-
Notifications
You must be signed in to change notification settings - Fork 18.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
container hostConfig not checked on container start #15159
Comments
@runcom I can't reproduce on the latest master branch, I tried ubuntu 14.04 using upstart and RHEL7 using systemd, what Docker version are you using? |
@hqhq master branch on Ubuntu 15.04 :( will try on Fedora 22 later today |
@runcom It's weird I can't reproduce it, but for libcontainer part you mentioned, the rule is:
So if memory cgroup was not mounted, and |
@hqhq indeed docker is fixed (I saw your patch) butsysinfo is not updated while daemon is running so if you unmount the cgroup while it's running you get that error if your container was started with cgroup's constraints and you try to start it I think the problem here lies also in having hostConfig in start :/ |
Working to fix this, I'll send the PR later today |
On container start, exactly in
daemon/start.go
, only thehostConfig
provided to the API is checked.If you've previously created a container with a specific hostConfig and then you make changes to the system something could be broken.
I've hit this when unmounting cgroups (memory in my case) but any other hostConfig's field could have this problem I think.
Step to reproduce on an Ubuntu 15.04:
This is happening because the hostConfig in the start API is only checked if it's the one provided in the request and not the actual container's hostConfig (see
verifyContainerSettings
)Beaware also that
verifyContainerSettings
will set for instanceMemorySwappiness
tonil
if it detects the system doesn't have memory cgroup enabled.Should we check hostConfig before starting container (and show a nicer error and put MemorySwappiness in hostConfig to nil) or this libcontainer error is ok to show if you umount cgroups while running? I have a fix to check container's hostConfig on start also
EDIT: Digging deeper, daemon.sysInfo is only populated on daemon start so even calling verifyContainerSettings in container start still shows the error above
ping @LK4D4 (I've seen libcontainer ignores cgroups path not found error in apply_systemd and try to write the file and erroring out above, wondering if that should be fixed as well)
The text was updated successfully, but these errors were encountered: