Support `LinuxDeviceCgroup` updates

Open
#3,401 5 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
30/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Tech stack
docker, go, linux
Domain
cli, operating-systems

Research direction

Start with update.go around the existing config.Cgroups.SkipDevices handling and trace config.Cgroups.Resources.Devices. Compare that path with CreateCgroupConfig and the device-update discussion in #2366 and PR #2951. Done means the update command has explicitly defined semantics for replacing or applying device rules and supports the required cgroup(v2) permission changes.

Written by the indexing model from the issue text.

Description

To be able to adjust device permissions at runtime, this issue seeks to implement support for Linux Device CGroup updates. It is a prerequisite to get such support in Moby/Docker, see also moby/moby#42255.

Currently supplying devices to runc update --resources - does not adjust cgroup(v2) device permissions for an existing container. Some issues with device updates have been outlined in #2366 and addressed in various PRs linked to that issue.

To implement support updates would need to pass devices to the internal config.Cgroups.Resources.Devices structure. Besides update also sets config.Cgroups.SkipDevices to false explicitly, which probably would need changing.

I guess the semantics of update would need to be defined exactly. A simplistic approach would be to implement a behavior similar to what CreateCgroupConfig implements: Clear the current list of devices, append the list provided by the update command, then append the defaultDevs.

In PR #2951 @cyphar added a comment saying:

	# Unfortunately we can't update device rules directly with runc ("runc
	# update" doesn't support it, and adding support would require ironing out
	# some long-standing design issues with device configuration). So instead
	# we just run "runc update" many times, relying on the fact that runc will
	# re-apply devices cgroup rules on each runc update.

What are those design issues exactly?

Dominant language
Go
Stars
13.5k
Forks
2.3k
Avg merge
2d 8h
Merged PRs (30d)
30

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from opencontainers/runc

All issues in opencontainers/runc

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.