Move the slave into its own cgroup for each of the specified subsystems. NOTE: Any subsystem configuration is inherited from the mesos root cgroup for that subsystem, e.g., by default the memory cgroup will be unlimited. TODO(jieyu): Make sure the corresponding cgroup isolator is enabled so that the container processes are moved to different cgroups than the agent cgroup.
| 146 | // enabled so that the container processes are moved to different |
| 147 | // cgroups than the agent cgroup. |
| 148 | static Try<Nothing> assignCgroups(const slave::Flags& flags) |
| 149 | { |
| 150 | CHECK_SOME(flags.agent_subsystems); |
| 151 | |
| 152 | foreach (const string& subsystem, |
| 153 | strings::tokenize(flags.agent_subsystems.get(), ",")) { |
| 154 | LOG(INFO) << "Moving agent process into its own cgroup for" |
| 155 | << " subsystem: " << subsystem; |
| 156 | |
| 157 | // Ensure the subsystem is mounted and the Mesos root cgroup is |
| 158 | // present. |
| 159 | Try<string> hierarchy = cgroups::prepare( |
| 160 | flags.cgroups_hierarchy, |
| 161 | subsystem, |
| 162 | flags.cgroups_root); |
| 163 | |
| 164 | if (hierarchy.isError()) { |
| 165 | return Error( |
| 166 | "Failed to prepare cgroup " + flags.cgroups_root + |
| 167 | " for subsystem " + subsystem + |
| 168 | ": " + hierarchy.error()); |
| 169 | } |
| 170 | |
| 171 | // Create a cgroup for the slave. |
| 172 | string cgroup = path::join(flags.cgroups_root, "slave"); |
| 173 | |
| 174 | if (!cgroups::exists(hierarchy.get(), cgroup)) { |
| 175 | Try<Nothing> create = cgroups::create(hierarchy.get(), cgroup); |
| 176 | if (create.isError()) { |
| 177 | return Error( |
| 178 | "Failed to create cgroup " + cgroup + |
| 179 | " for subsystem " + subsystem + |
| 180 | " under hierarchy " + hierarchy.get() + |
| 181 | " for agent: " + create.error()); |
| 182 | } |
| 183 | } |
| 184 | |
| 185 | // Exit if there are processes running inside the cgroup - this |
| 186 | // indicates a prior slave (or child process) is still running. |
| 187 | Try<set<pid_t>> processes = cgroups::processes(hierarchy.get(), cgroup); |
| 188 | if (processes.isError()) { |
| 189 | return Error( |
| 190 | "Failed to check for existing threads in cgroup " + cgroup + |
| 191 | " for subsystem " + subsystem + |
| 192 | " under hierarchy " + hierarchy.get() + |
| 193 | " for agent: " + processes.error()); |
| 194 | } |
| 195 | |
| 196 | // Log if there are any processes in the slave's cgroup. They |
| 197 | // may be transient helper processes like 'perf' or 'du', |
| 198 | // ancillary processes like 'docker log' or possibly a stuck |
| 199 | // slave. |
| 200 | // TODO(idownes): Generally, it's not a problem if there are |
| 201 | // processes running in the slave's cgroup, though any resources |
| 202 | // consumed by those processes are accounted to the slave. Where |
| 203 | // applicable, transient processes should be configured to |
| 204 | // terminate if the slave exits; see example usage for perf in |
| 205 | // isolators/cgroups/perf.cpp. Consider moving ancillary |