82 lines
3.8 KiB
Bash
Executable file
82 lines
3.8 KiB
Bash
Executable file
#!/bin/sh
|
|
# zddc-cgroup-init — prepare cgroup v2 hierarchy and exec zddc-server.
|
|
#
|
|
# The per-conversion wrapper (zddc-sandbox-exec) creates a transient
|
|
# child cgroup for each pandoc / chromium invocation, sets memory.max
|
|
# and pids.max on it, and moves the conversion process in. That only
|
|
# works when:
|
|
#
|
|
# (a) the cgroup v2 hierarchy is mounted at /sys/fs/cgroup, AND
|
|
# (b) the controllers we need (memory, pids) are enabled in the
|
|
# parent cgroup's subtree_control file, AND
|
|
# (c) the parent cgroup has NO processes in it (cgroup v2's
|
|
# "no internal processes" constraint: a cgroup can have
|
|
# children OR processes, not both).
|
|
#
|
|
# A bare container with PID 1 in the root cgroup violates (c). This
|
|
# init script does the one-time setup BEFORE exec'ing zddc-server:
|
|
#
|
|
# 1. mkdir /sys/fs/cgroup/zddc/ (a sibling for zddc-server)
|
|
# 2. move every PID out of root into /sys/fs/cgroup/zddc/
|
|
# 3. enable +memory +pids in root's subtree_control (now empty)
|
|
# 4. enable +memory +pids in zddc/'s subtree_control (so its
|
|
# children — the per-conversion cgroups created by the wrapper
|
|
# — can use those controllers)
|
|
# 5. exec zddc-server (which inherits cgroup membership in zddc/)
|
|
#
|
|
# After this, the wrapper script creates /sys/fs/cgroup/conv.<pid>/
|
|
# as a sibling of /sys/fs/cgroup/zddc/, sets limits, and moves the
|
|
# pandoc/chromium process in. Each conversion gets a fresh transient
|
|
# cgroup that vanishes when the process exits.
|
|
#
|
|
# Best-effort: if any step fails (cgroup v1, undelegated subtree,
|
|
# read-only cgroupfs in some other container shape), this script
|
|
# still exec's zddc-server. The convert pipeline degrades to
|
|
# "bwrap sandbox + wall-clock timeout"; an operator notices via
|
|
# the warning log line below.
|
|
|
|
set -eu
|
|
|
|
setup_cgroup_v2() {
|
|
cgroot=/sys/fs/cgroup
|
|
[ -d "$cgroot" ] || return 1
|
|
# Detect cgroup v2 by the presence of cgroup.controllers at root.
|
|
[ -r "$cgroot/cgroup.controllers" ] || return 1
|
|
# Need memory + pids in available controllers.
|
|
if ! grep -qw memory "$cgroot/cgroup.controllers"; then
|
|
echo "zddc-cgroup-init: cgroup.controllers lacks 'memory' — per-conversion memory cap will be unenforced" >&2
|
|
fi
|
|
# Create the leaf where zddc-server itself will live.
|
|
mkdir -p "$cgroot/zddc" || return 1
|
|
# Move every PID currently in the root cgroup into zddc/. The
|
|
# root must be empty before we can enable subtree_control.
|
|
if [ -r "$cgroot/cgroup.procs" ]; then
|
|
while read -r pid; do
|
|
[ -n "$pid" ] || continue
|
|
# Best-effort; processes can exit between read and write.
|
|
printf "%s\n" "$pid" > "$cgroot/zddc/cgroup.procs" 2>/dev/null || true
|
|
done < "$cgroot/cgroup.procs"
|
|
fi
|
|
# Enable controllers at root → makes them usable in immediate
|
|
# children (zddc/ and any sibling per-conversion cgroup).
|
|
printf "+memory +pids" > "$cgroot/cgroup.subtree_control" 2>/dev/null || {
|
|
echo "zddc-cgroup-init: could not enable +memory +pids in $cgroot/cgroup.subtree_control — caps will not apply" >&2
|
|
return 1
|
|
}
|
|
# Enable inside zddc/ too, so any deeper children of zddc-server
|
|
# (which there shouldn't be, but defense in depth) inherit.
|
|
printf "+memory +pids" > "$cgroot/zddc/cgroup.subtree_control" 2>/dev/null || true
|
|
return 0
|
|
}
|
|
|
|
if ! setup_cgroup_v2; then
|
|
echo "zddc-cgroup-init: cgroup v2 setup unavailable — running without per-conversion caps" >&2
|
|
fi
|
|
|
|
# Hand off to zddc-server. The exec'd process lands in
|
|
# /sys/fs/cgroup/zddc/ (we moved ourselves there above). When it
|
|
# spawns the wrapper, the wrapper creates a transient sibling cgroup
|
|
# under /sys/fs/cgroup/, NOT a child of zddc/, so the conversion's
|
|
# cgroup is a peer of zddc-server's — keeping zddc-server's own
|
|
# resource accounting separate from conversion accounting.
|
|
exec "$@"
|