Bug 1268059 - docker exec setting the wrong cgroups
docker exec setting the wrong cgroups
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: docker (Show other bugs)
7.1
Unspecified Unspecified
unspecified Severity urgent
: rc
: ---
Assigned To: Mrunal Patel
atomic-bugs@redhat.com
: Extras
Depends On:
Blocks: docker-1.10
  Show dependency treegraph
 
Reported: 2015-10-01 13:22 EDT by Daniel Riek
Modified: 2016-05-12 11:16 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-05-12 11:16:45 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Daniel Riek 2015-10-01 13:22:21 EDT
When running "docker exec bash" into a container, cgroups can be set wrong.

Running a systemd-based container built from: 
https://github.com/riekrh/Fedora-Dockerfiles/tree/master/systemd/apache-atomic

The Dockerfile has:
CMD ["/usr/sbin/init"]

Ignore the LABELS. 

Starting via:
# docker run --rm -p 80:80 -v /sys/fs/cgroup:/sys/fs/cgroup --init=systemd --name my-httpd-atomic llunved/httpd-atomic

Then:
# docker exec CONTAINERID bash
[ ENTERING CONTAINER ] 
bash-4.3# cat /proc/1/cgroup 
10:hugetlb:/
9:perf_event:/
8:blkio:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope
7:net_cls:/
6:freezer:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope
5:devices:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope
4:memory:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope
3:cpuacct,cpu:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope
2:cpuset:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope
1:name=systemd:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope

bash-4.3# cat /proc/self/cgroup 
10:hugetlb:/
9:perf_event:/
8:blkio:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope
7:net_cls:/
6:freezer:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope
5:devices:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope
4:memory:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope
3:cpuacct,cpu:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope
2:cpuset:/system.slice/docker-8a632f02f168fed20f7ff7c56c060cfba3f8c5f081297d4e60360cbeaa4c53e3.scope
1:name=systemd:/system.slice/docker.service

* So the cgroups are different between systemd in the container and the instance of bash (self) created by docker exec.

Note sure if this affects non-systemd containers.

A possible effect of this is, that "# systemctl restart httpd" does no work in the example container.
Comment 2 Daniel Walsh 2015-10-01 16:54:54 EDT
Mrunal can you take a look at this.

docker exec should be putting the process inside of the pid 1 cgroup.
Comment 3 Mrunal Patel 2015-10-01 19:51:31 EDT
Found the issue. Not all paths are set correctly during exec.
I am working on a fix.
Comment 4 Mrunal Patel 2015-10-05 15:30:09 EDT
https://github.com/opencontainers/runc/pull/315 opened to correct the systemd name cgroup.
Comment 5 Daniel Walsh 2015-10-05 16:46:10 EDT
Leave assigned until it gets merged and we can identify a docker rpm that the fix will be in.
Comment 6 Mrunal Patel 2015-10-05 18:19:06 EDT
https://github.com/opencontainers/runc/pull/315 has been merged. Next step will be to get it into docker as part of runc update.
Comment 7 Daniel Walsh 2015-10-06 09:08:10 EDT
Fixed in docker-1.9
Comment 9 Alex Jia 2016-02-03 05:31:59 EST
(In reply to Daniel Riek from comment #0)

> Starting via:
> # docker run --rm -p 80:80 -v /sys/fs/cgroup:/sys/fs/cgroup --init=systemd
> --name my-httpd-atomic llunved/httpd-atomic

There is no '--init' option in docker-1.9.1-16.el7.x86_64.

# docker run --rm -p 80:80 -v /sys/fs/cgroup:/sys/fs/cgroup --init=systemd --name my-httpd-atomic llunved/httpd-atomic
flag provided but not defined: --init
See 'docker run --help'.
Comment 10 Daniel Walsh 2016-02-03 06:45:17 EST
Correct we have dropped --init from docker-1.9 and future.  We will have a new way of doing this in docker-1.10 that is less onerous to upstream.
Comment 11 Mrunal Patel 2016-03-21 12:38:56 EDT
Taking out the needinfo as Dan Walsh provided the information.
Comment 14 Luwen Su 2016-05-02 05:06:21 EDT
Since lack of implementation of --init in docker client, i'd like to verified this via ONLY checking those patch whether is in the current git branch(top git commit) 

In docker-1.9.1-38.el7.x86_64, move to verified
Comment 16 errata-xmlrpc 2016-05-12 11:16:45 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-1034.html

Note You need to log in before you can comment on or make changes to this bug.