On Tue, 11 Nov 2025 09:57:39 GMT, Severin Gehwolf <[email protected]> wrote:
>> Please review this change to the Linux container detection code updating the
>> mapping function of cg v2 to most recent runtimes' implementation. OCI has
>> been standardized with cgroup v1 in mind and there is a mapping function in
>> place - implemented by container runtimes such as `runc` or `crun` - which
>> map the passed `--cpu-shares` value on the engine's `run` command to the
>> internal cgroup v2 `cpu.weight` interface file's values.
>>
>> For runtimes lower than 1.23 (crun) and 1.3.2 (runc) the mapping function
>> was (where `f(x)=<cpu.weight value>` and `x=<cpu-shares CLI value>`):
>>
>>
>> f(x) = {(x - 2) \times 9999 + 1 \over 262142}
>>
>>
>> This changed in `crun` >= 1.23 and `runc` >= 1.3.2 to:
>>
>>
>> f(x)=10^{({{\log_{2}(x)}^2 \over 612} + {125 \over 612} \times \log_{2}(x) -
>> {7 \over 34})}
>>
>>
>> Therefore, we need to find the inverse of the new quadratic mapping function
>> and use that over the inverse of the old mapping function. Since the input
>> domain is `[2,262144]` for `--cpu-shares` mapping to `[1,10000]` for
>> `cpu.weight` we can discount the negative exponent value as a possible
>> solution.
>>
>> Since there are production systems out there with those runtimes already I
>> believe it's time to change the mapping function internal to the JDK to the
>> new one in JDK 26. There is a chance that JDK 26 would run on old runtimes
>> in a container using cgroup v2, resulting in wrong diagnostics. The chance
>> of this happening will decrease over time.
>>
>> Thoughts?
>>
>> **Testing:**
>> - [x] GHA
>> - [x] `test/hotspot/jtreg/containers` and `test/jdk/jdk/internal/platform`
>> on cgroup v1 (with an old runtime - code not affected) and on cgroup v2 with
>> a new runtime. All tests passed.
>
> Severin Gehwolf has updated the pull request with a new target base due to a
> merge or a rebase. The incremental webrev excludes the unrelated changes
> brought in by the merge/rebase. The pull request contains seven additional
> commits since the last revision:
>
> - Merge branch 'master' into jdk-8370492-fix-cpushares-mapping
> - Remove SkippedException import
> - Merge branch 'master' into jdk-8370492-fix-cpushares-mapping
> - Fix include
> - Add asserts/checks for input domain
> - Add regression test for jdk-8370492
> - 8370492: [Linux] Update cpu shares to cpu.weight mapping function
Looks good! We are also starting to see tests failing. Some of the new tests
fail on rootless cgroup v1 configurations, see comment.
test/hotspot/jtreg/containers/docker/TestMisc.java line 107:
> 105: // Don't use 1024 exactly so as to avoid mapping to the
> unlimited/uset case.
> 106: // Use a value > 100 post-mapping so as to hit the non-default
> branch: 1052 => 103
> 107: printContainerInfo(1052, 1024, true);
These tests fail in rootless Podman containers using cgroup v1, because that
configuration does not support resource limits. We get the following error to
stderr:
`Resource limits are not supported and ignored on cgroups V1 rootless systems`
and the cpu shares value is reset to 1024. `cpu_shares: no shares` is then in
the output, leading to the first test failing. Then, `1024 != 1052` which leads
to the second test failing.
-------------
PR Review: https://git.openjdk.org/jdk/pull/28157#pullrequestreview-3454095579
PR Review Comment: https://git.openjdk.org/jdk/pull/28157#discussion_r2518801888
