runtime-spec: update pids.limit handling to match new guidance #4949
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cyphar
force-pushed
the
pids-limit-0
branch
2 times, most recently
from
0cad003 to
53c6f1b
Compare
Member
Author
|
Given how close we are to 1.4.0, we should punt this for 1.4.1. |
cyphar
force-pushed
the
pids-limit-0
branch
5 times, most recently
from
ae5145b to
9cbc6a3
Compare
cyphar
force-pushed
the
pids-limit-0
branch
3 times, most recently
from
cefb4e7 to
cb93018
Compare
cyphar
force-pushed
the
pids-limit-0
branch
2 times, most recently
from
ecd4789 to
41690a4
Compare
AkihiroSuda
reviewed
Nov 4, 2025
AkihiroSuda
added
the
backport/1.4-todo
kolyshkin
reviewed
Nov 4, 2025
kolyshkin
reviewed
Nov 4, 2025
Contributor
|
Lint failure is probably golangci/golangci-lint#5979. Removed the cache and re-ran the job. Opened #4961 as a potential workaround (which may or may not work). |
cyphar
referenced
this pull request
in opencontainers/cgroups
Nov 5, 2025
Previously we would treat a value of "0" as meaning "no-op", which lead to quite a bit of confusion. The runtime-spec has been updated to make the "pids.limit" value a pointer, and explicitly state that: * Values >= 0 should be treated as normal values; and * < 0 (usually -1) indicates "max". In practice this means we should switch PidsLimit to an *int64. Luckily, this is actually backwards-compatible with our previous JSON -- an old value of "0" would be omitted from the output, which will now be parsed as "nil". The handling by our cgroup code would be identical but the latter now correctly reflects the guidance by the runtime-spec. Signed-off-by: Aleksa Sarai <[email protected]>
Member
|
Needs rebase |
Open
AkihiroSuda
reviewed
Nov 10, 2025
AkihiroSuda
reviewed
Nov 10, 2025
The main update is actually in github.com/opencontainers/cgroups, but we need to also update runtime-spec to a newer pre-release version to get the updates from there as well. In short, the behaviour change is now that "0" is treated as a valid value to set in "pids.max", "-1" means "max" and unset/nil means "do nothing". As described in the opencontainers/cgroups PR, this change is actually backwards compatible because our internal state.json stores PidsLimit, and that entry is marked as "omitempty". So, an old runc would omit PidsLimit=0 in state.json, and this will be parsed by a new runc as being "nil" -- and both would treat this case as "do not set anything". Signed-off-by: Aleksa Sarai <[email protected]>
Signed-off-by: Aleksa Sarai <[email protected]>
This is much easier to read and removes the need for explicit per-type helper functions. Signed-off-by: Aleksa Sarai <[email protected]>
AkihiroSuda
approved these changes
Nov 11, 2025
kolyshkin
added
backport/1.4-done
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Draft until opencontainers/cgroups#48 is merged.The main update is actually in github.com/opencontainers/cgroups, but we
need to also update runtime-spec to a newer pre-release version to get
the updates from there as well.
In short, the behaviour change is now that "0" is treated as a valid
value to set in "pids.max", "-1" means "max" and unset/nil means "do
nothing". As described in the opencontainers/cgroups PR, this change is
actually backwards compatible because our internal state.json stores
PidsLimit, and that entry is marked as "omitempty". So, an old runc
would omit PidsLimit=0 in state.json, and this will be parsed by a new
runc as being "nil" -- and both would treat this case as "do not set
anything".
Fixes #4014
Closes #4015
Closes #4023
Signed-off-by: Aleksa Sarai [email protected]