Red Hat Bugzilla – Bug 1268059
docker exec setting the wrong cgroups
Last modified: 2016-05-12 11:16:45 EDT
When running "docker exec bash" into a container, cgroups can be set wrong. Running a systemd-based container built from: https://github.com/riekrh/Fedora-Dockerfiles/tree/master/systemd/apache-atomic The Dockerfile has: CMD ["/usr/sbin/init"] Ignore the LABELS. Starting via: # docker run --rm -p 80:80 -v /sys/fs/cgroup:/sys/fs/cgroup --init=systemd --name my-httpd-atomic llunved/httpd-atomic Then: # docker exec CONTAINERID bash [ ENTERING CONTAINER ] bash-4.3# cat /proc/1/cgroup 10:hugetlb:/ 9:perf_event:/ 8:blkio:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope 7:net_cls:/ 6:freezer:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope 5:devices:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope 4:memory:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope 3:cpuacct,cpu:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope 2:cpuset:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope 1:name=systemd:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope bash-4.3# cat /proc/self/cgroup 10:hugetlb:/ 9:perf_event:/ 8:blkio:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope 7:net_cls:/ 6:freezer:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope 5:devices:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope 4:memory:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope 3:cpuacct,cpu:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope 2:cpuset:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope 1:name=systemd:/system.slice/docker.service * So the cgroups are different between systemd in the container and the instance of bash (self) created by docker exec. Note sure if this affects non-systemd containers. A possible effect of this is, that "# systemctl restart httpd" does no work in the example container.
Mrunal can you take a look at this. docker exec should be putting the process inside of the pid 1 cgroup.
Found the issue. Not all paths are set correctly during exec. I am working on a fix.
https://github.com/opencontainers/runc/pull/315 opened to correct the systemd name cgroup.
Leave assigned until it gets merged and we can identify a docker rpm that the fix will be in.
https://github.com/opencontainers/runc/pull/315 has been merged. Next step will be to get it into docker as part of runc update.
Fixed in docker-1.9
(In reply to Daniel Riek from comment #0) > Starting via: > # docker run --rm -p 80:80 -v /sys/fs/cgroup:/sys/fs/cgroup --init=systemd > --name my-httpd-atomic llunved/httpd-atomic There is no '--init' option in docker-1.9.1-16.el7.x86_64. # docker run --rm -p 80:80 -v /sys/fs/cgroup:/sys/fs/cgroup --init=systemd --name my-httpd-atomic llunved/httpd-atomic flag provided but not defined: --init See 'docker run --help'.
Correct we have dropped --init from docker-1.9 and future. We will have a new way of doing this in docker-1.10 that is less onerous to upstream.
Taking out the needinfo as Dan Walsh provided the information.
Since lack of implementation of --init in docker client, i'd like to verified this via ONLY checking those patch whether is in the current git branch(top git commit) In docker-1.9.1-38.el7.x86_64, move to verified
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2016-1034.html