feat: remove wrapperd and launch processes directly #9489
+350
−169
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,12 +8,19 @@ import ( | |
| "fmt" | ||
| "io" | ||
| "os" | ||
| "slices" | ||
| "strings" | ||
| "syscall" | ||
| "time" | ||
|
|
||
| "github.com/containerd/cgroups/v3" | ||
| "github.com/containerd/cgroups/v3/cgroup1" | ||
| "github.com/containerd/cgroups/v3/cgroup2" | ||
| "github.com/containerd/containerd/v2/pkg/sys" | ||
| "github.com/siderolabs/gen/optional" | ||
| "github.com/siderolabs/gen/xslices" | ||
| "github.com/siderolabs/go-cmd/pkg/cmd/proc/reaper" | ||
| "kernel.org/pub/linux/libs/security/libcap/cap" | ||
|
|
||
| "github.com/siderolabs/talos/internal/app/machined/pkg/system/events" | ||
| "github.com/siderolabs/talos/internal/app/machined/pkg/system/runner" | ||
|
|
@@ -78,27 +85,85 @@ func (p *processRunner) Close() error { | |
| } | ||
|
|
||
| type commandWrapper struct { | ||
| launcher *cap.Launcher | ||
| ctty optional.Optional[int] | ||
| stdin uintptr | ||
| stdout uintptr | ||
| stderr uintptr | ||
| afterStart func() | ||
| afterTermination func() error | ||
| } | ||
|
|
||
| func dropCaps(droppedCapabilities []string, launcher *cap.Launcher) error { | ||
| droppedCaps := strings.Join(droppedCapabilities, ",") | ||
|
|
||
| if droppedCaps != "" { | ||
| caps := strings.Split(droppedCaps, ",") | ||
| dropCaps := xslices.Map(caps, func(c string) cap.Value { | ||
| capability, capErr := cap.FromName(c) | ||
| if capErr != nil { | ||
| fmt.Printf("failed to parse capability: %s", capErr) | ||
| } | ||
|
|
||
| return capability | ||
| }) | ||
|
|
||
| iab := cap.IABGetProc() | ||
| if err := iab.SetVector(cap.Bound, true, dropCaps...); err != nil { | ||
| return fmt.Errorf("failed to set capabilities: %w", err) | ||
| } | ||
|
|
||
| launcher.SetIAB(iab) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| // This callback is run in the thread before executing child process. | ||
| func beforeExecCallback(pa *syscall.ProcAttr, data interface{}) error { | ||
| wrapper, ok := data.(*commandWrapper) | ||
| if !ok { | ||
| return fmt.Errorf("failed to get command info") | ||
| } | ||
|
|
||
| ctty, cttySet := wrapper.ctty.Get() | ||
| if cttySet { | ||
| if pa.Sys == nil { | ||
| pa.Sys = &syscall.SysProcAttr{} | ||
| } | ||
|
|
||
| pa.Sys.Ctty = ctty | ||
| pa.Sys.Setsid = true | ||
| pa.Sys.Setctty = true | ||
| } | ||
|
|
||
| pa.Files = []uintptr{ | ||
| wrapper.stdin, | ||
| wrapper.stdout, | ||
| wrapper.stderr, | ||
| } | ||
|
|
||
| // TODO: use pa.Sys.CgroupFD here when we can be sure clone3 is available | ||
|
There was a problem hiding this comment. So implement 2 different pathways? We use this code in container mode as well, and we cannot really expect containers to be ran on kernel 5.5+ which has clone3 |
||
| return nil | ||
| } | ||
|
|
||
| //nolint:gocyclo | ||
| func (p *processRunner) build() (commandWrapper, error) { | ||
| wrapper := commandWrapper{} | ||
|
|
||
| env := slices.Concat([]string{"PATH=" + constants.PATH}, p.opts.Env, os.Environ()) | ||
| launcher := cap.NewLauncher(p.args.ProcessArgs[0], p.args.ProcessArgs, env) | ||
|
|
||
| if p.opts.UID > 0 { | ||
| launcher.SetUID(int(p.opts.UID)) | ||
| } | ||
|
|
||
| // reduce capabilities and assign them to launcher | ||
| if err := dropCaps(p.opts.DroppedCapabilities, launcher); err != nil { | ||
| return commandWrapper{}, err | ||
| } | ||
|
|
||
| launcher.Callback(beforeExecCallback) | ||
|
|
||
| // Setup logging. | ||
| w, err := p.opts.LoggingManager.ServiceLog(p.args.ID).Writer() | ||
|
|
@@ -113,12 +178,40 @@ func (p *processRunner) build() (commandWrapper, error) { | |
| writer = w | ||
| } | ||
|
|
||
| // As MultiWriter is not a file, we need to create a pipe | ||
| // Pipe writer is passed to the child process while we read from the read side | ||
| pr, pw, err := os.Pipe() | ||
| if err != nil { | ||
| return commandWrapper{}, err | ||
| } | ||
|
|
||
| go io.Copy(writer, pr) //nolint:errcheck | ||
|
|
||
| // close the writer if we exit early due to an error | ||
| closeWriter := true | ||
|
|
||
| closeLogging := func() (e error) { | ||
| err := w.Close() | ||
| if err != nil { | ||
| e = err | ||
| } | ||
|
|
||
| err = pr.Close() | ||
| if err != nil { | ||
| e = err | ||
| } | ||
|
|
||
| err = pw.Close() | ||
| if err != nil { | ||
| e = err | ||
| } | ||
|
|
||
| return e | ||
| } | ||
|
|
||
| defer func() { | ||
| if closeWriter { | ||
| closeLogging() //nolint:errcheck | ||
| } | ||
| }() | ||
|
|
||
|
|
@@ -130,7 +223,7 @@ func (p *processRunner) build() (commandWrapper, error) { | |
| return commandWrapper{}, err | ||
| } | ||
|
|
||
| wrapper.stdin = stdin.Fd() | ||
|
|
||
| afterStartFuncs = append(afterStartFuncs, func() { | ||
| stdin.Close() //nolint:errcheck | ||
|
|
@@ -143,13 +236,13 @@ func (p *processRunner) build() (commandWrapper, error) { | |
| return commandWrapper{}, err | ||
| } | ||
|
|
||
| wrapper.stdout = stdout.Fd() | ||
|
|
||
| afterStartFuncs = append(afterStartFuncs, func() { | ||
| stdout.Close() //nolint:errcheck | ||
| }) | ||
| } else { | ||
| wrapper.stdout = pw.Fd() | ||
| } | ||
|
|
||
| if p.opts.StderrFile != "" { | ||
|
|
@@ -158,37 +251,60 @@ func (p *processRunner) build() (commandWrapper, error) { | |
| return commandWrapper{}, err | ||
| } | ||
|
|
||
| wrapper.stderr = stderr.Fd() | ||
|
|
||
| afterStartFuncs = append(afterStartFuncs, func() { | ||
| stderr.Close() //nolint:errcheck | ||
| }) | ||
| } else { | ||
| wrapper.stderr = pw.Fd() | ||
| } | ||
|
|
||
| closeWriter = false | ||
|
|
||
| wrapper.launcher = launcher | ||
| wrapper.afterStart = func() { | ||
| for _, f := range afterStartFuncs { | ||
| f() | ||
| } | ||
| } | ||
| wrapper.afterTermination = closeLogging | ||
| wrapper.ctty = p.opts.Ctty | ||
|
|
||
| return wrapper, nil | ||
| } | ||
|
|
||
| // Apply cgroup and OOM score after the process is launched. | ||
| func applyProperties(p *processRunner, pid int) error { | ||
| path := cgroup.Path(p.opts.CgroupPath) | ||
|
|
||
| if cgroups.Mode() == cgroups.Unified { | ||
| cgv2, err := cgroup2.Load(path) | ||
| if err != nil { | ||
| return fmt.Errorf("failed to load cgroup %s: %w", path, err) | ||
| } | ||
|
|
||
| if err := cgv2.AddProc(uint64(pid)); err != nil { | ||
|
There was a problem hiding this comment. Don't we also use this launch method when running in a container (thus not sure we have clone3 available)? Cgroup in clone3 is actually only available since kernel 5.7 There was a problem hiding this comment. good point, let's skip it for now There was a problem hiding this comment. can we optionally have two paths? like auto-detect? There was a problem hiding this comment. Unsure whether that's going to be beneficial, but it's possible for sure |
||
| return fmt.Errorf("failed to move process %s to cgroup: %w", p, err) | ||
| } | ||
| } else { | ||
| cgv1, err := cgroup1.Load(cgroup1.StaticPath(path)) | ||
| if err != nil { | ||
| return fmt.Errorf("failed to load cgroup %s: %w", path, err) | ||
| } | ||
|
|
||
| if err := cgv1.Add(cgroup1.Process{ | ||
| Pid: pid, | ||
| }); err != nil { | ||
| return fmt.Errorf("failed to move process %s to cgroup: %w", p, err) | ||
| } | ||
| } | ||
|
|
||
| if err := sys.AdjustOOMScore(pid, p.opts.OOMScoreAdj); err != nil { | ||
| return fmt.Errorf("failed to change OOMScoreAdj of process %s to %d: %w", p, p.opts.OOMScoreAdj, err) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func (p *processRunner) run(eventSink events.Recorder) error { | ||
|
|
@@ -206,20 +322,29 @@ func (p *processRunner) run(eventSink events.Recorder) error { | |
| defer reaper.Stop(notifyCh) | ||
| } | ||
|
|
||
| pid, err := cmdWrapper.launcher.Launch(&cmdWrapper) | ||
| if err != nil { | ||
| return fmt.Errorf("error starting process: %w", err) | ||
| } | ||
|
|
||
| if err := applyProperties(p, pid); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| cmdWrapper.afterStart() | ||
|
|
||
| eventSink(events.StateRunning, "Process %s started with PID %d", p, pid) | ||
|
|
||
| process, err := os.FindProcess(pid) | ||
| if err != nil { | ||
| return fmt.Errorf("could not find process: %w", err) | ||
| } | ||
|
|
||
| waitCh := make(chan error) | ||
|
|
||
| go func() { | ||
| _, err := process.Wait() | ||
|
There was a problem hiding this comment. should use reaper, don't change this part please There was a problem hiding this comment. Okay, refactoring here to accept raw pid and so: https://github.com/siderolabs/go-cmd/blob/main/pkg/cmd/proc/reaper/wait.go#L13-L38 |
||
| waitCh <- err | ||
| }() | ||
|
|
||
| select { | ||
|
|
@@ -231,7 +356,7 @@ func (p *processRunner) run(eventSink events.Recorder) error { | |
| eventSink(events.StateStopping, "Sending SIGTERM to %s", p) | ||
|
|
||
| //nolint:errcheck | ||
| _ = process.Signal(syscall.SIGTERM) | ||
| } | ||
|
|
||
| select { | ||
|
|
@@ -243,7 +368,7 @@ func (p *processRunner) run(eventSink events.Recorder) error { | |
| eventSink(events.StateStopping, "Sending SIGKILL to %s", p) | ||
|
|
||
| //nolint:errcheck | ||
| _ = process.Signal(syscall.SIGKILL) | ||
| } | ||
|
|
||
| // wait for process to terminate | ||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
TODO: remove as this was only debug