From 3bcc09a04ddc3303d79e2e3913fa0d90dee1e1b2 Mon Sep 17 00:00:00 2001 From: Zexi Li Date: Tue, 19 Mar 2024 15:09:58 +0800 Subject: [PATCH] feat(host): set container memory limit --- cmd/climc/shell/compute/containers.go | 1 + pkg/hostman/guestman/pod.go | 58 ++++++++++++++-------- pkg/hostman/options/options.go | 1 + pkg/mcclient/options/compute/containers.go | 4 ++ 4 files changed, 43 insertions(+), 21 deletions(-) diff --git a/cmd/climc/shell/compute/containers.go b/cmd/climc/shell/compute/containers.go index 0ac39a421b..1caa50c3e0 100644 --- a/cmd/climc/shell/compute/containers.go +++ b/cmd/climc/shell/compute/containers.go @@ -24,6 +24,7 @@ func init() { cmd := shell.NewResourceCmd(&modules.Containers) cmd.Create(new(options.ContainerCreateOptions)) cmd.List(new(options.ContainerListOptions)) + cmd.Show(new(options.ContainerShowOptions)) cmd.BatchDelete(new(options.ContainerDeleteOptions)) cmd.BatchPerform("stop", new(options.ContainerStopOptions)) cmd.BatchPerform("start", new(options.ContainerStartOptions)) diff --git a/pkg/hostman/guestman/pod.go b/pkg/hostman/guestman/pod.go index 32fcfea1ae..a6f69dedd6 100644 --- a/pkg/hostman/guestman/pod.go +++ b/pkg/hostman/guestman/pod.go @@ -335,7 +335,7 @@ func (s *sPodGuestInstance) getPortMapping(pm *computeapi.PodPortMapping) (*runt if pm.HostPort != nil { runtimePm.HostPort = int32(*pm.HostPort) if getport.IsPortUsed(portProtocol, "", *pm.HostPort) { - return nil, httperrors.NewInputParameterError("host_port %d is used", pm.HostPort) + return nil, httperrors.NewInputParameterError("host_port %d is used", *pm.HostPort) } usedPorts, ok := otherPorts[pm.Protocol] if ok { @@ -364,6 +364,11 @@ func (s *sPodGuestInstance) getPortMapping(pm *computeapi.PodPortMapping) (*runt } } +func (s *sPodGuestInstance) getCgroupParent() string { + // return fmt.Sprintf("/cloudpods/%s", s.GetId()) + return "/cloudpods" +} + func (s *sPodGuestInstance) startPod(ctx context.Context, userCred mcclient.TokenCredential) (*computeapi.PodStartResponse, error) { podInput, err := s.getPodCreateParams() if err != nil { @@ -386,7 +391,7 @@ func (s *sPodGuestInstance) startPod(ctx context.Context, userCred mcclient.Toke Labels: nil, Annotations: nil, Linux: &runtimeapi.LinuxPodSandboxConfig{ - CgroupParent: "", + CgroupParent: s.getCgroupParent(), SecurityContext: &runtimeapi.LinuxSandboxSecurityContext{ NamespaceOptions: nil, SelinuxOptions: nil, @@ -395,8 +400,12 @@ func (s *sPodGuestInstance) startPod(ctx context.Context, userCred mcclient.Toke ReadonlyRootfs: false, SupplementalGroups: nil, Privileged: s.getPodPrivilegedMode(podInput), - Seccomp: nil, - Apparmor: nil, + Seccomp: &runtimeapi.SecurityProfile{ + ProfileType: runtimeapi.SecurityProfile_Unconfined, + }, + Apparmor: &runtimeapi.SecurityProfile{ + ProfileType: runtimeapi.SecurityProfile_Unconfined, + }, SeccompProfilePath: "", }, Sysctls: nil, @@ -667,8 +676,8 @@ func (s *sPodGuestInstance) getContainerLogPath(ctrId string) string { } func (s *sPodGuestInstance) getLxcfsMounts() []*runtimeapi.Mount { - // TODO: make lxcfs configurable or be able to auto detect - lxcfsPath := "/var/lib/lxc/lxcfs" + // lxcfsPath := "/var/lib/lxc/lxcfs" + lxcfsPath := options.HostOptions.LxcfsPath return []*runtimeapi.Mount{ { ContainerPath: "/proc/uptime", @@ -737,6 +746,9 @@ func (s *sPodGuestInstance) createContainer(ctx context.Context, userCred mcclie if err != nil { return "", errors.Wrap(err, "get container mounts") } + + // REF: https://docs.docker.com/config/containers/resource_constraints/#configure-the-default-cfs-scheduler + var defaultCPUPeriod int64 = 1000 spec := input.Spec ctrCfg := &runtimeapi.ContainerConfig{ Metadata: &runtimeapi.ContainerMetadata{ @@ -746,18 +758,18 @@ func (s *sPodGuestInstance) createContainer(ctx context.Context, userCred mcclie Image: spec.Image, }, Linux: &runtimeapi.LinuxContainerConfig{ - //Resources: &runtimeapi.LinuxContainerResources{ - // CpuPeriod: 0, - // CpuQuota: 0, - // CpuShares: 0, - // MemoryLimitInBytes: 1024 * 1024 * 4, - // OomScoreAdj: 0, - // CpusetCpus: "", - // CpusetMems: "", - // HugepageLimits: nil, - // Unified: nil, - // MemorySwapLimitInBytes: 0, - //}, + Resources: &runtimeapi.LinuxContainerResources{ + CpuPeriod: defaultCPUPeriod, + //CpuQuota: s.GetDesc().Cpu * defaultCPUPeriod, + //CpuShares: defaultCPUPeriod, + MemoryLimitInBytes: s.GetDesc().Mem * 1024 * 1024, + OomScoreAdj: 0, + CpusetCpus: "", + CpusetMems: "", + HugepageLimits: nil, + Unified: nil, + MemorySwapLimitInBytes: 0, + }, SecurityContext: &runtimeapi.LinuxContainerSecurityContext{ Capabilities: &runtimeapi.Capability{}, Privileged: spec.Privileged, @@ -768,11 +780,15 @@ func (s *sPodGuestInstance) createContainer(ctx context.Context, userCred mcclie RunAsUsername: "", ReadonlyRootfs: false, SupplementalGroups: nil, - NoNewPrivs: false, + NoNewPrivs: true, MaskedPaths: nil, ReadonlyPaths: nil, - Seccomp: nil, - Apparmor: nil, + Seccomp: &runtimeapi.SecurityProfile{ + ProfileType: runtimeapi.SecurityProfile_Unconfined, + }, + Apparmor: &runtimeapi.SecurityProfile{ + ProfileType: runtimeapi.SecurityProfile_Unconfined, + }, ApparmorProfile: "", SeccompProfilePath: "", }, diff --git a/pkg/hostman/options/options.go b/pkg/hostman/options/options.go index 0d17ebb2bf..73f2e06324 100644 --- a/pkg/hostman/options/options.go +++ b/pkg/hostman/options/options.go @@ -208,6 +208,7 @@ type SHostOptions struct { // EnableContainerRuntime bool `help:"enable container runtime" default:"false"` ContainerRuntimeEndpoint string `help:"endpoint of container runtime service" default:"unix:///var/run/onecloud/containerd/containerd.sock"` ContainerDeviceConfigFile string `help:"container device configuration file path"` + LxcfsPath string `help:"lxcfs directory path" default:"/var/lib/lxcfs"` } var ( diff --git a/pkg/mcclient/options/compute/containers.go b/pkg/mcclient/options/compute/containers.go index cb9a34278d..e3fd9b0293 100644 --- a/pkg/mcclient/options/compute/containers.go +++ b/pkg/mcclient/options/compute/containers.go @@ -35,6 +35,10 @@ func (o *ContainerListOptions) Params() (jsonutils.JSONObject, error) { return options.ListStructToParams(o) } +type ContainerShowOptions struct { + ServerIdOptions +} + type ContainerDeleteOptions struct { ServerIdsOptions }