14ed8696c1
Due to the fact that the init is implemented in Go (which seemingly randomly spawns new processes and loves eating memory), most cgroup configurations are required to have an arbitrary minimum dictated by the init. This confuses users and makes configuration more annoying than it should. An example of this is pids.max, where Go spawns multiple processes that then cause init to violate the pids cgroup constraint before the container can even start. Solve this problem by setting the cgroup configurations as late as possible, to avoid hitting as many of the resources hogged by the Go init as possible. This has to be done before seccomp rules are applied, as the parent and child must synchronise in order for the parent to correctly set the configurations (and writes might be blocked by seccomp). Signed-off-by: Aleksa Sarai <asarai@suse.com> |
||
|---|---|---|
| .. | ||
| checkpoint_test.go | ||
| doc.go | ||
| exec_test.go | ||
| execin_test.go | ||
| init_test.go | ||
| seccomp_test.go | ||
| template_test.go | ||
| utils_test.go | ||