From c96364913ef6fed024604ff6ec1b0aa445dec53e Mon Sep 17 00:00:00 2001
From: Tonis Tiigi <tonistiigi@gmail.com>
Date: Fri, 7 Jul 2023 15:15:21 -0700
Subject: [PATCH] oci: make sure cgroupns is enabled if supported

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
---
 executor/oci/spec.go         |  6 ++++++
 executor/oci/spec_unix.go    | 16 ++++++++++++++++
 executor/oci/spec_windows.go |  4 ++++
 3 files changed, 26 insertions(+)

diff --git a/executor/oci/spec.go b/executor/oci/spec.go
index 054c28dd4..c6d665b08 100644
--- a/executor/oci/spec.go
+++ b/executor/oci/spec.go
@@ -137,6 +137,12 @@ func GenerateSpec(ctx context.Context, meta executor.Meta, mounts []executor.Mou
 		return nil, nil, err
 	}
 
+	if cgroupNamespaceSupported() {
+		s.Linux.Namespaces = append(s.Linux.Namespaces, specs.LinuxNamespace{
+			Type: specs.CgroupNamespace,
+		})
+	}
+
 	if len(meta.Ulimit) == 0 {
 		// reset open files limit
 		s.Process.Rlimits = nil
diff --git a/executor/oci/spec_unix.go b/executor/oci/spec_unix.go
index 3c809e7ff..97e95e983 100644
--- a/executor/oci/spec_unix.go
+++ b/executor/oci/spec_unix.go
@@ -6,7 +6,9 @@ package oci
 import (
 	"context"
 	"fmt"
+	"os"
 	"strings"
+	"sync"
 
 	"github.com/containerd/containerd/containers"
 	"github.com/containerd/containerd/oci"
@@ -21,6 +23,11 @@ import (
 	"github.com/pkg/errors"
 )
 
+var (
+	cgroupNSOnce     sync.Once
+	supportsCgroupNS bool
+)
+
 const (
 	tracingSocketPath = "/dev/otel-grpc.sock"
 )
@@ -139,3 +146,12 @@ func getTracingSocketMount(socket string) specs.Mount {
 func getTracingSocket() string {
 	return fmt.Sprintf("unix://%s", tracingSocketPath)
 }
+
+func cgroupNamespaceSupported() bool {
+	cgroupNSOnce.Do(func() {
+		if _, err := os.Stat("/proc/self/ns/cgroup"); !os.IsNotExist(err) {
+			supportsCgroupNS = true
+		}
+	})
+	return supportsCgroupNS
+}
diff --git a/executor/oci/spec_windows.go b/executor/oci/spec_windows.go
index faa9baafa..83ee27818 100644
--- a/executor/oci/spec_windows.go
+++ b/executor/oci/spec_windows.go
@@ -63,3 +63,7 @@ func getTracingSocketMount(socket string) specs.Mount {
 func getTracingSocket() string {
 	return fmt.Sprintf("npipe://%s", filepath.ToSlash(tracingSocketPath))
 }
+
+func cgroupNamespaceSupported() bool {
+	return false
+}