use final names for cgroup isolation

[pve-container.git] / src / PVE / LXC.pm

diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index 6c4980b5a55de8b023a5d0b2da03942083fc5bbd..b4ffc9bdc5508c3f058db6330b2bf0971b7c09c3 100644 (file)
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -107,23 +107,6 @@ sub get_container_disk_usage {
 
 my $last_proc_vmid_stat;
 
-my $parse_cpuacct_stat = sub {
-    my ($vmid, $unprivileged) = @_;
-
-    my $raw = read_cgroup_value('cpuacct', $vmid, $unprivileged, 'cpuacct.stat', 1);
-
-    my $stat = {};
-
-    if ($raw =~ m/^user (\d+)\nsystem (\d+)\n/) {
-
-       $stat->{utime} = $1;
-       $stat->{stime} = $2;
-
-    }
-
-    return $stat;
-};
-
 our $vmstatus_return_properties = {
     vmid => get_standard_option('pve-vmid'),
     status => {
@@ -325,33 +308,6 @@ sub vmstatus {
     return $list;
 }
 
-sub read_cgroup_list($$$$) {
-    my ($group, $vmid, $unprivileged, $name) = @_;
-
-    my $content = read_cgroup_value($group, $vmid, $unprivileged, $name, 1);
-
-    return { split(/\s+/, $content) };
-}
-
-sub read_cgroup_value($$$$$) {
-    my ($group, $vmid, $unprivileged, $name, $full) = @_;
-
-    my $nsdir = $unprivileged ? '' : 'ns/';
-    my $path = "/sys/fs/cgroup/$group/lxc/$vmid/${nsdir}$name";
-
-    return PVE::Tools::file_get_contents($path) if $full;
-
-    return PVE::Tools::file_read_firstline($path);
-}
-
-sub write_cgroup_value {
-   my ($group, $vmid, $name, $value) = @_;
-
-   my $path = "/sys/fs/cgroup/$group/lxc/$vmid/$name";
-   PVE::ProcFSTools::write_proc_entry($path, $value) if -e $path;
-
-}
-
 sub find_lxc_console_pids {
 
     my $res = {};
@@ -624,8 +580,26 @@ sub update_lxc_config {
        return;
     }
 
+    my ($lxc_major, $lxc_minor) = get_lxc_version();
+
     my $raw = '';
 
+    if ($lxc_major >= 4) {
+       # Explicitly don't use relative directories, which is the default, but
+       # note that we do this mostly because they are only applied for *some*
+       # cgroups. Our pve-container@.service now starts lxc-start with `-F`,
+       # so we also don't need to worry about the new monitor cgroup to
+       # confuse systemd.
+       $raw .= "lxc.cgroup.relative = 0\n";
+
+       # To make things easier, let's keep our previous cgroup layout and
+       # simply move the monitor outside:
+       $raw .= "lxc.cgroup.dir.monitor = lxc.monitor/$vmid\n";
+       # cgroup namespace separation for stronger limits:
+       $raw .= "lxc.cgroup.dir.container = lxc/$vmid\n";
+       $raw .= "lxc.cgroup.dir.container.inner = ns\n";
+    }
+
     die "missing 'arch' - internal error" if !$conf->{arch};
     $raw .= "lxc.arch = $conf->{arch}\n";
 
@@ -726,6 +700,11 @@ sub update_lxc_config {
        $raw .= "lxc.net.$ind.hwaddr = $d->{hwaddr}\n" if defined($d->{hwaddr});
        $raw .= "lxc.net.$ind.name = $d->{name}\n" if defined($d->{name});
        $raw .= "lxc.net.$ind.mtu = $d->{mtu}\n" if defined($d->{mtu});
+
+       # Starting with lxc 4.0, we do not patch lxc to execute our up-scripts.
+       if ($lxc_major >= 4) {
+           $raw .= "lxc.net.$ind.script.up = /usr/share/lxc/lxcnetaddbr\n";
+       }
     }
 
     my $had_cpuset = 0;
@@ -2390,4 +2369,20 @@ sub copy_volume {
     return $new_volid;
 }
 
+sub get_lxc_version() {
+    my $version;
+    PVE::Tools::run_command([qw(lxc-start --version)], outfunc => sub {
+       my ($line) = @_;
+       # We only parse out major & minor version numbers.
+       if ($line =~ /^(\d+)\.(\d+)(?:\D.*)?$/) {
+           $version = [$1, $2];
+       }
+    });
+
+    die "failed to get lxc version\n" if !defined($version);
+
+    # return as a list:
+    return $version->@*;
+}
+
 1;