Merge pull request #1158 from kolyshkin/check-before-update

config-linux: add memory.checkBeforeUpdate

Author: kolyshkin

config-linux.md

@@ -336,6 +336,11 @@ The following properties do not specify memory limits, but are covered by the `m
     To disable it, specify a value of `true`.
 * **`useHierarchy`** *(bool, OPTIONAL)* - enables or disables hierarchical memory accounting.
     If enabled (`true`), child cgroups will share the memory limits of this cgroup.
+* **`checkBeforeUpdate`** *(bool, OPTIONAL)* - enables container memory usage check before setting a new limit.
+    If enabled (`true`), runtime MAY check if a new memory limit is lower than the current usage, and MUST
+    reject the new limit. Practically, when cgroup v1 is used, the kernel rejects the limit lower than the
+    current usage, and when cgroup v2 is used, an OOM killer is invoked. This setting can be used on
+    cgroup v2 to mimic the cgroup v1 behavior.
 
 #### Example
 

schema/config-linux.json

@@ -169,6 +169,9 @@
                             },
                             "useHierarchy": {
                                 "type": "boolean"
+                            },
+                            "checkBeforeUpdate": {
+                                "type": "boolean"
                             }
                         }
                     },

schema/test/config/good/spec-example.json

@@ -270,7 +270,8 @@
                 "kernelTCP": -1,
                 "swappiness": 0,
                 "disableOOMKiller": false,
-                "useHierarchy": false
+                "useHierarchy": false,
+                "checkBeforeUpdate": false
             },
             "cpu": {
                 "shares": 1024,

specs-go/config.go

@@ -319,6 +319,10 @@ type LinuxMemory struct {
 	DisableOOMKiller *bool `json:"disableOOMKiller,omitempty"`
 	// Enables hierarchical memory accounting
 	UseHierarchy *bool `json:"useHierarchy,omitempty"`
+	// CheckBeforeUpdate enables checking if a new memory limit is lower
+	// than the current usage during update, and if so, rejecting the new
+	// limit.
+	CheckBeforeUpdate *bool `json:"checkBeforeUpdate,omitempty"`
 }
 
 // LinuxCPU for Linux cgroup 'cpu' resource management