Need an interface to assign other processes to cgroups
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
snapd |
Incomplete
|
Medium
|
Unassigned |
Bug Description
Related: https:/
While working on a snap for kubelet, we saw the following error:
container_
After looking at the code it appears that it falls back to using `pidof` to find the docker PID. So this may not be a problem on its own.
However, it looks like it's doing this so it can assign the docker process to a cgroup. See https:/
So we will need a way to give kubelet permission to assign other processes to cgroups. I believe it wants to assign the containerd process as well, maybe others.
Thank you for filing a bug. The docker pid issue could be allowed by adding the following rule to dockerConnected PlugAppArmor in the docker interface:
/{,var/ }run/docker. pid r,
However, assigning to a cgroup is not currently handled by any interfaces. Do you have a simple reproducer to demonstrate the functionality you require?