Implement Linux memory policy

.github/workflows/integration_tests_validation.yaml

@@ -92,7 +92,7 @@ jobs:
         run: sudo add-apt-repository -y ppa:criu/ppa
       - name: Install requirements
         run: sudo env PATH=$PATH just ci-prepare
-      - name: Install runc 1.3.2
+      - name: Install runc v1.3.2
         run: |
           wget -q https://github.com/opencontainers/runc/releases/download/v1.3.2/runc.amd64
           sudo mv runc.amd64 /usr/bin/runc

crates/libcontainer/Cargo.toml

@@ -48,7 +48,10 @@ libseccomp = { version = "0.4.0", optional = true }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 rust-criu = "0.4.0"
-regex = { version = "1.12.2", default-features = false, features = ["std", "unicode-perl"] }
+regex = { version = "1.12.2", default-features = false, features = [
+    "std",
+    "unicode-perl",
+] }
 thiserror = "2.0.17"
 tracing = { version = "0.1.41", features = ["attributes"] }
 safe-path = "0.1.0"

crates/libcontainer/src/process/init/error.rs

@@ -1,5 +1,6 @@
 use crate::namespaces::NamespaceError;
 use crate::process::channel;
+use crate::process::memory_policy::MemoryPolicyError;
 use crate::rootfs::device::DeviceError;
 #[cfg(feature = "libseccomp")]
 use crate::seccomp;
@@ -64,6 +65,10 @@ pub enum InitProcessError {
     IoPriorityClass(String),
     #[error("call exec sched_setattr error: {0}")]
     SchedSetattr(String),
+    #[error("invalid memory policy: {0}")]
+    InvalidMemoryPolicy(String),
+    #[error(transparent)]
+    MemoryPolicy(#[from] MemoryPolicyError),
     #[error(transparent)]
     Network(#[from] crate::network::NetworkError),
     #[error("failed to verify if current working directory is safe")]

crates/libcontainer/src/process/init/process.rs

@@ -27,7 +27,7 @@ use crate::network::link::LinkClient;
 use crate::network::network_device::{resolve_device_name, setup_addresses_in_network_namespace};
 use crate::network::wrapper::create_network_client;
 use crate::process::args::{ContainerArgs, ContainerType};
-use crate::process::channel;
+use crate::process::{channel, memory_policy};
 use crate::rootfs::RootFS;
 use crate::rootfs::device::{open_device_fd, verify_dev_null};
 #[cfg(feature = "libseccomp")]
@@ -54,6 +54,8 @@ pub fn container_init_process(
 
     setup_scheduler(ctx.process.scheduler())?;
 
+    memory_policy::setup_memory_policy(ctx.linux.memory_policy(), ctx.syscall.as_ref())?;
+
     // set up tty if specified
     if let Some(csocketfd) = args.console_socket {
         tty::setup_console(csocketfd).map_err(|err| {