Address @kolyshkin comments

Signed-off-by: Cédric Clerget <[email protected]>

libcontainer/cgroups/fs/fs.go

@@ -279,7 +279,9 @@ func GetEffectiveCPUs(cpusetPath string, cgroups *configs.Cgroup) string {
  }
 
  // Iterates until it goes to the cgroup root path.
- for path := filepath.Clean(cpusetPath); path != defaultCgroupRoot; path = filepath.Dir(path) {
+ // It's required for containers in which cpuset controller
+ // is not enabled, in this case a parent cgroup is used.
+ for path := cpusetPath; path != defaultCgroupRoot; path = filepath.Dir(path) {
  cpus, err := fscommon.GetCgroupParamString(path, "cpuset.effective_cpus")
  if err == nil {
  return cpus

libcontainer/cgroups/fs2/fs2.go

@@ -10,6 +10,7 @@ import (
  "github.com/opencontainers/runc/libcontainer/cgroups"
  "github.com/opencontainers/runc/libcontainer/cgroups/fscommon"
  "github.com/opencontainers/runc/libcontainer/configs"
+ "github.com/opencontainers/runc/libcontainer/utils"
 )
 
 type parseError = fscommon.ParseError
@@ -33,6 +34,9 @@ func NewManager(config *configs.Cgroup, dirPath string) (*Manager, error) {
  if err != nil {
  return nil, err
  }
+ } else {
+ // Clean path for safety.
+ dirPath = utils.CleanPath(dirPath)
  }
 
  m := &Manager{
@@ -327,9 +331,11 @@ func (m *Manager) GetEffectiveCPUs() string {
  }
 
  // Iterates until it goes outside of the cgroup root path.
+ // It's required for containers in which cpuset controller
+ // is not enabled, in this case a parent cgroup is used.
  outsidePath := filepath.Dir(UnifiedMountpoint)
 
- for path := filepath.Clean(m.dirPath); path != outsidePath; path = filepath.Dir(path) {
+ for path := m.dirPath; path != outsidePath; path = filepath.Dir(path) {
  cpus, err := fscommon.GetCgroupParamString(path, "cpuset.cpus.effective")
  if err == nil {
  return cpus

tests/integration/exec.bats

@@ -342,22 +342,17 @@ EOF
 }
 
 @test "runc exec with isolated cpus affinity temporary transition [cgroup cpuset]" {
- requires root
+ requires root cgroups_cpuset
 
  tmp=$(mktemp -d "$BATS_RUN_TMPDIR/runc.XXXXXX")
 
+ set_cgroup_cpuset_all_cpus
  local all_cpus
- all_cpus="$(cat /sys/devices/system/cpu/online)"
-
- update_config ".linux.resources.cpu.cpus = \"$all_cpus\""
+ all_cpus="$(get_all_online_cpus)"
 
  # set temporary isolated CPU affinity transition
  update_config '.annotations += {"org.opencontainers.runc.exec.isolated-cpu-affinity-transition": "temporary"}'
 
- local mems
- mems="$(cat /sys/devices/system/node/online 2>/dev/null || true)"
- [[ -n $mems ]] && update_config ".linux.resources.cpu.mems = \"$mems\""
-
  runc run -d --console-socket "$CONSOLE_SOCKET" test_isolated_temporary_transition
  [ "$status" -eq 0 ]
 
@@ -375,25 +370,17 @@ EOF
 }
 
 @test "runc exec with isolated cpus affinity definitive transition [cgroup cpuset]" {
- requires root
+ requires root cgroups_cpuset
 
  tmp=$(mktemp -d "$BATS_RUN_TMPDIR/runc.XXXXXX")
 
+ set_cgroup_cpuset_all_cpus
  local all_cpus
- all_cpus="$(cat /sys/devices/system/cpu/online)"
-
- local first_cpu="0"
- [[ $all_cpus =~ [^0-9]*([0-9]+)([-,][0-9]+)? ]] && first_cpu=${BASH_REMATCH[1]}
-
- update_config ".linux.resources.cpu.cpus = \"$all_cpus\""
+ all_cpus="$(get_all_online_cpus)"
 
  # set definitive isolated CPU affinity transition
  update_config '.annotations += {"org.opencontainers.runc.exec.isolated-cpu-affinity-transition": "definitive"}'
 
- local mems
- mems="$(cat /sys/devices/system/node/online 2>/dev/null || true)"
- [[ -n $mems ]] && update_config ".linux.resources.cpu.mems = \"$mems\""
-
  runc run -d --console-socket "$CONSOLE_SOCKET" test_isolated_definitive_transition
  [ "$status" -eq 0 ]
 
@@ -411,34 +398,29 @@ EOF
  load /etc/os-release
 
  # fix unbound variable in condition below
- PLATFORM_ID=${PLATFORM_ID:-}
+ VERSION_ID=${VERSION_ID:-}
 
  allowed_cpus=$all_cpus
  # use first cpu on systems with RHEL >= 9 or systems with kernel >= 6.2
- if [[ "${ID_LIKE:-}" =~ "rhel" && "${PLATFORM_ID#platform:el*}" -ge "9" ]] || is_kernel_gte 6.2; then
- allowed_cpus=$first_cpu
+ if [[ "${ID_LIKE:-}" =~ "rhel" && "${VERSION_ID%%.*}" -ge "9" ]] || is_kernel_gte 6.2; then
+ allowed_cpus="$(get_first_online_cpu)"
  fi
 
  [[ "${lines[0]}" == "Cpus_allowed_list: $allowed_cpus" ]]
 }
 
 @test "runc exec with isolated cpus affinity bad transition [cgroup cpuset]" {
- requires root
+ requires root cgroups_cpuset
 
  tmp=$(mktemp -d "$BATS_RUN_TMPDIR/runc.XXXXXX")
 
+ set_cgroup_cpuset_all_cpus
  local all_cpus
- all_cpus="$(cat /sys/devices/system/cpu/online)"
-
- update_config ".linux.resources.cpu.cpus = \"$all_cpus\""
+ all_cpus="$(get_all_online_cpus)"
 
  # set a bad isolated CPU affinity transition
  update_config '.annotations += {"org.opencontainers.runc.exec.isolated-cpu-affinity-transition": "bad"}'
 
- local mems
- mems="$(cat /sys/devices/system/node/online 2>/dev/null || true)"
- [[ -n $mems ]] && update_config ".linux.resources.cpu.mems = \"$mems\""
-
  runc run -d --console-socket "$CONSOLE_SOCKET" test_isolated_bad_transition
  [ "$status" -eq 0 ]
 
@@ -455,21 +437,13 @@ EOF
 }
 
 @test "runc exec with taskset affinity [cgroup cpuset]" {
- requires root
+ requires root cgroups_cpuset
 
+ set_cgroup_cpuset_all_cpus
  local all_cpus
- all_cpus="$(cat /sys/devices/system/cpu/online)"
-
- local first_cpu="0"
- [[ $all_cpus =~ [^0-9]*([0-9]+)([-,][0-9]+)? ]] && first_cpu=${BASH_REMATCH[1]}
+ all_cpus="$(get_all_online_cpus)"
 
- update_config ".linux.resources.cpu.cpus = \"$all_cpus\""
-
- local mems
- mems="$(cat /sys/devices/system/node/online 2>/dev/null || true)"
- [[ -n $mems ]] && update_config ".linux.resources.cpu.mems = \"$mems\""
-
- taskset -p -c "$first_cpu" $$
+ taskset -p -c "$(get_first_online_cpu)" $$
 
  runc run -d --console-socket "$CONSOLE_SOCKET" test_with_taskset
  [ "$status" -eq 0 ]
@@ -487,12 +461,9 @@ EOF
  requires rootless cgroups_v2
 
  local all_cpus
- all_cpus="$(cat /sys/devices/system/cpu/online)"
-
- local first_cpu="0"
- [[ $all_cpus =~ [^0-9]*([0-9]+)([-,][0-9]+)? ]] && first_cpu=${BASH_REMATCH[1]}
+ all_cpus="$(get_all_online_cpus)"
 
- taskset -p -c "$first_cpu" $$
+ taskset -p -c "$(get_first_online_cpu)" $$
 
  runc run -d --console-socket "$CONSOLE_SOCKET" test_with_taskset
  [ "$status" -eq 0 ]

tests/integration/helpers.bash

@@ -354,6 +354,27 @@ function set_cgroup_mount_writable() {
  update_config '.mounts |= map((select(.type == "cgroup") | .options -= ["ro"]) // .)'
 }
 
+# Helper function to get all online cpus.
+function get_all_online_cpus() {
+ cat /sys/devices/system/cpu/online
+}
+
+# Helper function to get the first online cpu.
+function get_first_online_cpu() {
+ [[ $(get_all_online_cpus) =~ [^0-9]*([0-9]+)([-,][0-9]+)? ]] && echo "${BASH_REMATCH[1]}"
+}
+
+# Helper function to set all cpus/mems in container cgroup cpuset.
+function set_cgroup_cpuset_all_cpus() {
+ update_config ".linux.resources.cpu.cpus = \"$(get_all_online_cpus)\""
+
+ local mems
+ mems="$(cat /sys/devices/system/node/online 2>/dev/null || true)"
+ if [[ -n $mems ]]; then
+ update_config ".linux.resources.cpu.mems = \"$mems\""
+ fi
+}
+
 # Fails the current test, providing the error given.
 function fail() {
  echo "$@" >&2