validation: add linux resource check

Signed-off-by: Ma Shimiao <[email protected]>

Author: Ma Shimiao

cmd/ocitools/validate.go

@@ -361,6 +361,11 @@ func checkLinux(spec rspec.Spec, rootfs string, hostCheck bool) (msgs []string)
 		}
 	}
 
+	if spec.Linux.Resources != nil {
+		ms := checkLinuxResources(*spec.Linux.Resources, hostCheck)
+		msgs = append(msgs, ms...)
+	}
+
 	if spec.Linux.Seccomp != nil {
 		ms := checkSeccomp(*spec.Linux.Seccomp)
 		msgs = append(msgs, ms...)
@@ -381,6 +386,47 @@ func checkLinux(spec rspec.Spec, rootfs string, hostCheck bool) (msgs []string)
 	return
 }
 
+func checkLinuxResources(r rspec.Resources, hostCheck bool) (msgs []string) {
+	logrus.Debugf("check linux resources")
+
+	if r.OOMScoreAdj != nil && (int(*r.OOMScoreAdj) < -1000 || int(*r.OOMScoreAdj) > 1000) {
+		msgs = append(msgs, fmt.Sprintf("OOMScoreAdj range is from -1000 to 1000"))
+	}
+	if r.Memory != nil {
+		if r.Memory.Swappiness != nil && uint64(*r.Memory.Swappiness) > 100 {
+			msgs = append(msgs, fmt.Sprintf("Memory swappiness range is 0-100"))
+		}
+		if r.Memory.Limit != nil && r.Memory.Swap != nil && uint64(*r.Memory.Limit) > uint64(*r.Memory.Swap) {
+			msgs = append(msgs, fmt.Sprintf("Minimum memoryswap should be larger than memory limit"))
+		}
+		if r.Memory.Limit != nil && r.Memory.Reservation != nil && uint64(*r.Memory.Reservation) > uint64(*r.Memory.Limit) {
+			msgs = append(msgs, fmt.Sprintf("Minimum memory limit should be larger than memory reservation"))
+		}
+	}
+	if r.CPU != nil {
+		if r.CPU.Quota != nil && uint64(*r.CPU.Quota) < 1000 {
+			msgs = append(msgs, fmt.Sprintf("Cpu cfs quota shoud not be less than 1ms"))
+		}
+		if r.CPU.Period != nil && (uint64(*r.CPU.Period) < 1000 || uint64(*r.CPU.Period) > 1000000) {
+			msgs = append(msgs, fmt.Sprintf("Cpu cfs period range is from 1ms to 1s"))
+		}
+		if hostCheck {
+			// todo host-specific checks
+			// mems, cpus
+		}
+	}
+	if r.BlockIO != nil {
+		if r.BlockIO.Weight != nil && (uint64(*r.BlockIO.Weight) < 10 || uint64(*r.BlockIO.Weight) > 1000) {
+			msgs = append(msgs, fmt.Sprintf("BlockIO weight range is from 10 to 1000"))
+		}
+		if r.BlockIO.LeafWeight != nil && (uint64(*r.BlockIO.LeafWeight) < 10 || uint64(*r.BlockIO.LeafWeight) > 1000) {
+			msgs = append(msgs, fmt.Sprintf("BlockIO leaf weight range is from 10 to 1000"))
+		}
+	}
+
+	return
+}
+
 func checkSeccomp(s rspec.Seccomp) (msgs []string) {
 	logrus.Debugf("check seccomp")