Virtualized /proc/cpuinfo via LXCFS not working

[PhilippWendler]

If I start something with core limit, e.g., runexec --cores 0 ... and have LXCFS installed, I expect /proc/cpuinfo to only contain the allowed cores. However, on my system I get the full list of cores. This should be investigated and fixed if possible.

findmnt does show our mounts of LXCFS files over /proc, and /var/lib/lxcfs/proc/cpuinfo also shows the full amount of cores, so the problem is not related to our mounts.

Potentially lxcfs needs to be started in a different cgroup or so.

[PhilippWendler]

What happens is the following: When LXCFS receives a read request to the virtualized /proc/cpuinfo, it needs to find out the cgroup from which it should get the core limits that apply. I assumed that it uses the cgroup of the process that reads cpuinfo, but in fact it uses the cgroup of the init process of the PID namespace that the reading process is in. In BenchExec's case, the init process of the container is not in the same cgroup as the processes in the container, because we do not want to measure the resource consumption of the init process. So our init process has no core limit, which is what LXCFS reports.

In order to fix this we need to put the init process into a cgroup that has the same core limit as the cgroup of the container, but is still outside the cgroup that we use for measurements.

[PhilippWendler]

The behavior of LXCFS is actually the same no matter what cgroup version we have.

However, only the files that virtualize the (potentially limited) system resources like /proc/cpuinfo and /proc/meminfo where affected: The virtualization of /proc/uptime was always working (and tested) because it does not rely on the cgroup of the init process.

I tried to find out when LXCFS started to use the cgroup of the init process of the container, but was not successful. It seems that it has done so basically forever, which would mean that virtualization of /proc/cpuinfo was never working inside BenchExec containers. Luckily we at least never explicitly promised this, we only recommended LXCFS to our users because of virtualized /proc/uptime. But users who were already familiar with the feature set of LXCFS could have expected to have a virtualized /proc/cpuinfo in BenchExec nevertheless.