Internal change.

PiperOrigin-RevId: 827191756

Author: nixprime

go.mod

@@ -15,7 +15,7 @@ require (
 	github.com/containerd/go-runc v1.0.0
 	github.com/containerd/log v0.1.0
 	github.com/containerd/typeurl v1.0.2
-	github.com/coreos/go-systemd/v22 v22.5.0
+	github.com/coreos/go-systemd/v22 v22.6.0
 	github.com/godbus/dbus/v5 v5.1.0
 	github.com/gofrs/flock v0.8.0
 	github.com/gogo/protobuf v1.3.2

go.sum

@@ -234,6 +234,8 @@ github.com/coreos/go-systemd/v22 v22.1.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+
 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/coreos/go-systemd/v22 v22.6.0 h1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo=
+github.com/coreos/go-systemd/v22 v22.6.0/go.mod h1:iG+pp635Fo7ZmV/j14KUcmEyWF+0X7Lua8rrTWzYgWU=
 github.com/coreos/pkg v0.0.0-20160727233714-3ac0863d7acf/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
 github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=

runsc/cgroup/cgroup.go

@@ -960,3 +960,17 @@ func (*hugeTLB) set(spec *specs.LinuxResources, path string) error {
 	}
 	return nil
 }
+
+// RunInCgroup executes fn inside the specified cgroup. If cg is nil, execute
+// it in the current context.
+func RunInCgroup(cg Cgroup, fn func() error) error {
+	if cg == nil {
+		return fn()
+	}
+	restore, err := cg.Join()
+	if err != nil {
+		return err
+	}
+	defer restore()
+	return fn()
+}

runsc/cgroup/systemd.go

@@ -182,6 +182,9 @@ func (c *cgroupSystemd) Join() (func(), error) {
 			return nil, fmt.Errorf("unknown job completion status %q", s)
 		}
 	} else if unitAlreadyExists(err) {
+		if err := c.dbusConn.AttachProcessesToUnit(timedCtx, unitName, "" /* subcgroup */, []uint32{uint32(os.Getpid())}); err != nil {
+			return nil, fmt.Errorf("error joining systemd unit `%s`: %w", unitName, err)
+		}
 		return clean.Release(), nil
 	} else {
 		return nil, fmt.Errorf("systemd error: %v", err)

runsc/container/container.go

@@ -297,7 +297,7 @@ func New(conf *config.Config, args Args) (*Container, error) {
 		if err := nvProxyPreGoferHostSetup(args.Spec, conf); err != nil {
 			return nil, err
 		}
-		if err := runInCgroup(containerCgroup, func() error {
+		if err := cgroup.RunInCgroup(containerCgroup, func() error {
 			ioFiles, goferFilestores, devIOFile, specFile, err := c.createGoferProcess(conf, mountHints, args.Attached)
 			if err != nil {
 				return fmt.Errorf("cannot create gofer process: %w", err)
@@ -451,7 +451,7 @@ func (c *Container) startImpl(conf *config.Config, action string, startRoot func
 	} else {
 		// Join cgroup to start gofer process to ensure it's part of the cgroup from
 		// the start (and all their children processes).
-		if err := runInCgroup(c.Sandbox.CgroupJSON.Cgroup, func() error {
+		if err := cgroup.RunInCgroup(c.Sandbox.CgroupJSON.Cgroup, func() error {
 			// Create the gofer process.
 			goferFiles, goferFilestores, devIOFile, mountsFile, err := c.createGoferProcess(conf, c.Sandbox.MountHints, false /* attached */)
 			if err != nil {
@@ -1589,20 +1589,6 @@ func isRoot(spec *specs.Spec) bool {
 	return specutils.SpecContainerType(spec) != specutils.ContainerTypeContainer
 }
 
-// runInCgroup executes fn inside the specified cgroup. If cg is nil, execute
-// it in the current context.
-func runInCgroup(cg cgroup.Cgroup, fn func() error) error {
-	if cg == nil {
-		return fn()
-	}
-	restore, err := cg.Join()
-	if err != nil {
-		return err
-	}
-	defer restore()
-	return fn()
-}
-
 // adjustGoferOOMScoreAdj sets the oom_store_adj for the container's gofer.
 func (c *Container) adjustGoferOOMScoreAdj() error {
 	goferPid := c.GoferPid.Load()

runsc/sandbox/sandbox.go

@@ -986,7 +986,7 @@ func (s *Sandbox) createSandboxProcess(conf *config.Config, args *Args, startSyn
 		donations.DonateAndClose("save-fds", files...)
 	}
 
-	if err := createSandboxProcessExtra(conf, args, cmd, &donations); err != nil {
+	if err := s.createSandboxProcessExtra(conf, args, cmd, &donations); err != nil {
 		return err
 	}
 
@@ -1540,7 +1540,7 @@ func (s *Sandbox) Checkpoint(conf *config.Config, cid string, imagePath string,
 			_ = f.Close()
 		}
 	}()
-	if err := setCheckpointOptsImpl(conf, imagePath, opts, &opt); err != nil {
+	if err := s.setCheckpointOptsImpl(conf, imagePath, opts, &opt); err != nil {
 		return err
 	}
 

runsc/sandbox/sandbox_impl.go

@@ -26,13 +26,13 @@ import (
 	"gvisor.dev/gvisor/runsc/donation"
 )
 
-func createSandboxProcessExtra(conf *config.Config, args *Args, cmd *exec.Cmd, donations *donation.Agency) error {
+func (s *Sandbox) createSandboxProcessExtra(conf *config.Config, args *Args, cmd *exec.Cmd, donations *donation.Agency) error {
 	return nil
 }
 
 type checkpointOptsExtra struct{}
 
-func setCheckpointOptsImpl(conf *config.Config, imagePath string, opts CheckpointOpts, opt *control.SaveOpts) error {
+func (s *Sandbox) setCheckpointOptsImpl(conf *config.Config, imagePath string, opts CheckpointOpts, opt *control.SaveOpts) error {
 	return setCheckpointOptsForLocalCheckpointFiles(conf, imagePath, opts, opt)
 }