hakoniwa 1.7.0

Process isolation for Linux using namespaces, resource limits, cgroups, landlock and seccomp.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

use libcgroups::common::{
    AnyCgroupManager, CgroupConfig, CgroupManager, ControllerOpt as CgroupControllerOpt,
    create_cgroup_manager,
};
use nix::unistd::Pid;
use std::path::PathBuf;

use super::{Resources, error::*};

pub(crate) struct Manager {
    manager: AnyCgroupManager,
}

impl Manager {
    pub(crate) fn new(id: &str) -> Result<Self> {
        let manager = create_cgroup_manager(CgroupConfig {
            cgroup_path: PathBuf::from(format!("hakoniwa.slice:hakoniwa:{id}")),
            systemd_cgroup: true,
            container_name: id.to_string(),
        })?;
        Ok(Self { manager })
    }

    pub(crate) fn apply(&self, task: Pid, resources: &Resources) -> Result<()> {
        let opts = CgroupControllerOpt {
            resources: &resources.build()?,
            disable_oom_killer: false,
            oom_score_adj: None,
            freezer_state: None,
        };
        self.manager.add_task(task)?;
        self.manager.apply(&opts)?;
        Ok(())
    }
}

impl Drop for Manager {
    fn drop(&mut self) {
        _ = self.manager.remove();
    }
}