Set rlimit for execin process

integration/execin_test.go

@@ -27,28 +27,57 @@ func TestExecIn(t *testing.T) {
 		t.Fatalf("failed to write config %s", err)
 	}
 
-	// start the container
-	containerErr := make(chan error, 1)
-	containerCmd := &exec.Cmd{}
-	var statePath string
-	createCmd := func(container *libcontainer.Config, console, dataPath, init string,
-		pipe *os.File, args []string) *exec.Cmd {
-		containerCmd = namespaces.DefaultCreateCommand(container, console, dataPath, init, pipe, args)
-		statePath = dataPath
-		return containerCmd
+	containerCmd, statePath, containerErr := startLongRunningContainer(config)
+	defer func() {
+		// kill the container
+		if containerCmd.Process != nil {
+			containerCmd.Process.Kill()
+		}
+		if err := <-containerErr; err != nil {
+			t.Fatal(err)
+		}
+	}()
+
+	// start the exec process
+	state, err := libcontainer.GetState(statePath)
+	if err != nil {
+		t.Fatalf("failed to get state %s", err)
 	}
-	var containerStart sync.WaitGroup
-	containerStart.Add(1)
+	buffers := newStdBuffers()
+	execErr := make(chan error, 1)
 	go func() {
-		buffers := newStdBuffers()
-		_, err := namespaces.Exec(config,
-			buffers.Stdin, buffers.Stdout, buffers.Stderr,
-			"", config.RootFs, []string{"sleep", "10"},
-			createCmd, containerStart.Done)
-		containerErr <- err
+		_, err := namespaces.ExecIn(config, state, []string{"ps"},
+			os.Args[0], "exec", buffers.Stdin, buffers.Stdout, buffers.Stderr,
+			"", nil)
+		execErr <- err
 	}()
-	containerStart.Wait()
+	if err := <-execErr; err != nil {
+		t.Fatalf("exec finished with error %s", err)
+	}
 
+	out := buffers.Stdout.String()
+	if !strings.Contains(out, "sleep 10") || !strings.Contains(out, "ps") {
+		t.Fatalf("unexpected running process, output %q", out)
+	}
+}
+
+func TestExecInRlimit(t *testing.T) {
+	if testing.Short() {
+		return
+	}
+
+	rootfs, err := newRootFs()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer remove(rootfs)
+
+	config := newTemplateConfig(rootfs)
+	if err := writeConfig(config); err != nil {
+		t.Fatalf("failed to write config %s", err)
+	}
+
+	containerCmd, statePath, containerErr := startLongRunningContainer(config)
 	defer func() {
 		// kill the container
 		if containerCmd.Process != nil {
@@ -67,7 +96,7 @@ func TestExecIn(t *testing.T) {
 	buffers := newStdBuffers()
 	execErr := make(chan error, 1)
 	go func() {
-		_, err := namespaces.ExecIn(config, state, []string{"ps"},
+		_, err := namespaces.ExecIn(config, state, []string{"/bin/sh", "-c", "ulimit -n"},
 			os.Args[0], "exec", buffers.Stdin, buffers.Stdout, buffers.Stderr,
 			"", nil)
 		execErr <- err
@@ -77,7 +106,35 @@ func TestExecIn(t *testing.T) {
 	}
 
 	out := buffers.Stdout.String()
-	if !strings.Contains(out, "sleep 10") || !strings.Contains(out, "ps") {
-		t.Fatalf("unexpected running process, output %q", out)
+	if limit := strings.TrimSpace(out); limit != "1024" {
+		t.Fatalf("expected rlimit to be 1024, got %s", limit)
+	}
+}
+
+// start a long-running container so we have time to inspect execin processes
+func startLongRunningContainer(config *libcontainer.Config) (*exec.Cmd, string, chan error) {
+	containerErr := make(chan error, 1)
+	containerCmd := &exec.Cmd{}
+	var statePath string
+
+	createCmd := func(container *libcontainer.Config, console, dataPath, init string,
+		pipe *os.File, args []string) *exec.Cmd {
+		containerCmd = namespaces.DefaultCreateCommand(container, console, dataPath, init, pipe, args)
+		statePath = dataPath
+		return containerCmd
 	}
+
+	var containerStart sync.WaitGroup
+	containerStart.Add(1)
+	go func() {
+		buffers := newStdBuffers()
+		_, err := namespaces.Exec(config,
+			buffers.Stdin, buffers.Stdout, buffers.Stderr,
+			"", config.RootFs, []string{"sleep", "10"},
+			createCmd, containerStart.Done)
+		containerErr <- err
+	}()
+	containerStart.Wait()
+
+	return containerCmd, statePath, containerErr
 }

namespaces/execin.go

@@ -97,6 +97,10 @@ func FinalizeSetns(container *libcontainer.Config, args []string) error {
 		return err
 	}
 
+	if err := setupRlimits(container); err != nil {
+		return fmt.Errorf("setup rlimits %s", err)
+	}
+
 	if err := FinalizeNamespace(container); err != nil {
 		return err
 	}