mirror of
https://github.com/moby/moby.git
synced 2026-08-10 01:49:04 +00:00
3c8d133837
For rootless + host netns (detach-netns mode), the daemon replaces the /sys mounts, as sysfs cannot be mounted without owning the netns. This removed the /sys/fs/cgroup mount as well, so such containers could not see their own cgroup at all (e.g. /sys/fs/cgroup/pids.max was ENOENT even when a pids limit was set and enforced). Unlike sysfs, mounting cgroup2 does not require the netns to be owned by the userns, so the cgroup mount can be kept when running with cgroup v2. runc mounts it with the container's cgroup namespace view, so the container sees its own limits, e.g.: $ docker run --net=host --pids-limit 32 busybox cat /sys/fs/cgroup/pids.max 32 This fixes TestUpdatePidsLimit in the rootless-systemd CI mode, which was the last remaining failure there: it is the only test that reads back cgroup limits from inside a container with --net=host (used for speed), and it only runs when the daemon reports a cgroup driver other than "none" (i.e. rootless + systemd + delegation). The cgroup limits themselves were applied correctly all along (every container scope had the pids controller and the correct pids.max on the host side); only the container's view was missing. Fixes the remaining part of the issue 44084. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>