nspawn: move container into its own name=systemd cgroup

diff --git a/Makefile.am b/Makefile.am
index 97c8be35ee039f21f30a53e12538ae7074fb1209..6104c809d3e8e548609e7f458b59d412c4e22977 100644 (file)
--- a/Makefile.am
+++ b/Makefile.am
@@ -985,13 +985,15 @@ systemd_cgls_LDADD = \
        libsystemd-basic.la
 
 systemd_nspawn_SOURCES = \
        libsystemd-basic.la
 
 systemd_nspawn_SOURCES = \

-       src/nspawn.c
+       src/nspawn.c \
+       src/cgroup-util.c

 
 systemd_nspawn_CFLAGS = \
        $(AM_CFLAGS)
 
 systemd_nspawn_LDADD = \
 
 systemd_nspawn_CFLAGS = \
        $(AM_CFLAGS)
 
 systemd_nspawn_LDADD = \

-       libsystemd-basic.la
+       libsystemd-basic.la \
+       libsystemd-daemon.la

 
 systemd_stdio_bridge_SOURCES = \
        src/bridge.c
 
 systemd_stdio_bridge_SOURCES = \
        src/bridge.c

diff --git a/src/nspawn.c b/src/nspawn.c
index 451d539625eba6a170872122fb94580e1a11c90a..94e03b58dcce9ade1cbbd8e8e5a1fd2203ffca5c 100644 (file)
--- a/src/nspawn.c
+++ b/src/nspawn.c
@@ -37,6 +37,8 @@
 #include "log.h"
 #include "util.h"
 #include "missing.h"
 #include "log.h"
 #include "util.h"
 #include "missing.h"

+#include "cgroup-util.h"
+#include "sd-daemon.h"

 
 static char *arg_directory = NULL;
 
 
 static char *arg_directory = NULL;
 


@@ -347,7 +349,8 @@ static int is_os_tree(const char *path) {
 
 int main(int argc, char *argv[]) {
         pid_t pid = 0;
 
 int main(int argc, char *argv[]) {
         pid_t pid = 0;

-        int r = EXIT_FAILURE;
+        int r = EXIT_FAILURE, k;
+        char *oldcg = NULL, *newcg = NULL;

 
         log_parse_environment();
         log_open();
 
         log_parse_environment();
         log_open();


@@ -376,6 +379,11 @@ int main(int argc, char *argv[]) {
                 goto finish;
         }
 
                 goto finish;
         }
 

+        if (sd_booted() <= 0) {
+                log_error("Not running on a systemd system.");
+                goto finish;
+        }
+

         if (path_equal(arg_directory, "/")) {
                 log_error("Spawning container on root directory not supported.");
                 goto finish;
         if (path_equal(arg_directory, "/")) {
                 log_error("Spawning container on root directory not supported.");
                 goto finish;


@@ -388,6 +396,21 @@ int main(int argc, char *argv[]) {
 
         log_info("Spawning namespace container on %s.", arg_directory);
 
 
         log_info("Spawning namespace container on %s.", arg_directory);
 

+        if ((k = cg_get_by_pid(SYSTEMD_CGROUP_CONTROLLER, 0, &oldcg)) < 0) {
+                log_error("Failed to determine current cgroup: %s", strerror(-k));
+                goto finish;
+        }
+
+        if (asprintf(&newcg, "%s/nspawn-%lu", oldcg, (unsigned long) getpid()) < 0) {
+                log_error("Failed to allocate cgroup path.");
+                goto finish;
+        }
+
+        if ((k = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, newcg, 0)) < 0)  {
+                log_error("Failed to create cgroup: %s", strerror(-k));
+                goto finish;
+        }
+

         if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS, NULL)) < 0) {
                 log_error("clone() failed: %m");
                 goto finish;
         if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS, NULL)) < 0) {
                 log_error("clone() failed: %m");
                 goto finish;


@@ -453,10 +476,15 @@ int main(int argc, char *argv[]) {
                 r = EXIT_FAILURE;
 
 finish:
                 r = EXIT_FAILURE;
 
 finish:

-        free(arg_directory);
+        if (oldcg)
+                cg_attach(SYSTEMD_CGROUP_CONTROLLER, oldcg, 0);
+
+        if (newcg)
+                cg_kill_recursive_and_wait(SYSTEMD_CGROUP_CONTROLLER, newcg, true);

 
 

-        if (pid > 0)
-                kill(pid, SIGTERM);
+        free(arg_directory);
+        free(oldcg);
+        free(newcg);

 
         return r;
 }
 
         return r;
 }