core/spindle/engines/ at 566697c68dfd519f745fe12862707c898695166b · alice.pds.demo.boltless.dev/core · Tangled

alice.pds.demo.boltless.dev / core

0

This repository has no description

0

core / spindle / engines

3 folders

at 566697c68dfd519f745fe12862707c898695166b

Winter spindle/microvm: vacate populated cgroup namespace roots at init 19d ago

spindle/engines/nixery: make engine fully lazy Signed-off-by: dawn <dawn@tangled.org>

3 weeks ago

spindle/microvm: vacate populated cgroup namespace roots at init initCgroupParent skips the parent-process move at group "/", assuming the real root cgroup, which is exempt from the no-internal-process constraint. in a private cgroup namespace (podman and docker's default on cgroup v2) "/" is a populated delegated NON-root cgroup instead, so the first workflow fails: 'failed to write subtree controllers [memory pids] to "/sys/fs/cgroup/cgroup.subtree_control"': EBUSY. userspace cannot tell the two "/"s apart — cgroup namespaces virtualize /proc/self/cgroup and mountinfo for the reader — but the constraint can: it exempts only the real root. probe it by writing +memory +pids to cgroup.subtree_control: succeeds at the real root (the same write prepareCgroup does per microVM anyway), EBUSY at a populated namespace root, where we then vacate exactly as on the group != "/" path. a read-only cgroupfs now fails loudly at init instead of mid-workflow. verified in scratch podman containers: unpatched reproduces the EBUSY, patched passes the new regression test and enforces memory.max. Signed-off-by: Winter <winter@madoka.systems>

2 weeks ago

spindle/engines/nixery: make engine fully lazy Signed-off-by: dawn <dawn@tangled.org>

3 weeks ago