Need an interface to assign other processes to cgroups

[George Kraft]

Related: https://bugs.launchpad.net/snapd/+bug/1664638

While working on a snap for kubelet, we saw the following error:

container_manager_linux.go:625] error opening pid file /var/run/docker.pid: open /var/run/docker.pid: permission denied

After looking at the code it appears that it falls back to using `pidof` to find the docker PID. So this may not be a problem on its own.

However, it looks like it's doing this so it can assign the docker process to a cgroup. See https://github.com/kubernetes/kubernetes/blob/2541c16692c7777b0aeda8124f7895855b1b9232/pkg/kubelet/cm/container_manager_linux.go#L635-L692

So we will need a way to give kubelet permission to assign other processes to cgroups. I believe it wants to assign the containerd process as well, maybe others.

[Jamie Strandboge (jdstrand)]

Thank you for filing a bug. The docker pid issue could be allowed by adding the following rule to dockerConnectedPlugAppArmor in the docker interface:

/{,var/}run/docker.pid r,

However, assigning to a cgroup is not currently handled by any interfaces. Do you have a simple reproducer to demonstrate the functionality you require?

[George Kraft (cynerva)]

Thanks Jamie.

The script in https://bugs.launchpad.net/snapd/+bug/1664638 should be able to reproduce this. I've attached it here for convenience as well.

[Jamie Strandboge (jdstrand)]

I took a look at this and strongly feel we need a separate kubernetes interface rather than something specific for managing cgroups. I'm going to close this bug as a duplicate of bug #1664638 and then continue the conversation in bug #1664638.