Add a switch to control writing to /proc/sys

[alexjh]

Not all environments allow writing to /proc/sys, allow these to be
controlled via config setting.

There is already a check for running_in_container() but this seems to be bosh-lite specific as it's looking for a specific entry in /proc/self/cgroup.

[cfdreddbot]

Hey alexjh!

Thanks for submitting this pull request!

All pull request authors must have a Contributor License Agreement (CLA) on-file with us. Please sign the appropriate CLA (individual or corporate).

When sending signed CLA please provide your github username in case of individual CLA or the list of github usernames that can make pull requests on behalf of your organization.

If you are confident that you're covered under a Corporate CLA, please make sure you've publicized your membership in the appropriate Github Org, per these instructions.

Once you've publicized your membership, one of the owners of this repository can close and reopen this pull request, and dreddbot will take another look.

[cfdreddbot]

Hey alexjh!

Thanks for submitting this pull request!

All pull request authors must have a Contributor License Agreement (CLA) on-file with us. Please sign the appropriate CLA (individual or corporate).

When sending signed CLA please provide your github username in case of individual CLA or the list of github usernames that can make pull requests on behalf of your organization.

If you are confident that you're covered under a Corporate CLA, please make sure you've publicized your membership in the appropriate Github Org, per these instructions.

Once you've publicized your membership, one of the owners of this repository can close and reopen this pull request, and dreddbot will take another look.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this. You can view the current status of your issue at: https://www.pivotaltracker.com/story/show/115904293.

[alexjh]

Ah, I didn't have my membership for the hpcloud org set to public. Just updated it now.

[alexjh]

Ok dreddbot, trying again.

[cfdreddbot]

Hey alexjh!

Thanks for submitting this pull request! I'm here to inform the recipients of the pull request that you've already signed the CLA.

[cfdreddbot]

Hey alexjh!

Thanks for submitting this pull request! I'm here to inform the recipients of the pull request that you've already signed the CLA.

[emalm]

Thanks, @alexjh! Could you elaborate on which BOSH-deployed environments don't allow writing to /proc/sys, other than BOSH-Lite? Is there some way the ctl scripts could determine that programmatically, as they do for BOSH-Lite? I'd like to avoid adding more configuration values to the manifest if possible.

Also, the 'tweak' in the property name sounds too informal. Would you mind changing the property names to 'adjust_proc_sys' or something similar?

Thanks,
Eric, CF Runtime Diego PM

[alexjh]

Hi @ematpl! Renaming is no problem, I've changed the property names to adjust_proc_sys.

Re the environment, we're running the diego-release components in a docker container, so our /proc/self/cgroups looks something like this:

12:name=systemd:/
11:hugetlb:/docker/62387e51cf21af0f62202ffcb0753e6eb89e4ac021c37c1de95f3b9fc16cc353
10:net_prio:/docker/62387e51cf21af0f62202ffcb0753e6eb89e4ac021c37c1de95f3b9fc16cc353
9:perf_event:/docker/62387e51cf21af0f62202ffcb0753e6eb89e4ac021c37c1de95f3b9fc16cc353
8:blkio:/docker/62387e51cf21af0f62202ffcb0753e6eb89e4ac021c37c1de95f3b9fc16cc353
7:net_cls:/docker/62387e51cf21af0f62202ffcb0753e6eb89e4ac021c37c1de95f3b9fc16cc353
6:freezer:/docker/62387e51cf21af0f62202ffcb0753e6eb89e4ac021c37c1de95f3b9fc16cc353
5:devices:/docker/62387e51cf21af0f62202ffcb0753e6eb89e4ac021c37c1de95f3b9fc16cc353
4:memory:/docker/62387e51cf21af0f62202ffcb0753e6eb89e4ac021c37c1de95f3b9fc16cc353
3:cpuacct:/docker/62387e51cf21af0f62202ffcb0753e6eb89e4ac021c37c1de95f3b9fc16cc353
2:cpu:/docker/62387e51cf21af0f62202ffcb0753e6eb89e4ac021c37c1de95f3b9fc16cc353
1:cpuset:/docker/62387e51cf21af0f62202ffcb0753e6eb89e4ac021c37c1de95f3b9fc16cc353

There are some recommended ways of checking if you're in a docker container but I didn't want our implementation leaking into the diego-release scripts. But if you think that would be better than adding properties, I can make a change to running_in_container() to handle our case as well.

[emalm]

Thanks for the extra context, @alexjh. Do you think it would be reasonable to change the running_in_container function to check whether the process is in any non-root cgroups at all? For example, when I check proc/self/cgroup on a CF or Diego VM on AWS, all the cgroups are / or unset, while in a BOSH-Lite-deployed garden-linux container some of them are /instance-<warden-handle>, and in a docker container they are all /docker/<container-id>. That check would seem to cover both the BOSH-Lite and Docker cases.

[alexjh]

@ematpl That makes sense. I've pushed the change to handle both cases, no new configuration properties are needed.

[emalm]

Thanks, @alexjh! I'll prioritize the story for the Diego team to evaluate this and pull it in.

Best,
Eric