is a sibling of CRIU, hence a child of whoever called criu_restore_child(). Become a subreaper before forking, so that a non-detached restore still gets the container init as its own child and can wait for it. Signed-off-by: Giuseppe Scrivano <[email protected]> Signed-off-by: Kir Kolyshkin <[email protected]>
It was only used to move crun back to its original cgroups after a CRIU restore, which no longer happens now that CRIU is started from a child process. Signed-off-by: Giuseppe Scrivano <[email protected]> Signed-off-by: Kir Kolyshkin <[email protected]>
A restore without --detach must leave the restored init as a direct child of crun, otherwise crun cannot wait for it and report its exit status. Now that CRIU is invoked from a throw-away child process, the restored tree is created by that child, so crun must be a subreaper to inherit it. Add a test for it: restore in the foreground, check the parentage of the restored init, kill the container and check that crun reports 137. Signed-off-by: Giuseppe Scrivano <[email protected]> Signed-off-by: Kir Kolyshkin <[email protected]>
The runc repository has an extensive integration test suite, which can be used to test any OCI runtime that aims to be compatible with runc, by pointing the RUNC environment variable to it. Add a CI job that checks out runc, builds the helper binaries the tests need, and runs the suite against crun, mimicking what runc's own CI does: both as root and rootless, with both the cgroupfs and the systemd cgroup manager. Some of the tests currently fail with crun. Those are listed in tests/runc-integration-skip.txt, and skipped. An entry can also be a file name, meaning the whole file is to be skipped, which is used for runc features crun does not have (e.g. runc events). The list is expected to shrink over time. For now, runc is checked out from a branch with the changes to its tests needed to run them against crun (see opencontainers/runc#5455). Signed-off-by: Kir Kolyshkin <[email protected]>
Collaborator
Author
|
All runc tests passed; closing. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Do not merge. This is a combination of #2250 and #2238, to run runc integration tests against the changes from #2250.