docker: docker run --cpuset is not having any effect

[bugproxy]

---Problem Description---
docker: cpuset resouce allocaton on a container shows/lists all CPU of VM host

---uname output---
root@8a2d293ba30d:/sys# uname -a Linux 8a2d293ba30d 3.19.0-7-generic #7-Ubuntu SMP Fri Feb 27 00:26:30 UTC 2015 ppc64le ppc64le ppc64le GNU/Linux

Machine Type = Power 8 / PowerKVM

---Steps to Reproduce---
1 - Install docker 1.4 developer build on PowerKVM Ubuntu 15.04 LE geust
ftp://ftp.unicamp.br/pub/linuxpatch/docker-ppc64/ubuntu/14_10/docker.io-1.4.1-dev_ppc64el.deb

2 - Create vivid image using debootstrap

3 - Run a container using below command with cpuset=6,7

root@dockerbase:~# docker run -it --cpuset=6,7 vivid-cpuset-stress /bin/bash

4 - Inside container check for : grep processor /proc/cpuinfo
root@06b22766d612:/# grep processor /proc/cpuinfo
processor : 0
processor : 1
processor : 2
processor : 3
processor : 4
processor : 5
processor : 6
processor : 7
processor : 8
processor : 9
processor : 10
processor : 11
processor : 12
processor : 13
processor : 14
processor : 15
root@06b22766d612:/#

It does list all CPUs of guest VM aka host in this case instead expected 6,7 cpu to be bound to this container.

At host end "cpuset" :
root@dockerbase:~# cat /sys/fs/cgroup/cpuset/docker/06b22766d61244fc5964d2a11bb0972d05ad72bb5899b6f55663c603bf5d6cba/cpuset.cpus
6-7

Nish, AFAIK, effective cpus was relevant only for unified hierarchy... they used to set effective_cpus= cpuset.cpus .. but will investigate more on this..

Uh, I think this got fixed upstream, can we check? Maybe build an Ubuntu test kernel (this should get auto-pulled in in some future build, due to -stable):

79063bffc81f82689bd90e16da1b49408f3bf095 ("cpuset: fix a warning when clearing configured masks in old hierarchy").

-Nish

I did some more investigation and as Nish pointed there were some bugs that got fixed in upstream.

Root cause: cgroup.clone_children was not handled properly. the bug appears when we have
cgroup.clone_children=1

if we set 0 to clone_children it should work properly.
so better if we backport below patch (if not already to fix the current problem)

1. 790317e1b266c776765a4bdcedefea706ff0fada: cpuset: initialize effective masks when clone_children is enabled
2. 79063bffc81f82689bd90e16da1b49408f3bf095 ("cpuset: fix a warning when clearing configured masks in old hierarchy"). (Nish pointed this patch)

Canonical,

both the above patches are targetted for 3.19-stable (in fact 3.17+), but given the possible miss on schedule between the upstream 3.19-stable releases and 15.04 kernel freeze, can we please manually include them until they are present in -stable? Without the changes, the cpuset cgroups are rather broken.

-Nish

[bugproxy (bugproxy)]

------- Comment (attachment only) From <email address hidden> 2015-03-24 01:04 EDT-------

[bugproxy (bugproxy)]

------- Comment (attachment only) From <email address hidden> 2015-03-24 01:06 EDT-------

[Chris J Arges (arges)]

Spoke with Leann, these should easily make the Vivid release kernel. I'll track this until these patches are present.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2015-04-06 16:25 EDT-------
Update from Raghu:

FYI .. linux-image-3.19.0-12-generic should be carrying the fix. I tested the kernel and it is working.

root@ragbase:~# uname -a
Linux ragbase 3.19.0-12-generic #12-Ubuntu SMP Fri Apr 3 04:03:54 UTC 2015 ppc64le ppc64le ppc64le GNU/Linux
root@ragbase:~# docker run --cpuset=0,1 -itd ubuntu:vivid /bin/bash
a4d1f2951829fe5d201010d944009ecbfe388305ecf02d56a0d64f42cf227ba2
root@ragbase:~# docker run --cpuset=0,1 -itd ubuntu:vivid /bin/bash^C
root@ragbase:~# docker attach a4d1f2951829fe5d201010d944009ecbfe388305ecf02d56a0d64f42cf227ba2

root@ragbase:~# cat /proc/self/status |grep Cpus
Cpus_allowed: f
Cpus_allowed_list: 0-3

[Benjamin Burns (benjamin-c-burns)]

This issue has either regressed, or it has not made it to 4.2.0-25-generic on Ubuntu 15.10.

user@host:~$ uname -a
Linux bburns-workstation 4.2.0-25-generic #30-Ubuntu SMP Mon Jan 18 12:31:50 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

user@host:~$ cat /etc/issue
Ubuntu 15.10 \n \l

user@host:~$ docker run -it --cpuset-cpus=0 centos:centos7 grep processor /proc/cpuinfo
processor : 0
processor : 1
processor : 2
processor : 3

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2016-03-02 01:41 EDT-------
The upstream fix should have fixed this issue:

docker container is bound to some cpuset and that is not honoured by the system. This can be verified by checking the corresponding cpuset cgroup of docker container in the host.

The upstream fix will not fix this issue:

/proc/cpuinfo showing what is the container affinity. /proc/cpuinfo shows all the cpus available in the system but it does not have anything to do with affinity of container.

Hope this is clear