Skip to content

fix: only remount /sys/fs/cgroup when rooted at a nested path #173

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
geokat merged 2 commits into from
Jul 21, 2026
+38 −11
Merged

fix: only remount /sys/fs/cgroup when rooted at a nested path #173

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3facdd9
fix: only remount /sys/fs/cgroup when rooted at a nested path
geokat Jul 15, 2026
2ce0cc7
support stacked mounts when checking to remount /sys/fs/cgroup
geokat Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 21 additions & 6 deletions cli/docker_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,11 +191,23 @@ func TestDocker(t *testing.T) {
# (https://github.com/moby/moby/blob/8d9e3502aba39127e4d12196dae16d306f76993d/hack/dind#L61-L79),
# bounded by envbox_max_attempts.
if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
# Remount /sys/fs/cgroup so the new cgroup namespace's view becomes the
# fs root; inner container cgroups end up under the envbox container's
# cgroup on the host.
umount /sys/fs/cgroup || { echo "envbox: failed to umount /sys/fs/cgroup" >&2; exit 1; }
mount -t cgroup2 cgroup /sys/fs/cgroup || { echo "envbox: failed to mount cgroup2 on /sys/fs/cgroup" >&2; exit 1; }
# Some runtimes already root /sys/fs/cgroup at "/" after unsharing the
# cgroup namespace; remounting it again fails with EBUSY. Only remount
# when it's still rooted at a nested host path.
# When mounts are stacked at /sys/fs/cgroup, the visible mount is the
# one whose ID is not another same-location mount's parent (see
# proc_pid_mountinfo(5)).
cgroup_mount_root=$(awk '
$5 == "/sys/fs/cgroup" { root[$1] = $4; isparent[$2] = 1 }
END { for (id in root) if (!(id in isparent)) print root[id] }
' /proc/self/mountinfo)
if [ "$cgroup_mount_root" != "/" ]; then
# Remount /sys/fs/cgroup so the new cgroup namespace's view becomes the
# fs root; inner container cgroups end up under the envbox container's
# cgroup on the host.
umount /sys/fs/cgroup || { echo "envbox: failed to umount /sys/fs/cgroup" >&2; exit 1; }
mount -t cgroup2 cgroup /sys/fs/cgroup || { echo "envbox: failed to mount cgroup2 on /sys/fs/cgroup" >&2; exit 1; }
fi
Comment on lines +194 to +210

@johnstcn johnstcn Jul 21, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit, non-blocking: We now have this logic duplicated verbatim. Might be worth de-duping? Not a blocker though and more of a follow-up.

@geokat geokat Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point! More than that, we're effectively triplicating this logic between this
test, TestWrapDockerdCmd, and the production script itself. It would be nice to
replace most of that with a black-box test of the wrapper's behavior, but that
would need a bit of dedicated harness/setup (good for a follow-up PR).


# move the processes from the root group to the /init group,
# otherwise writing subtree_control fails with EBUSY.
Expand Down Expand Up @@ -817,13 +829,16 @@ func TestWrapDockerdCmd(t *testing.T) {
// - prepend the envbox_max_attempts value (so the embedded script can
// reference it as a variable)
// - guard the v2-only block on cgroup.controllers existing
// - perform the umount/mount inside that guard (cgroupv1 hosts unaffected)
// - only remount when /sys/fs/cgroup is still rooted at a nested path
// - delegate via /init + subtree_control
// - bound the retry loop against envbox_max_attempts
// - exec into dockerd
script := args[3]
require.Contains(t, script, fmt.Sprintf("envbox_max_attempts=%d", cli.DockerdSubtreeControlMaxAttempts))
require.Contains(t, script, "[ -f /sys/fs/cgroup/cgroup.controllers ]")
require.Contains(t, script, `$5 == "/sys/fs/cgroup" { root[$1] = $4; isparent[$2] = 1 }`)
require.Contains(t, script, `END { for (id in root) if (!(id in isparent)) print root[id] }`)
require.Contains(t, script, `if [ "$cgroup_mount_root" != "/" ]; then`)
require.Contains(t, script, "umount /sys/fs/cgroup")
require.Contains(t, script, "mount -t cgroup2 cgroup /sys/fs/cgroup")
require.Contains(t, script, "mkdir -p /sys/fs/cgroup/init")
Expand Down
22 changes: 17 additions & 5 deletions cli/wrap_dockerd.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,23 @@
# (https://github.com/moby/moby/blob/8d9e3502aba39127e4d12196dae16d306f76993d/hack/dind#L61-L79),
# bounded by envbox_max_attempts.
if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
# Remount /sys/fs/cgroup so the new cgroup namespace's view becomes the
# fs root; inner container cgroups end up under the envbox container's
# cgroup on the host.
umount /sys/fs/cgroup || { echo "envbox: failed to umount /sys/fs/cgroup" >&2; exit 1; }
mount -t cgroup2 cgroup /sys/fs/cgroup || { echo "envbox: failed to mount cgroup2 on /sys/fs/cgroup" >&2; exit 1; }
# Some runtimes already root /sys/fs/cgroup at "/" after unsharing the
# cgroup namespace; remounting it again fails with EBUSY. Only remount
# when it's still rooted at a nested host path.
# When mounts are stacked at /sys/fs/cgroup, the visible mount is the
# one whose ID is not another same-location mount's parent (see
# proc_pid_mountinfo(5)).
cgroup_mount_root=$(awk '
$5 == "/sys/fs/cgroup" { root[$1] = $4; isparent[$2] = 1 }
END { for (id in root) if (!(id in isparent)) print root[id] }
' /proc/self/mountinfo)
if [ "$cgroup_mount_root" != "/" ]; then
# Remount /sys/fs/cgroup so the new cgroup namespace's view becomes the
# fs root; inner container cgroups end up under the envbox container's
# cgroup on the host.
umount /sys/fs/cgroup || { echo "envbox: failed to umount /sys/fs/cgroup" >&2; exit 1; }
mount -t cgroup2 cgroup /sys/fs/cgroup || { echo "envbox: failed to mount cgroup2 on /sys/fs/cgroup" >&2; exit 1; }
fi

# move the processes from the root group to the /init group,
# otherwise writing subtree_control fails with EBUSY.
Expand Down
Loading