Repository: opencontainers/runc
File: libcontainer/process_linux.go (Go)

Code before:
	}
	p.cmd.SysProcAttr.UseCgroupFD = true
	p.cmd.SysProcAttr.CgroupFD = int(fd.Fd())

	return fd, nil
}

func (p *setnsProcess) start() (retErr error) {
	defer p.comm.closeParent()

	fd, err := p.prepareCloneIntoCgroup()
	if err != nil {
		return err
	}

	// Get the "before" value of oom kill count.
	oom, _ := p.manager.OOMKillCount()

	err = p.startWithCPUAffinity()
	if fd != nil {
		fd.Close()
	}
	// We tried using cgroupfd but failed, so retry without.
	if p.cmd.SysProcAttr.UseCgroupFD && err != nil &&
		// clone3(CLONE_INTO_CGROUP) not supported.
		(errors.Is(err, errors.ErrUnsupported) ||
			// Nesting + domain controllers.
			errors.Is(err, unix.EBUSY) ||
			// Rootless has no direct access to cgroup.
			(p.rootlessCgroups && errors.Is(err, unix.EACCES))) {
		logrus.Debugf("exec(CLONE_INTO_CGROUP) failed with %v, retrying without it", err)
		p.cmd.SysProcAttr.UseCgroupFD = false
		err = p.startWithCPUAffinity()
	}

	// Close the child-side of the pipes (controlled by child).
	p.comm.closeChild()
	if err != nil {
		return fmt.Errorf("error starting setns process: %w", err)
	}

	defer func() {
		if retErr != nil {
			if newOom, err := p.manager.OOMKillCount(); err == nil && newOom != oom {
				// Someone in this cgroup was killed, this _might_ be us.
				retErr = fmt.Errorf("%w (possibly OOM-killed)", retErr)
			}
			err := ignoreTerminateErrors(p.terminate())
			if err != nil {
				logrus.WithError(err).Warn("unable to terminate setnsProcess")
			}

Review comment (suggestion):
Just curious, the CI run when using old kernels falls into this? We don't need to handle `ENOSYS` too (like kernels without clone3)?

Or what happens if the kernel supports clone into cgroup but it's using cgroups v1? What is returned? EINVAL? From the manpage it's not clear to me on a quick look.



Code after:
	if p.cmd.SysProcAttr == nil {
		p.cmd.SysProcAttr = &syscall.SysProcAttr{}
	}
	p.cmd.SysProcAttr.UseCgroupFD = true
	p.cmd.SysProcAttr.CgroupFD = int(fd.Fd())

	return fd, nil
}

func (p *setnsProcess) start() (retErr error) {
	defer p.comm.closeParent()

	fd, err := p.prepareCgroupFD()
	if err != nil {
		return err
	}

	// Get the "before" value of oom kill count.
	oom, _ := p.manager.OOMKillCount()

	err = p.startWithCPUAffinity()
	if fd != nil {
		fd.Close()
	}
	if err != nil && p.cmd.SysProcAttr.UseCgroupFD {
		logrus.Debugf("exec with CLONE_INTO_CGROUP failed: %v; retrying without", err)
		// SysProcAttr.CgroupFD is never used when UseCgroupFD is unset.
		p.cmd.SysProcAttr.UseCgroupFD = false
		err = p.startWithCPUAffinity()
	}

	// Close the child-side of the pipes (controlled by child).
	p.comm.closeChild()
	if err != nil {
		return fmt.Errorf("error starting setns process: %w", err)
	}

	defer func() {
		if retErr != nil {
			if newOom, err := p.manager.OOMKillCount(); err == nil && newOom != oom {
				// Someone in this cgroup was killed, this _might_ be us.
				retErr = fmt.Errorf("%w (possibly OOM-killed)", retErr)
			}
			err := ignoreTerminateErrors(p.terminate())
			if err != nil {
				logrus.WithError(err).Warn("unable to terminate setnsProcess")
			}
		}
	}()

	if p.bootstrapData != nil {