cgroups v2 support (apply from v1/OCI spec)

Support execution on a cgroups v2 unified hierarchy system, by using
the `containerd/cgroups/v2` translation of the
`opencontainers/runtime-spec` `LinuxResources` structure (which we use
for cgroups config toml files) into v2 Resources. Device limits are
implemented with the eBPF translation.

This will mean that existing v1 / OCI style cgroups configuration
files can be used on a system configured for the unified hierarchy
without an ugly failure. Also fixes failures with the `oci` commands
on these systems.

Note that we don't yet support the Unified attribute from
LinuxResources, which is a free-form map[string][string] for
expressing cgroups v2 configuration natively.

Fixes apptainer#60

CHANGELOG.md

@@ -82,6 +82,8 @@
 
 - Fix regression when files `source`d from `%environment` contain `\` escaped
   shell builtins (fixes issue with `source` of conda profile.d script).
+- The `oci` commands will operate on systems that use the v2 unified cgroups
+  hierarchy.
 - `singularity delete` will use the correct library service when the hostname
   is specified in the `library://` URI.
 - `singularity build` will use the correct library service when the hostname

go.sum

@@ -168,6 +168,7 @@ github.com/cilium/ebpf v0.0.0-20200110133405-4032b1d8aae3/go.mod h1:MA5e5Lr8slmE
 github.com/cilium/ebpf v0.0.0-20200702112145-1c8d4c9ef775/go.mod h1:7cR51M8ViRLIdUjrmSXlK9pkrsDlLHbO8jiB8X8JnOc=
 github.com/cilium/ebpf v0.2.0/go.mod h1:To2CFviqOWL/M0gIMsvSMlqe7em/l1ALkX1PyjrX2Qs=
 github.com/cilium/ebpf v0.4.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
+github.com/cilium/ebpf v0.6.2 h1:iHsfF/t4aW4heW2YKfeHrVPGdtYTL4C4KocpM8KTSnI=
 github.com/cilium/ebpf v0.6.2/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
@@ -369,6 +370,7 @@ github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYF
 github.com/felixge/httpsnoop v1.0.1 h1:lvB5Jl89CsZtGIWuTcDM1E/vkVs49/Ml7JJe07l8SPQ=
 github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
+github.com/frankban/quicktest v1.11.3 h1:8sXhOn0uLys67V8EsXLc6eszDs8VXWxL3iRvebPhedY=
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
 github.com/frankban/quicktest v1.13.1 h1:xVm/f9seEhZFL9+n5kv5XLrGwy6elc4V9v/XFY2vmd8=
 github.com/frankban/quicktest v1.13.1/go.mod h1:NeW+ay9A/U67EYXNFA1nPE8e/tnQv/09mUdL/ijj8og=

internal/app/singularity/oci_update_linux.go

@@ -1,4 +1,4 @@
-// Copyright (c) 2018-2019, Sylabs Inc. All rights reserved.
+// Copyright (c) 2018-2021, Sylabs Inc. All rights reserved.
 // This software is licensed under a 3-clause BSD license. Please consult the
 // LICENSE.md file distributed with the sources of this project regarding your
 // rights to use or distribute this software.
@@ -35,7 +35,10 @@ func OciUpdate(containerID string, args *OciArgs) error {
 	}
 
 	resources := &specs.LinuxResources{}
-	manager := &cgroups.Manager{Pid: state.State.Pid}
+	manager, err := cgroups.GetManagerFromPid(state.State.Pid)
+	if err != nil {
+		return fmt.Errorf("failed to get cgroups manager: %v", err)
+	}
 
 	if args.FromFile == "-" {
 		reader = os.Stdin