libct/cgroups: add SkipDevices to Resources

[kolyshkin]

The kubelet uses libct/cgroups code to set up cgroups. It creates a
parent cgroup (kubepods) to put the containers into.

The problem (for cgroupv2 that uses eBPF for device configuration) is
the hard requirement to have devices cgroup configured results in
leaking an eBPF program upon every kubelet restart. program. If kubelet
is restarted 64+ times, the cgroup can't be configured anymore.

Work around this by adding a SkipDevices flag to Resources.

A check was added so that if SkipDevices is set, such a "container"
can't be started (to make sure it is only used for non-containers).

Fixes #2474

[kolyshkin]

@cyphar PTAL

[cyphar]

Just a few minor things, but looks good otherwise.

[kolyshkin]

Updated to address @cyphar review comments.

[cyphar]

@kolyshkin

One question about the justification for this change:

The problem (for cgroupv2 that uses eBPF for device configuration) is
the hard requirement to have devices cgroup configured results in
leaking an eBPF program upon every kubelet restart. program. If kubelet
is restarted 64+ times, the cgroup can't be configured anymore.

That's a bug in runc (#2366 is tracking that), and is something we need to fix anyway (we should be either doing BPF_F_REPLACE or manually replacing the program inatomically, or even possibly reimplementing our eBPF rules to use eBPF maps that we can atomically replace).

Is that the only reason for this change (looking back at #2474, it looks like I didn't catch this when discussing the need for this)? I'd be happy to have it anyway (since the requirement for the devices cgroup doesn't make sense in certain circumstances), but I just want to make sure that we're aware that this doesn't fix the underlying issue (which will be at least somewhat more involved).

[cyphar]

Aside from my point about this patch not fixing the motivating cgroupv2 bug, LGTM.

[kolyshkin]

I do agree this looks like a workaround for #2366.

From the other side, it does not make sense to require devices to be configured in cgroups that are not used to run containers, but rather to hold other cgroups (not sure what's the term here, parent cgroups? meta cgroups?). That is also the reason why I am thinking about renaming SkipDevices to ParentCgroup or something like that (although currently it only does what SkipDevices says).