aristanetworks / bst

A one-stop shop for process isolation
MIT License
99 stars 9 forks source link

Revisit cgroup support and make it more turnkey #80

Closed Snaipe closed 1 year ago

Snaipe commented 1 year ago

The current cgroup implementation was in a very sad state, and was overall hard to use correctly, because it was trying to conciliate two very different system configurations: systemd-managed systems, and the contrary.

This PR makes bst limits more turnkey; that is, it now "just works" on the vast majority of systems without any additional configuration.


More specifically, this PR does two things: first, it refactors the current cgroup code into cgroup "drivers", and it provides two driver implementations: native, and systemd.

The native driver manages and cleans up cgroups directly, with no intermediary. It is appropriate to use in situations where nothing is owning the cgroups tree, like in most containers.

The systemd driver defers the management of the cgroup to systemd. It does so by creating a systemd scope unit via the D-Bus API. This driver is appropriate for systemd-managed systems, as directly creating cgroups without informing systemd on these systems causes bst to step on systemd's toes, and vice-versa.

bst will attempt to use the systemd driver before falling back to the native driver.