Merge pull request #5423 from indrajitr/container-cgroupns

T9240: container: Allow sharing host's cgroup namespace with container

Author: jestabro

interface-definitions/container.xml.in

@@ -27,6 +27,12 @@
               <valueless/>
             </properties>
           </leafNode>
+          <leafNode name="allow-host-cgroups">
+            <properties>
+              <help>Allow sharing host cgroup namespace with container</help>
+              <valueless/>
+            </properties>
+          </leafNode>
           <leafNode name="capability">
             <properties>
               <help>Grant individual Linux capability to container instance</help>

smoketest/scripts/cli/test_container.py

@@ -87,6 +87,7 @@ def test_basic(self):
         self.cli_set(base_path + ['name', cont_name, 'sysctl', 'parameter',
                                   'kernel.msgmax', 'value', '4096'])
         self.cli_set(base_path + ['name', cont_name, 'log-driver', 'journald'])
+        self.cli_set(base_path + ['name', cont_name, 'allow-host-cgroups'])
         # commit changes
         self.cli_commit()
 
@@ -104,6 +105,7 @@ def test_basic(self):
         l = cmd_to_json(['container', 'inspect', cont_name])
         self.assertEqual(l['HostConfig']['LogConfig']['Type'], 'journald')
         self.assertEqual(l['Config']['Healthcheck']['Test'], ['NONE'])
+        self.assertEqual(l['HostConfig']['CgroupMode'], 'host')
 
     def test_healthcheck(self):
         cont_name = 'health-test'

src/conf_mode/container.py

@@ -475,6 +475,10 @@ def generate_run_arguments(name, container_config, host_ident, network_config):
     if 'allow_host_pid' in container_config:
       host_pid = '--pid host'
 
+    cgroupns = ''
+    if 'allow_host_cgroups' in container_config:
+      cgroupns = '--cgroupns host'
+
     name_server = []
     if 'name_server' in container_config:
         for ns in container_config['name_server']:
@@ -486,7 +490,7 @@ def generate_run_arguments(name, container_config, host_ident, network_config):
 
     container_base_cmd = f'--detach --interactive --tty --replace {capabilities} {privileged} --cpus {cpu_quota} {sysctl_opt} ' \
                          f'--memory {memory}m --shm-size {shared_memory}m --memory-swap 0 --restart {restart} --log-driver={log_driver} ' \
-                         f'--name {name} {hostname} {device} {port} {name_server} {volume} {tmpfs} {env_opt} {label} {uid} {host_pid}'
+                         f'--name {name} {hostname} {device} {port} {name_server} {volume} {tmpfs} {env_opt} {label} {uid} {host_pid} {cgroupns}'
 
     entrypoint = ''
     if 'entrypoint' in container_config: