Add cgroups v2 support for Jammy stemcells #468
Conversation
This enables warden stemcells to function on hosts that are using cgroups v2, which is increasingly common. This should not have any effects on other infrastructures as the stemcell kernel will continue to be booted with cgroups v1.
cf-foundation-community-automation
bot
moved this to Inbox
in Foundational Infrastructure Working Group
github-project-automation
bot
moved this from Inbox
to Pending Merge | Prioritized
in Foundational Infrastructure Working Group
|
I think this looks good to me. The main change is to use a cgroup v2 path instead of a v1 path when necessary? |
aramprice
left a comment
aramprice
left a comment
There was a problem hiding this comment.
This change seems reasonable for contexts where a Jammy stemcell image is be running in a containerized context.
|
Something similar would be needed here: https://github.com/cloudfoundry/bosh-linux-stemcell-builder/blob/ubuntu-noble/stemcell_builder/stages/bosh_monit/assets/monit-nftables.nft#L9 So the question on my mind is why is this needed on a noble host, and why only when using the warden cpi. Because noble host with docker cpi is fine, with both noble and jammy stemcells. In other words shouldn't this be fixed on the garden noble compatibility side? |
|
There is some concern about merging this since it doesn't appear that there are tests which validate the monit protection code. We should either add, or document that there are tests which exercise the "happy path" protection of monit before changing this. No need to add tests for the containerized scenario so long as there is coverage for the "production " (aka VM deployment) case. |
|
As @rkoster mentioned the nftables cgroup path blocks monit access for cgroups v2. But I am not sure this config can figure out current cgroup - https://github.com/cloudfoundry/bosh-linux-stemcell-builder/blob/ubuntu-noble/stemcell_builder/stages/bosh_monit/assets/monit-nftables.nft#L9 |
When stemcells run as privileged containers (e.g., Docker CPI on Apple Silicon), systemd-binfmt clears the host's binfmt_misc registrations, including Rosetta, causing "exec format error" for x86_64 processes. Add a drop-in override with ConditionVirtualization=!container to skip the service in containers while preserving normal behavior on VMs. Signed-off-by: Matthew Kocher <matthew.kocher@broadcom.com>
rkoster
left a comment
rkoster
left a comment
There was a problem hiding this comment.
Nice find!! But how is it jammy specific or related to cgroups v2
github-project-automation
bot
moved this from Pending Merge | Prioritized
to Waiting for Changes | Open for Contribution
in Foundational Infrastructure Working Group
6 participants
This enables warden stemcells to function on hosts that are using cgroups v2, which is increasingly common. This should not have any effects on other infrastructures as the stemcell kernel will continue to be booted with cgroups v1.