Wrap Linux 4.3 pids cgroup

[stefanberger]

With Linux 4.3 the new 'pids' cgroup becomes available. It allows to set
fork limits on a group of processes. Once a process's PID has been added to
the cgroup, all its children will automatically be added to this cgroup.

The new cgroup has the following files:

cgroups.proc: To set the processes on which to impose a fork limit;
The entry also shows the processes that are under the fork limit

pids.max: The maximum number of processes that can be spawned;
The file may either container the string 'max' or an unsigned
integer value

pids.current: The number of processes in this cgroup

Signed-off-by: Stefan Berger [email protected]

[mrunalp]

This is duplicate of #58. @cyphar ping.

[stefanberger]

@mrunalp Two different people, two different implementations. :-)

[cyphar]

We're still figuring out the semantics of setting a value to be the system default in opencontainers/runtime-spec#233.

[stefanberger]

@cyphar Null pointers sound right for 'do not touch this - use system default'... otherwise when a value is set all acceptable values should be reachable with the datatype being used.

In 'our' case here I wondered how to express 'max'. It seems like one doesn't loose much if one can express a large number of processes 2^31-1 (or 2^63 -1; 2^22 being the max on Linux) and use -1 to express 'max'.

[cyphar]

@stefanberger Since #58 has integration tests, I'd prefer if we continued discussions over there. There's not much of a difference between our implementations (apart from the integration tests I've written). I also don't understand why you provide the PIDs in the cgroup as a statistic (nor why you have the unused code for setting specific processes to be in the container -- which is overreaching what the purpose of libcontainer/cgroup/fs/* is).

[cyphar]

Actually, you appear to have misunderstood what pids.current contains so the statistics code won't work. It contains a single number: the number of processes inside that cgroup (or inside the cgroup's descendants).

[stefanberger]

pids.current may in this case be a typo. I meant to read the pids from cgroup.procs. The len of that should return the same number as pids.current would. Anyway, I'll close this PR .