Commits on Jul 2, 2020

1. libct/cgroups: add SkipDevices to Resources …

   The kubelet uses libct/cgroups code to set up cgroups. It creates a
   parent cgroup (kubepods) to put the containers into.
   
   The problem (for cgroupv2 that uses eBPF for device configuration) is
   the hard requirement to have devices cgroup configured results in
   leaking an eBPF program upon every kubelet restart.  program. If kubelet
   is restarted 64+ times, the cgroup can't be configured anymore.
   
   Work around this by adding a SkipDevices flag to Resources.
   
   A check was added so that if SkipDevices is set, such a "container"
   can't be started (to make sure it is only used for non-containers).
   
   Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

   

   kolyshkin committed Jul 2, 2020
   Configuration menu

   • View commit details
   • Copy full SHA for 108ee85
   • Browse repository at this point

   Copy the full SHA

   108ee85 View commit details

   Browse the repository at this point in the history