Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1573716

Summary: optimized image builds (imagebuilder) isn't being cgroup confined
Product: OpenShift Container Platform Reporter: Clayton Coleman <ccoleman>
Component: BuildAssignee: Clayton Coleman <ccoleman>
Status: CLOSED ERRATA QA Contact: Wenjing Zheng <wzheng>
Severity: high Docs Contact:
Priority: unspecified    
Version: 3.10.0CC: aos-bugs, bparees, ccoleman, dyan
Target Milestone: ---   
Target Release: 3.10.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-07-30 19:14:34 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Clayton Coleman 2018-05-02 06:24:09 UTC
A 3.10 build that is using imageOptimizationPolicy is bypassing cgroup limits (no cgroup setting is being passed to the docker container it creates).

Have not tested with regular docker build.

Comment 1 Ben Parees 2018-05-02 16:13:25 UTC
pretty sure it works for regular docker builds, we have an extended test that looks at the cgroup limits within the Dockerfile execution.

you can add a variant of that test when you fix this:
https://github.com/openshift/origin/blob/master/test/extended/builds/docker_quota.go#L14


Do you expect to have this fixed for 3.10? if not, can we set the target release to 3.11 so it's not showing up on the blocker list?

Comment 2 Clayton Coleman 2018-05-02 16:37:43 UTC
https://github.com/openshift/origin/pull/19592

Comment 3 Clayton Coleman 2018-05-02 16:37:59 UTC
This may need to be back ported to 3.9

Comment 5 Dongbo Yan 2018-05-16 09:00:38 UTC
Verified
openshift v3.10.0-0.41.0
kubernetes v1.10.0+b81c8f8
etcd 3.2.16

Reproduce steps:
1.Create a bc
$ oc create -f https://raw.githubusercontent.com/openshift/origin/master/test/extended/testdata/builds/test-docker-build-quota-optimized.json

2.Start build from dir
$ wget https://raw.githubusercontent.com/openshift/origin/master/test/extended/testdata/builds/build-quota/.s2i/bin/assemble
$ wget https://raw.githubusercontent.com/openshift/origin/master/test/extended/testdata/builds/build-quota/Dockerfile
$ oc start-build docker-build-quota --from-dir=.

3.Check build logs
# oc logs -f build/docker-build-quota-4
Receiving source from STDIN as archive ...
--> FROM centos:7 as 0
--> USER root
--> ADD .s2i/bin/assemble .
--> RUN ./assemble
MEMORY=209715200
MEMORYSWAP=209715200
QUOTA=-1
SHARES=1024
PERIOD=100000

Comment 7 errata-xmlrpc 2018-07-30 19:14:34 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1816