v2

package
v1.0.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 2, 2021 License: Apache-2.0 Imports: 23 Imported by: 0

Documentation

Overview

Devicefilter containes eBPF device filter program

The implementation is based on https://github.com/containers/crun/blob/0.10.2/src/libcrun/ebpf.c

Although ebpf.c is originally licensed under LGPL-3.0-or-later, the author (Giuseppe Scrivano) agreed to relicense the file in Apache License 2.0: https://github.com/opencontainers/runc/issues/2144#issuecomment-543116397

This particular Go implementation based on runc version https://github.com/opencontainers/runc/blob/master/libcontainer/cgroups/ebpf/devicefilter/devicefilter.go

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrInvalidPid               = errors.New("cgroups: pid must be greater than 0")
	ErrMountPointNotExist       = errors.New("cgroups: cgroup mountpoint does not exist")
	ErrInvalidFormat            = errors.New("cgroups: parsing file with invalid format failed")
	ErrFreezerNotSupported      = errors.New("cgroups: freezer cgroup (v2) not supported on this system")
	ErrMemoryNotSupported       = errors.New("cgroups: memory cgroup (v2) not supported on this system")
	ErrPidsNotSupported         = errors.New("cgroups: pids cgroup (v2) not supported on this system")
	ErrCPUNotSupported          = errors.New("cgroups: cpu cgroup (v2) not supported on this system")
	ErrCgroupDeleted            = errors.New("cgroups: cgroup deleted")
	ErrNoCgroupMountDestination = errors.New("cgroups: cannot find cgroup mount destination")
	ErrInvalidGroupPath         = errors.New("cgroups: invalid group path")
)

Functions

func DeviceFilter 

func DeviceFilter(devices []specs.LinuxDeviceCgroup) (asm.Instructions, string, error)

DeviceFilter returns eBPF device filter program and its license string

func IgnoreNotExist 

func IgnoreNotExist(err error) error

IgnoreNotExist ignores any errors that are for not existing files

func LoadAttachCgroupDeviceFilter 

func LoadAttachCgroupDeviceFilter(insts asm.Instructions, license string, dirFD int) (func() error, error)

LoadAttachCgroupDeviceFilter installs eBPF device filter program to /sys/fs/cgroup/<foo> directory.

Requires the system to be running in cgroup2 unified-mode with kernel >= 4.15 .

https://github.com/torvalds/linux/commit/ebc614f687369f9df99828572b1d85a7c2de3d92

func NestedGroupPath 

func NestedGroupPath(suffix string) (string, error)

NestedGroupPath will nest the cgroups based on the calling processes cgroup placing its child processes inside its own path

func PidGroupPath 

func PidGroupPath(pid int) (string, error)

PidGroupPath will return the correct cgroup paths for an existing process running inside a cgroup This is commonly used for the Load function to restore an existing container

func VerifyGroupPath 

func VerifyGroupPath(g string) error

VerifyGroupPath verifies the format of group path string g. The format is same as the third field in /proc/PID/cgroup. e.g. "/user.slice/user-1001.slice/session-1.scope"

g must be a "clean" absolute path starts with "/", and must not contain "/sys/fs/cgroup" prefix.

VerifyGroupPath doesn't verify whether g actually exists on the system.

Types

type BFQ 

type BFQ struct {
	Weight uint16
}

type CPU 

type CPU struct {
	Weight *uint64
	Max    CPUMax
	Cpus   string
	Mems   string
}

func (*CPU) Values 

func (r *CPU) Values() (o []Value)

type CPUMax 

type CPUMax string

func NewCPUMax 

func NewCPUMax(quota *int64, period *uint64) CPUMax

type ControllerToggle 

type ControllerToggle int
const (
	Enable ControllerToggle = iota + 1
	Disable
)

type Entry 

type Entry struct {
	Type  IOType
	Major int64
	Minor int64
	Rate  uint64
}

func (Entry) String 

func (e Entry) String() string

type ErrorHandler 

type ErrorHandler func(err error) error

ErrorHandler is a function that handles and acts on errors

type Event 

type Event struct {
	Low     uint64
	High    uint64
	Max     uint64
	OOM     uint64
	OOMKill uint64
}

type HugeTlb 

type HugeTlb []HugeTlbEntry

func (*HugeTlb) Values 

func (r *HugeTlb) Values() (o []Value)

type HugeTlbEntry 

type HugeTlbEntry struct {
	HugePageSize string
	Limit        uint64
}

type IO 

type IO struct {
	BFQ BFQ
	Max []Entry
}

func (*IO) Values 

func (i *IO) Values() (o []Value)

type IOType 

type IOType string
const (
	ReadBPS   IOType = "rbps"
	WriteBPS  IOType = "wbps"
	ReadIOPS  IOType = "riops"
	WriteIOPS IOType = "wiops"
)

type Manager 

type Manager struct {
	// contains filtered or unexported fields
}

func LoadManager 

func LoadManager(mountpoint string, group string) (*Manager, error)

func LoadSystemd 

func LoadSystemd(slice, group string) (*Manager, error)

func NewManager 

func NewManager(mountpoint string, group string, resources *Resources) (*Manager, error)

func NewSystemd 

func NewSystemd(slice, group string, pid int, resources *Resources) (*Manager, error)

func (*Manager) AddProc 

func (c *Manager) AddProc(pid uint64) error

func (*Manager) Controllers 

func (c *Manager) Controllers() ([]string, error)

func (*Manager) Delete 

func (c *Manager) Delete() error

func (*Manager) DeleteSystemd 

func (c *Manager) DeleteSystemd() error

func (*Manager) EventChan 

func (c *Manager) EventChan() (<-chan Event, <-chan error)

func (*Manager) Freeze 

func (c *Manager) Freeze() error

func (*Manager) MemoryEventFD 

func (c *Manager) MemoryEventFD() (int, uint32, error)

MemoryEventFD returns inotify file descriptor and 'memory.events' inotify watch descriptor

func (*Manager) NewChild 

func (c *Manager) NewChild(name string, resources *Resources) (*Manager, error)

func (*Manager) Procs 

func (c *Manager) Procs(recursive bool) ([]uint64, error)

func (*Manager) RootControllers 

func (c *Manager) RootControllers() ([]string, error)

func (*Manager) Stat 

func (c *Manager) Stat() (*stats.Metrics, error)

func (*Manager) Thaw 

func (c *Manager) Thaw() error

func (*Manager) ToggleControllers 

func (c *Manager) ToggleControllers(controllers []string, t ControllerToggle) error

type Memory 

type Memory struct {
	Swap *int64
	Max  *int64
	Low  *int64
	High *int64
}

func (*Memory) Values 

func (r *Memory) Values() (o []Value)

type Pids 

type Pids struct {
	Max int64
}

func (*Pids) Values 

func (r *Pids) Values() (o []Value)

type RDMA 

type RDMA struct {
	Limit []RDMAEntry
}

func (*RDMA) Values 

func (r *RDMA) Values() (o []Value)

type RDMAEntry 

type RDMAEntry struct {
	Device     string
	HcaHandles uint32
	HcaObjects uint32
}

func (RDMAEntry) String 

func (r RDMAEntry) String() string

type Resources 

type Resources struct {
	CPU     *CPU
	Memory  *Memory
	Pids    *Pids
	IO      *IO
	RDMA    *RDMA
	HugeTlb *HugeTlb
	// When len(Devices) is zero, devices are not controlled
	Devices []specs.LinuxDeviceCgroup
}

Resources for a cgroups v2 unified hierarchy

func ToResources 

func ToResources(spec *specs.LinuxResources) *Resources

ToResources converts the oci LinuxResources struct into a v2 Resources type for use with this package.

converting cgroups configuration from v1 to v2 ref: https://github.com/containers/crun/blob/master/crun.1.md#cgroup-v2

func (*Resources) EnabledControllers 

func (r *Resources) EnabledControllers() (c []string)

EnabledControllers returns the list of all not nil resource controllers

func (*Resources) Values 

func (r *Resources) Values() (o []Value)

Values returns the raw filenames and values that can be written to the unified hierarchy

type State 

type State string

State is a type that represents the state of the current cgroup 

const (
	Unknown State = ""
	Thawed  State = "thawed"
	Frozen  State = "frozen"
	Deleted State = "deleted"
)

func (State) Values 

func (s State) Values() []Value

type Value 

type Value struct {
	// contains filtered or unexported fields
}

Value of a cgroup setting

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.