Warn if cgroups-v1

Podman v5 will not support cgroups-v1. This commit will print a warning
if it detects a cgroups-v1 system. The warning can be hidden by setting
envvar `PODMAN_CGROUPSV1_WARNING`.

This warning is patched out for RHEL 9 builds as cgroups-v1 will still
be supported on RHEL 9 systems.

Resolves: https://issues.redhat.com/browse/RUN-1957

[NO NEW TESTS NEEDED]

Co-authored-by: Ed Santiago <[email protected]>
Co-authored-by: Sascha Grunert <[email protected]>
Co-authored-by: Giuseppe Scrivano <[email protected]>
Signed-off-by: Lokesh Mandvekar <[email protected]>

Author: 4 people

.cirrus.yml

@@ -123,6 +123,9 @@ build_task:
               DISTRO_NV: ${DEBIAN_NAME}
               VM_IMAGE_NAME: ${DEBIAN_CACHE_IMAGE_NAME}
               CI_DESIRED_RUNTIME: runc
+              CI_DESIRED_NETWORK: netavark
+              # Ignore cgroups-v1 warnings on debian
+              PODMAN_IGNORE_CGROUPSV1_WARNING: true
     env:
         TEST_FLAVOR: build
     # NOTE: The default way Cirrus-CI clones is *NOT* compatible with

contrib/cirrus/lib.sh

@@ -95,7 +95,7 @@ EPOCH_TEST_COMMIT="$CIRRUS_BASE_SHA"
 # contexts, such as host->container or root->rootless user
 #
 # List of envariables which must be EXACT matches
-PASSTHROUGH_ENV_EXACT='CGROUP_MANAGER|DEST_BRANCH|DISTRO_NV|GOCACHE|GOPATH|GOSRC|OCI_RUNTIME|ROOTLESS_USER|SCRIPT_BASE|SKIP_USERNS|EC2_INST_TYPE|PODMAN_DB|STORAGE_FS'
+PASSTHROUGH_ENV_EXACT='CGROUP_MANAGER|DEST_BRANCH|DISTRO_NV|GOCACHE|GOPATH|GOSRC|NETWORK_BACKEND|OCI_RUNTIME|PODMAN_IGNORE_CGROUPSV1_WARNING|ROOTLESS_USER|SCRIPT_BASE|SKIP_USERNS|EC2_INST_TYPE|PODMAN_DB|STORAGE_FS'
 
 # List of envariable patterns which must match AT THE BEGINNING of the name.
 PASSTHROUGH_ENV_ATSTART='CI|LANG|LC_|TEST'

libpod/runtime.go

@@ -393,6 +393,15 @@ func makeRuntime(runtime *Runtime) (retErr error) {
 	runtime.mergeDBConfig(dbConfig)
 
 	unified, _ := cgroups.IsCgroup2UnifiedMode()
+	// DELETE ON RHEL9
+	if !unified {
+		_, ok := os.LookupEnv("PODMAN_IGNORE_CGROUPSV1_WARNING")
+		if !ok {
+			logrus.Warn("Using cgroups-v1 which is deprecated in favor of cgroups-v2 with Podman v5 and will be removed in a future version. Set environment variable `PODMAN_IGNORE_CGROUPSV1_WARNING` to hide this warning.")
+		}
+	}
+	// DELETE ON RHEL9
+
 	if unified && rootless.IsRootless() && !systemd.IsSystemdSessionValid(rootless.GetRootlessUID()) {
 		// If user is rootless and XDG_RUNTIME_DIR is found, podman will not proceed with /tmp directory
 		// it will try to use existing XDG_RUNTIME_DIR

rpm/podman.spec

@@ -211,6 +211,11 @@ when `%{_bindir}/%{name}sh` is set as a login shell or set as os.Args[0].
 %autosetup -Sgit -n %{name}-%{version_no_tilde}
 sed -i 's;@@PODMAN@@\;$(BINDIR);@@PODMAN@@\;%{_bindir};' Makefile
 
+# cgroups-v1 is supported on rhel9
+%if 0%{?rhel} == 9
+sed -i '/DELETE ON RHEL9/,/DELETE ON RHEL9/d' libpod/runtime.go
+%endif
+
 # These changes are only meant for copr builds
 %if %{defined copr_build}
 # podman --version should show short sha

test/system/120-load.bats

@@ -88,6 +88,11 @@ verify_iid_and_name() {
         skip "impossible due to pitfalls in our SSH implementation"
     fi
 
+    # See https://github.com/containers/podman/pull/21431
+    if [[ -n "$PODMAN_IGNORE_CGROUPSV1_WARNING" ]]; then
+        skip "impossible to test due to pitfalls in our SSH implementation"
+    fi
+
     # The testing is the same whether we're root or rootless; all that
     # differs is the destination (not-me) username.
     if is_rootless; then

test/system/252-quadlet.bats

@@ -153,6 +153,11 @@ Notify=yes
 LogDriver=passthrough
 EOF
 
+    # FIXME: Temporary until podman fully removes cgroupsv1 support; see #21431
+    if [[ -n "$PODMAN_IGNORE_CGROUPSV1_WARNING" ]]; then
+        skip "Way too complicated to test under cgroupsv1, and not worth the effort"
+    fi
+
     run_quadlet "$quadlet_file"
     service_setup $QUADLET_SERVICE_NAME