This setting can be used to mimic cgroup v1 behavior on cgroup v2,
when setting the new memory limit during update operation.

In cgroup v1, a limit which is lower than the current usage is rejected.

In cgroup v2, such a low limit is causing an OOM kill.

Ref: opencontainers/runc#3509

Signed-off-by: Kir Kolyshkin <[email protected]>

Signed-off-by: Akihiro Suda <[email protected]>

CODEOWNERS: sync with MAINTAINERS

Burstable CFS controller is introduced in Linux 5.14. This helps with
parallel workloads that might be bursty. They can get throttled even
when their average utilization is under quota. And they may be latency
sensitive at the same time so that throttling them is undesired.

This feature borrows time now against the future underrun, at the cost
of increased interference against the other system users, by introducing
`cfs_burst_us` into CFS bandwidth control to enact the cap on unused
bandwidth accumulation, which will then used additionally for burst.

The patch adds the support/control for CFS bandwidth burst.

Fixes #1119

Signed-off-by: Kailun Qin <[email protected]>

Linux 5.19 introduced a new seccomp flag:
SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV

It is useful for seccomp notify when handling notification from Golang
programs which are often preempted by the runtime with SIGURG.

Signed-off-by: Alban Crequy <[email protected]>

seccomp: Add flag SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV

config-linux: add memory.checkBeforeUpdate

runC originally implemented prestart hooks contrary to the spec. And it
still implements them the same way today, as it would break a lot of
projects which have come to rely on the existing behaviour. Any OCI
runtime implementations which want to be compatible with projects that
have come to rely on the existing runC behaviour must also implement
them contrary to the spec. Furthermore, the Lifecycle section of the
spec requires the existing runC behaviour for the prestart hook,
_directly contradicting the section of the spec which defines the
prestart hook in config.md!_ Given that existing implementations cannot
be changed, the spec contradicts existing implementations, and the spec
contradicts _itself_, amending the spec to align with the existing runC
behaviour is the only viable way to resolve the contradiction.

Signed-off-by: Cory Snider <[email protected]>

config-linux: add CFS bandwidth burst

Cory Snider (1):
  config: change prestart hook spec to match reality

LGTMs: AkihiroSuda guiseppe cyphar
Closes #1169

Through 5cfc4c3 (2023-01-24)

Signed-off-by: Akihiro Suda <[email protected]>

Signed-off-by: Akihiro Suda <[email protected]>