Fix/cgroup2 bind mount shared cgroupns#5267
Open
xujihui1985 wants to merge 2 commits into
Open
Conversation
xujihui1985
force-pushed
the
fix/cgroup2-bind-mount-shared-cgroupns
branch
3 times, most recently
from
9a08cc5 to
922bd42
Compare
Contributor
Author
lifubang
force-pushed
the
fix/cgroup2-bind-mount-shared-cgroupns
branch
from
5c685ee to
0b7a122
Compare
kolyshkin
reviewed
May 18, 2026
xujihui1985
force-pushed
the
fix/cgroup2-bind-mount-shared-cgroupns
branch
2 times, most recently
from
0b7a122 to
9653c5c
Compare
xujihui1985
force-pushed
the
fix/cgroup2-bind-mount-shared-cgroupns
branch
2 times, most recently
from
1360929 to
491bf97
Compare
Contributor
Author
|
Hi @kolyshkin would you like to move forward with this PR? |
xujihui1985
force-pushed
the
fix/cgroup2-bind-mount-shared-cgroupns
branch
from
491bf97 to
c8ed922
Compare
lifubang
requested changes
Jun 9, 2026
kolyshkin
reviewed
Jun 9, 2026
kolyshkin
left a comment
kolyshkin
left a comment
Contributor
There was a problem hiding this comment.
Forgot to submit pending review comments, my bad.
Overall it's almost ready.
xujihui1985
force-pushed
the
fix/cgroup2-bind-mount-shared-cgroupns
branch
4 times, most recently
from
3786615 to
3d9d5a7
Compare
Contributor
Author
|
@lifubang @kolyshkin I have moved the checkpoint-related commit into a new PR: #5318, and fixed the other review suggestions. |
xujihui1985
force-pushed
the
fix/cgroup2-bind-mount-shared-cgroupns
branch
from
3d9d5a7 to
0a1029c
Compare
kolyshkin
reviewed
Jun 24, 2026
kolyshkin
reviewed
Jun 24, 2026
xujihui1985
force-pushed
the
fix/cgroup2-bind-mount-shared-cgroupns
branch
2 times, most recently
from
b76157e to
6c3174f
Compare
When cgroup namespaces is host, mounting a new cgroup2 fs instance for /sys/fs/cgroup can affect the host-visible cgroupfs mount state, including options such as nsdelegate. Avoid that by preferring a bind mount of the existing cgroup v2 hierarchy when cgroupns is host. Keep the existing cgroup2 mount-first logic for private cgroup namespaces, including the EPERM/EBUSY fallback to a bind mount and the rootless ENOENT masking behavior. Signed-off-by: sean <xujihui1985@gmail.com>
xujihui1985
force-pushed
the
fix/cgroup2-bind-mount-shared-cgroupns
branch
from
6c3174f to
4e14d47
Compare
lifubang
requested changes
Jul 3, 2026
in host cgroupns, mount cgroupfs should not mutate the global superblock mount options, the test is to check when create container with host cgroupns, it should not mutate the global superblock options of host cgroupfs Signed-off-by: sean <xujihui1985@gmail.com>
xujihui1985
force-pushed
the
fix/cgroup2-bind-mount-shared-cgroupns
branch
from
4e14d47 to
e8edba3
Compare
Contributor
Author
|
@lifubang @kolyshkin I think I have fixed all the issue listed above, anything I can improve here? |
kolyshkin
reviewed
Jul 10, 2026
kolyshkin
left a comment
kolyshkin
left a comment
Contributor
There was a problem hiding this comment.
This is a bit out of scope for this PR, but I think we should test that the host mounts are not changed after tests (or after each test) as, in general, runc should not change host side mounts (with some exceptions).
Contributor
Author
@kolyshkin yes, the second commit is suppose to do this check e8edba3 so do you think we should run this check for each test? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When cgroup namespaces is host, mounting a new cgroup2 fs instance for /sys/fs/cgroup can affect the host-visible cgroupfs mount state, including options such as nsdelegate.
Avoid that by preferring a bind mount of the existing cgroup v2 hierarchy when cgroupns is host. Keep the existing cgroup2 mount-first logic for private cgroup namespaces, including the EPERM/EBUSY fallback to a bind mount and the rootless ENOENT masking behavior.
this PR fix issue #5258