| 1779 | |
| 1780 | #ifdef __linux__ |
| 1781 | Future<Nothing> DockerContainerizerProcess::_update( |
| 1782 | const ContainerID& containerId, |
| 1783 | const Resources& resourceRequests, |
| 1784 | const google::protobuf::Map<string, Value::Scalar>& resourceLimits, |
| 1785 | const Docker::Container& container) |
| 1786 | { |
| 1787 | if (container.pid.isNone()) { |
| 1788 | return Nothing(); |
| 1789 | } |
| 1790 | |
| 1791 | if (!containers_.contains(containerId)) { |
| 1792 | LOG(INFO) << "Container has been removed after docker inspect, " |
| 1793 | << "skipping update"; |
| 1794 | return Nothing(); |
| 1795 | } |
| 1796 | |
| 1797 | containers_.at(containerId)->pid = container.pid.get(); |
| 1798 | |
| 1799 | // NOTE: Normally, a Docker container should be in its own cgroup. |
| 1800 | // However, a zombie process (exited but not reaped) will be |
| 1801 | // temporarily moved into the system root cgroup. We add some |
| 1802 | // defensive check here to make sure we are not changing the knobs |
| 1803 | // in the root cgroup. See MESOS-8480 for details. |
| 1804 | const string systemRootCgroup = stringify(os::PATH_SEPARATOR); |
| 1805 | |
| 1806 | // We need to find the cgroup(s) this container is currently running |
| 1807 | // in for both the hierarchy with the 'cpu' subsystem attached and |
| 1808 | // the hierarchy with the 'memory' subsystem attached so we can |
| 1809 | // update the proper cgroup control files. |
| 1810 | |
| 1811 | // Determine the cgroup for the 'cpu' subsystem (based on the |
| 1812 | // container's pid). |
| 1813 | Result<string> cpuCgroup = cgroups::cpu::cgroup(container.pid.get()); |
| 1814 | if (cpuCgroup.isError()) { |
| 1815 | return Failure("Failed to determine cgroup for the 'cpu' subsystem: " + |
| 1816 | cpuCgroup.error()); |
| 1817 | } else if (cpuCgroup.isNone()) { |
| 1818 | LOG(WARNING) << "Container " << containerId |
| 1819 | << " does not appear to be a member of a cgroup" |
| 1820 | << " where the 'cpu' subsystem is mounted"; |
| 1821 | } else if (cpuCgroup.get() == systemRootCgroup) { |
| 1822 | LOG(WARNING) |
| 1823 | << "Process '" << container.pid.get() |
| 1824 | << "' should not be in the system root cgroup (being destroyed?)"; |
| 1825 | } else { |
| 1826 | // Cache the CPU cgroup. |
| 1827 | containers_.at(containerId)->cpuCgroup = cpuCgroup.get(); |
| 1828 | } |
| 1829 | |
| 1830 | // Now determine the cgroup for the 'memory' subsystem. |
| 1831 | Result<string> memoryCgroup = cgroups::memory::cgroup(container.pid.get()); |
| 1832 | if (memoryCgroup.isError()) { |
| 1833 | return Failure("Failed to determine cgroup for the 'memory' subsystem: " + |
| 1834 | memoryCgroup.error()); |
| 1835 | } else if (memoryCgroup.isNone()) { |
| 1836 | LOG(WARNING) << "Container " << containerId |
| 1837 | << " does not appear to be a member of a cgroup" |
| 1838 | << " where the 'memory' subsystem is mounted"; |