Regarding setting cgroup v2 rules without overriding previous ones

Hello,

I'm Itamar, a Kubevirt developer.

In Kubevirt we use runc to manage and control containers' cgroup definitions. One of our main uses is the devices subsystem. I'm currently working on supporting cgroups v2 but facing a problem that you may help me with.

The problem is that currently when setting a device rule through cgroups "Manager" interface, the behavior is that all previously defined rules are deleted. That makes things more difficult as usually when a rule is requested (e.g. allow to create certain device) we do not expect that every other definition will be discarded.

With v1 though this is easily solvable. We can read currently defined cgroup rules easily, override only old versions of currently requested rules, and append all others to the current request. With v2 life is more difficult as there is no straightforward way to get the currently defined rules.

Of course we can also solve this by "remembering" our previously requested rules, but I assume that many other runc users would need the ability to append a rule to currently defined rules. Since reading eBPF code and de-compiling it to device rules sounds like a very non-trivial task, maybe the best approach is to save previous requests at the Manager level for both v1 and v2. Behavior can be configurable through "configs.Cgroup".

Does this make sense?
What do you think?

Start with the Manager interface and the setting path linked at libcontainer/cgroups/cgroups.go#L38, then read the surrounding cgroups implementation and configs.Cgroup references. Determine how device rules are currently replaced for cgroup v1 and v2, and clarify the intended configurable append-versus-replace behavior before defining what completion means.