Merge pull request #6368 from marxarelli/review/unshare-cgroupns-entrypoint

dockerfile: run buildkitd within a cgroup namespace for cgroup v2

Author: tonistiigi

Dockerfile

@@ -221,7 +221,7 @@ FROM scratch AS release
 COPY --link --from=releaser /out/ /
 
 FROM alpine:${ALPINE_VERSION} AS buildkit-export-alpine
-RUN apk add --no-cache fuse3 git openssh openssl pigz xz iptables ip6tables \
+RUN apk add --no-cache fuse3 git openssh openssl pigz xz iptables ip6tables util-linux-misc \
   && ln -s fusermount3 /usr/bin/fusermount
 COPY --link examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/
 VOLUME /var/lib/buildkit
@@ -398,7 +398,9 @@ EOT
 FROM buildkit-export AS buildkit-linux
 COPY --link --from=binaries / /usr/bin/
 ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1
-ENTRYPOINT ["buildkitd"]
+COPY --link hack/buildkitd-entrypoint /usr/bin/buildkitd-entrypoint
+COPY --link hack/with-cgroupfs-remount /usr/bin/with-cgroupfs-remount
+ENTRYPOINT ["/usr/bin/buildkitd-entrypoint"]
 
 FROM buildkit-linux AS buildkit-linux-debug
 COPY --link --from=dlv /out/dlv /usr/bin/dlv

hack/buildkitd-entrypoint

@@ -0,0 +1,22 @@
+#!/bin/sh
+#
+# For cgroup v2, ensure buildkitd has a namespaced view of /sys/fs/cgroup by
+# running in a new cgroup and mount namespace and remounting /sys/fs/cgroup.
+# Assume we are already in our own cgroup ns if the current cgroup path is
+# "/".
+#
+# Note this is a workaround for the lack of cgroupns control in the Kubernetes
+# API. If KEP-5714 is adopted, this can eventually be removed.
+#
+# See https://github.com/kubernetes/enhancements/issues/5714
+
+set -e
+
+if [ -e /sys/fs/cgroup/cgroup.controllers ]; then
+  if [ "$(cut -d: -f3 /proc/self/cgroup)" != "/" ]; then
+    echo creating cgroup namespace >&2
+    exec /usr/bin/unshare --cgroup --mount /usr/bin/with-cgroupfs-remount /usr/bin/buildkitd "$@"
+  fi
+fi
+
+exec /usr/bin/buildkitd "$@"

hack/with-cgroupfs-remount

@@ -0,0 +1,8 @@
+#!/bin/sh
+set -e
+
+options="$(awk '$2 == "/sys/fs/cgroup" { print $4 }' /proc/self/mounts)"
+umount /sys/fs/cgroup
+mount -t cgroup2 -o "$options" cgroup2 /sys/fs/cgroup
+
+exec "$@"