You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In cgroupv2 hierrachy, cgroup setup for nested containers (i.e. docker)
are incorrect without enabling cgroup namespace. This enables cgroup
namespace for all containers to fix the incorrect cgroup setup.
See linuxkit#3734
Signed-off-by: Daniel Dao <dqminh89@gmail.com>
Currently, container is run without cgroup namespace, which creates non-functioning setup with cgroupv2 when cgroupv2 restrictions are enforced.
For example, the cgroup tree for docker without cgroup namespace is:
As a result,
/sys/fs/cgroup/docker
becomesdomain threaded
cgroup, and cgroup manipulation withincontainerA
doesn't work properly.I think it should be safe to enable creation of cgroup namespace by default, or at least when we are running under cgroupv2.
The text was updated successfully, but these errors were encountered: