(mesos) branch master updated: [cgroups2] Enforce use of linux launcher with cg2 isolator.

[bmahler]

This is an automated email from the ASF dual-hosted git repository.

bmahler pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mesos.git


The following commit(s) were added to refs/heads/master by this push:
     new 7a5040fb7 [cgroups2] Enforce use of linux launcher with cg2 isolator.
7a5040fb7 is described below

commit 7a5040fb77ffdc2c3aadcc36f5337fd274519470
Author: Jason Zhou <jasonzhou...@gmail.com>
AuthorDate: Thu Aug 15 17:59:34 2024 -0400

    [cgroups2] Enforce use of linux launcher with cg2 isolator.
    
    Currently we are not checking that the cgroups isolator is being used
    with the linux launcher. We need to ensure that if the linux launcher
    is being used, the cgroups isolator is also being used so that the
    cgroups for the containers can be made inside the isolator's prepare().
    
    Review: https://reviews.apache.org/r/75171/
---
 src/slave/containerizer/mesos/containerizer.cpp | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/slave/containerizer/mesos/containerizer.cpp 
b/src/slave/containerizer/mesos/containerizer.cpp
index 48bc4bc8f..95dde4da4 100644
--- a/src/slave/containerizer/mesos/containerizer.cpp
+++ b/src/slave/containerizer/mesos/containerizer.cpp
@@ -567,12 +567,19 @@ Try<MesosContainerizer*> MesosContainerizer::create(
   bool cgroupsIsolatorCreated = false;
 
   // First, apply the built-in isolators, in dependency order.
-  foreach (const auto& creator, creators) {
-    if (!isolations->contains(creator.first)) {
+  foreach (const auto& creator, creators)  {
+    // When the linux launcher is used, we *must* create the cgroups isolator,
+    // even if no specific cgroups/... isolations are requested.
+    bool forceCreation = !cgroupsIsolatorCreated
+        && strings::startsWith(creator.first, "cgroups/")
+        && flags.launcher == "linux";
+
+    if (!forceCreation && !isolations->contains(creator.first)) {
       continue;
     }
 
     if (strings::startsWith(creator.first, "cgroups/")) {
+      CHECK(flags.launcher == "linux");
       if (cgroupsIsolatorCreated) {
         // Skip when `Cgroups(2)IsolatorProcess` have already been created.
         continue;