Documentation
¶
Overview ¶
Package ateomcgroup delegates the worker pod's cgroup to the ateom so each actor can get a leaf of its own.
Index ¶
Constants ¶
const Root = "/sys/fs/cgroup"
Root is the worker pod's cgroup scope inside its private cgroup namespace.
Variables ¶
This section is empty.
Functions ¶
func Delegate ¶
Delegate prepares the worker pod's cgroup so the runtime can create per-actor leaves under it with real cpu/memory/pids accounting. It reports whether it did: a worker outside a private cgroup namespace is left alone.
The unprivileged worker runs in a private cgroup namespace, so /sys/fs/cgroup is the pod's own cgroup scope rather than the host root. Two things must be arranged before runsc can nest container cgroups here:
- The cgroup v2 "no internal processes" rule forbids a cgroup from holding processes directly while also delegating controllers to children. The pod scope is not the true cgroup root, so the exemption does not apply: we move the worker's own processes into a dedicated "ateom" leaf.
- Controllers are only available to children if enabled in the scope's cgroup.subtree_control. We enable everything the parent delegated to us.
The runtime bind-mounts /sys/fs/cgroup read-only for unprivileged pods. The worker holds CAP_SYS_ADMIN with no user namespace, so the ro flag is not locked: clear it and leave it writable (the runtime writes here on every create/restore).
func KillActorLeaf ¶
KillActorLeaf kills every process in the named leaf, including any they forked, and waits until the leaf is empty or ctx is done. A missing leaf, or a kernel without cgroup.kill, has nothing done.
func KillLeafUnder ¶
KillLeafUnder is KillActorLeaf for a leaf under root rather than Root.
func RemoveActorLeaf ¶
RemoveActorLeaf deletes the actor's leaf. Its processes must have exited.
Types ¶
type ActorLeaf ¶
type ActorLeaf struct {
// contains filtered or unexported fields
}
ActorLeaf is a cgroup of its own for one actor's host processes, so actors on one worker share its CPU fairly and each stays within its declared limit.
func OpenActorLeaf ¶
OpenActorLeaf creates the actor's leaf under the delegated scope, or reuses a leftover one, and caps it at milliCPU when that is set. Close it once its processes are started.
func (*ActorLeaf) Close ¶
Close releases the leaf's handle. The leaf itself stays until RemoveActorLeaf.
func (*ActorLeaf) SysProcAttr ¶
func (l *ActorLeaf) SysProcAttr() *syscall.SysProcAttr
SysProcAttr starts a process directly inside the leaf. A nil leaf starts it where the caller is.
Source Files