Function testPids

libcontainer/integration/exec_test.go:541–573

(t *testing.T, systemd bool)

}

func testPids(t *testing.T, systemd bool) {
	if testing.Short() {
		return
	}

	config := newTemplateConfig(t, &tParam{systemd: systemd})
	config.Cgroups.Resources.PidsLimit = mkPtr[int64](-1)

	// Running multiple processes, expecting it to succeed with no pids limit.
	runContainerOk(t, config, "/bin/sh", "-c", truePipeline(4))

	// Enforce a permissive limit. This needs to be fairly hand-wavey due to the
	// issues with running Go binaries with pids restrictions (see below).
	config.Cgroups.Resources.PidsLimit = mkPtr[int64](64)
	runContainerOk(t, config, "/bin/sh", "-c", truePipeline(32))

	// Enforce a restrictive limit. 64 * /bin/true + 1 * shell should cause
	// this to fail reliably.
	config.Cgroups.Resources.PidsLimit = mkPtr[int64](64)
	out, _, err := runContainer(t, config, "/bin/sh", "-c", truePipeline(64))
	if err != nil && !strings.Contains(out.String(), "can't fork") {
		t.Fatal(err)
	}

	if err == nil {
		t.Fatal("expected fork() to fail with restrictive pids limit")
	}

	// Minimal restrictions are not really supported, due to quirks in using Go
	// due to the fact that it spawns random processes. While we do our best with
	// late setting cgroup values, it's just too unreliable with very small pids.max.
	// As such, we don't test that case. YMMV.
}

func TestCgroupResourcesUnifiedErrorOnV1(t *testing.T) {
	testCgroupResourcesUnifiedErrorOnV1(t, false)