runtime-spec: update pids.limit handling to match new guidance #4949
+231
−48
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cyphar
force-pushed
the
pids-limit-0
branch
2 times, most recently
from
0cad003 to
53c6f1b
Compare
|
Given how close we are to 1.4.0, we should punt this for 1.4.1. |
cyphar
force-pushed
the
pids-limit-0
branch
5 times, most recently
from
ae5145b to
9cbc6a3
Compare
cyphar
force-pushed
the
pids-limit-0
branch
3 times, most recently
from
cefb4e7 to
cb93018
Compare
The main update is actually in github.com/opencontainers/cgroups, but we need to also update runtime-spec to a newer pre-release version to get the updates from there as well. In short, the behaviour change is now that "0" is treated as a valid value to set in "pids.max", "-1" means "max" and unset/nil means "do nothing". As described in the opencontainers/cgroups PR, this change is actually backwards compatible because our internal state.json stores PidsLimit, and that entry is marked as "omitempty". So, an old runc would omit PidsLimit=0 in state.json, and this will be parsed by a new runc as being "nil" -- and both would treat this case as "do not set anything". Signed-off-by: Aleksa Sarai <[email protected]>
Signed-off-by: Aleksa Sarai <[email protected]>
Signed-off-by: Aleksa Sarai <[email protected]>
AkihiroSuda
reviewed
Nov 4, 2025
| github.com/opencontainers/cgroups v0.0.5 | ||
| github.com/opencontainers/runtime-spec v1.2.2-0.20250818071321-383cadbf08c0 | ||
| github.com/opencontainers/cgroups v0.0.6 | ||
| github.com/opencontainers/runtime-spec v1.2.2-0.20251022072015-5caf3047c341 |
There was a problem hiding this comment.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Draft until opencontainers/cgroups#48 is merged.The main update is actually in github.com/opencontainers/cgroups, but we
need to also update runtime-spec to a newer pre-release version to get
the updates from there as well.
In short, the behaviour change is now that "0" is treated as a valid
value to set in "pids.max", "-1" means "max" and unset/nil means "do
nothing". As described in the opencontainers/cgroups PR, this change is
actually backwards compatible because our internal state.json stores
PidsLimit, and that entry is marked as "omitempty". So, an old runc
would omit PidsLimit=0 in state.json, and this will be parsed by a new
runc as being "nil" -- and both would treat this case as "do not set
anything".
Fixes #4014
Closes #4015
Closes #4023
Signed-off-by: Aleksa Sarai [email protected]