// mountContainerCgroups mounts the cgroup controllers hierarchy in the container's
// namespace read-only, leaving the needed knobs in the subcgroup for each-app
// read-write so systemd inside stage1 can apply isolators to them
func mountContainerCgroups(s1Root string, enabledCgroups map[int][]string, subcgroup string, serviceNames []string) error {
if err := cgroup.CreateCgroups(s1Root, enabledCgroups); err != nil {
return fmt.Errorf("error creating container cgroups: %v\n", err)
}
if err := cgroup.RemountCgroupsRO(s1Root, enabledCgroups, subcgroup, serviceNames); err != nil {
return fmt.Errorf("error restricting container cgroups: %v\n", err)
}
return nil
}
// mountContainerCgroups mounts the cgroup controllers hierarchy in the container's
// namespace read-only, leaving the needed knobs in the subcgroup for each-app
// read-write so systemd inside stage1 can apply isolators to them
func mountContainerCgroups(s1Root string, enabledCgroups map[int][]string, subcgroup string, serviceNames []string) error {
if err := cgroup.CreateCgroups(s1Root, enabledCgroups); err != nil {
return errwrap.Wrap(errors.New("error creating container cgroups"), err)
}
if err := cgroup.RemountCgroupsRO(s1Root, enabledCgroups, subcgroup, serviceNames); err != nil {
return errwrap.Wrap(errors.New("error restricting container cgroups"), err)
}
return nil
}
// mountContainerCgroups mounts the cgroup controllers hierarchy in the container's
// namespace read-only, leaving the needed knobs in the subcgroup for each-app
// read-write so systemd inside stage1 can apply isolators to them
func mountContainerCgroups(s1Root string, enabledCgroups map[int][]string, subcgroup string, serviceNames []string) error {
mountContext := os.Getenv(common.EnvSELinuxMountContext)
if err := cgroup.CreateCgroups(s1Root, enabledCgroups, mountContext); err != nil {
return errwrap.Wrap(errors.New("error creating container cgroups"), err)
}
if err := cgroup.RemountCgroupsRO(s1Root, enabledCgroups, subcgroup, serviceNames); err != nil {
return errwrap.Wrap(errors.New("error restricting container cgroups"), err)
}
return nil
}