Jira (PUP-6805) Services started during package resource application persist in agent's cgroup

[Adam Bottchen (JIRA)]

Title: Message Title

Adam Bottchen created an issue   Puppet / PUP-6805 Services started during package resource application persist in agent's cgroup Issue Type: Improvement Affects Versions: PUP 4.5.3 Assignee: Unassigned Created: 2016/10/10 1:41 PM Priority: Normal Reporter: Adam Bottchen When the Puppet agent service applies a catalog with a package resource that includes a post-install script, that script is executed in the Puppet agent's cgroup. Even if the Puppet agent is stopped, these processes continue to reside in that cgroup. Those processes should be locked to a per-run cgroup instead, to prevent resource contention and leaky data. Re-create steps: Simple manifest to install the package and start the service: package { '/tmp/gatekeeper-1.1.0-1.x86_64.rpm': ensure => present, } Start the Puppet agent to trigger a run that installs the package on the CentOS 7 system, and note that the service is running in the Puppet agent's cgroup rather than its own: # systemctl start puppet # grep puppet-agent /var/log/messages |tail -n 2 Oct 10 13:31:20 ivh1djpixluvddk puppet-agent[20242]: (/Stage[main]/Main/Node[__node_regexp__ivh1djpixluvddk]/Package[/tmp/gatekeeper-1.1.0-1.x86_64.rpm]/ensure) created Oct 10 13:31:21 ivh1djpixluvddk puppet-agent[20242]: Applied catalog in 1.80 seconds # grep name /proc/$(cat /var/run/gatekeeper.pid)/cgroup 1:name=systemd:/system.slice/puppet.service Even if the Puppet agent is stopped, the process continues to run in its name space: # systemctl stop puppet # grep name /proc/$(cat /var/run/gatekeeper.pid)/cgroup 1:name=systemd:/system.slice/puppet.service Add Comment   This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.