cgroups: Add support for cgroup.kill added in Linux Kernel 5.14

libcontainer/cgroups/cgroups.go

@@ -41,6 +41,10 @@ type Manager interface {
 	// Destroy removes cgroup.
 	Destroy() error
 
+	// Leverages "cgroup.kill" added in kernel 5.14.
+	// Kills all the process listed in cgroup.
+	Kill() error
+
 	// Path returns a cgroup path to the specified controller/subsystem.
 	// For cgroupv2, the argument is unused and can be empty.
 	Path(string) string

libcontainer/cgroups/fs/fs.go

@@ -150,6 +150,16 @@ func (m *Manager) Path(subsys string) string {
 	return m.paths[subsys]
 }
 
+func (m *Manager) Kill() error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	// Since "cgroup.kill" is not available for v1 check for cgroup mode hybrid+v1
+	if cgroups.IsCgroup2HybridMode() {
+		return fscommon.Kill(m.paths[""])
+	}
+	return errors.New("cgroup.kill not supported")
+}
+
 func (m *Manager) GetStats() (*cgroups.Stats, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()

libcontainer/cgroups/fs2/fs2.go

@@ -143,6 +143,10 @@ func (m *Manager) Destroy() error {
 	return cgroups.RemovePath(m.dirPath)
 }
 
+func (m *Manager) Kill() error {
+	return fscommon.Kill(m.dirPath)
+}
+
 func (m *Manager) Path(_ string) string {
 	return m.dirPath
 }

libcontainer/cgroups/fscommon/kill.go

@@ -0,0 +1,11 @@
+package fscommon
+
+import (
+	"github.com/opencontainers/runc/libcontainer/cgroups"
+)
+
+// Linux 5.14 supports the file "cgroup.kill" to kill all the processes
+// in a cgroup. Check https://lwn.net/Articles/855924/
+func Kill(path string) error {
+	return cgroups.WriteFile(path, "cgroup.kill", "1")
+}

libcontainer/cgroups/systemd/v1.go

@@ -8,6 +8,7 @@ import (
 	"sync"
 
 	systemdDbus "github.com/coreos/go-systemd/v22/dbus"
+	"github.com/opencontainers/runc/libcontainer/cgroups/fscommon"
 	"github.com/sirupsen/logrus"
 
 	"github.com/opencontainers/runc/libcontainer/cgroups"
@@ -237,6 +238,16 @@ func (m *LegacyManager) Path(subsys string) string {
 	return m.paths[subsys]
 }
 
+func (m *LegacyManager) Kill() error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	// Since "cgroup.kill" is not available for v1 check for cgroup mode hybrid+v1
+	if cgroups.IsCgroup2HybridMode() {
+		return fscommon.Kill(m.paths[""])
+	}
+	return errors.New("cgroup.kill not supported")
+}
+
 func (m *LegacyManager) joinCgroups(pid int) error {
 	for _, sys := range legacySubsystems {
 		name := sys.Name()

libcontainer/cgroups/systemd/v2.go

@@ -17,6 +17,7 @@ import (
 
 	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/cgroups/fs2"
+	"github.com/opencontainers/runc/libcontainer/cgroups/fscommon"
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
@@ -370,6 +371,12 @@ func (m *UnifiedManager) Path(_ string) string {
 	return m.path
 }
 
+func (m *UnifiedManager) Kill() error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return fscommon.Kill(m.path)
+}
+
 // getSliceFull value is used in initPath.
 // The value is incompatible with systemdDbus.PropSlice.
 func (m *UnifiedManager) getSliceFull() (string, error) {

libcontainer/container_linux_test.go

@@ -1,6 +1,7 @@
 package libcontainer
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"testing"
@@ -40,6 +41,10 @@ func (m *mockCgroupManager) Destroy() error {
 	return nil
 }
 
+func (m *mockCgroupManager) Kill() error {
+	return errors.New("Not supported for mock devices")
+}
+
 func (m *mockCgroupManager) Exists() bool {
 	_, err := os.Lstat(m.Path("devices"))
 	return err == nil

libcontainer/init_linux.go

@@ -528,9 +528,18 @@ func isWaitable(pid int) (bool, error) {
 // exit status and only if it is will a wait be performed.
 func signalAllProcesses(m cgroups.Manager, s os.Signal) error {
 	var procs []*os.Process
+	// If signal is SIGKILL try manager.Kill()
+	// in order to leverage "cgroup.kill" instead
+	// of iterating over each process. "cgroup.kill"
+	// was added in Linux kernel 5.14 onwards.
+	if s == unix.SIGKILL && m.Kill() == nil {
+		return nil
+	}
+	// Fallback to slow method
 	if err := m.Freeze(configs.Frozen); err != nil {
 		logrus.Warn(err)
 	}
+
 	pids, err := m.GetAllPids()
 	if err != nil {
 		if err := m.Freeze(configs.Thawed); err != nil {