docker mount cgroupv2失败研究
cgroup1
[root@901c18ae8c00 cgroup]# uname -r
5.8.0-050800rc1-generic
[root@901c18ae8c00 cgroup]# ll
total 0
drwxr-xr-x 2 root root 0 Jan 15 03:28 blkio
lrwxrwxrwx 1 root root 11 Jan 15 03:28 cpu -> cpu,cpuacct
drwxr-xr-x 2 root root 0 Jan 15 03:28 cpu,cpuacct
lrwxrwxrwx 1 root root 11 Jan 15 03:28 cpuacct -> cpu,cpuacct
drwxr-xr-x 2 root root 0 Jan 15 03:28 cpuset
drwxr-xr-x 2 root root 0 Jan 15 03:28 devices
drwxr-xr-x 2 root root 0 Jan 15 03:28 freezer
drwxr-xr-x 2 root root 0 Jan 15 03:28 hugetlb
drwxr-xr-x 2 root root 0 Jan 15 03:28 memory
lrwxrwxrwx 1 root root 16 Jan 15 03:28 net_cls -> net_cls,net_prio
drwxr-xr-x 2 root root 0 Jan 15 03:28 net_cls,net_prio
lrwxrwxrwx 1 root root 16 Jan 15 03:28 net_prio -> net_cls,net_prio
drwxr-xr-x 2 root root 0 Jan 15 03:28 perf_event
drwxr-xr-x 2 root root 0 Jan 15 03:28 pids
dr-xr-xr-x 2 root root 0 Aug 8 06:36 rdma
drwxr-xr-x 2 root root 0 Jan 15 03:28 systemd
[root@8e03aaeed1b2 /]# mount | grep cgroup
tmpfs on /sys/fs/cgroup type tmpfs (rw,nosuid,nodev,noexec,relatime,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,name=systemd)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls,net_prio)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct)
cgroup on /sys/fs/cgroup/rdma type cgroup (rw,nosuid,nodev,noexec,relatime,rdma)
cgroup on /sys/fs/cgroup/hugetlb type cgroup (rw,nosuid,nodev,noexec,relatime,hugetlb)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/pids type cgroup (rw,nosuid,nodev,noexec,relatime,pids)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,perf_event)
cgroup2
root@ubuntu:/sys/fs/cgroup# uname -a
Linux ubuntu 5.15.0-91-generic #101-Ubuntu SMP Tue Nov 14 13:30:08 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
root@node2:/tmp# mount | grep cgroup
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)
root@ubuntu:/sys/fs/cgroup# ll
total 0
dr-xr-xr-x 13 root root 0 Jan 8 01:17 ./
drwxr-xr-x 9 root root 0 Jan 8 01:16 ../
-r--r--r-- 1 root root 0 Jan 8 01:17 cgroup.controllers
-rw-r--r-- 1 root root 0 Jan 8 01:17 cgroup.max.depth
-rw-r--r-- 1 root root 0 Jan 8 01:17 cgroup.max.descendants
-rw-r--r-- 1 root root 0 Jan 8 01:17 cgroup.procs
-r--r--r-- 1 root root 0 Jan 8 01:17 cgroup.stat
-rw-r--r-- 1 root root 0 Jan 12 06:31 cgroup.subtree_control
-rw-r--r-- 1 root root 0 Jan 8 01:17 cgroup.threads
-rw-r--r-- 1 root root 0 Jan 8 01:17 cpu.pressure
-r--r--r-- 1 root root 0 Jan 8 01:17 cpu.stat
-r--r--r-- 1 root root 0 Jan 8 01:17 cpuset.cpus.effective
-r--r--r-- 1 root root 0 Jan 8 01:17 cpuset.mems.effective
drwxr-xr-x 2 root root 0 Jan 8 01:17 dev-hugepages.mount/
drwxr-xr-x 2 root root 0 Jan 8 01:17 dev-mqueue.mount/
drwxr-xr-x 2 root root 0 Jan 8 01:17 init.scope/
-rw-r--r-- 1 root root 0 Jan 8 01:17 io.cost.model
-rw-r--r-- 1 root root 0 Jan 8 01:17 io.cost.qos
-rw-r--r-- 1 root root 0 Jan 8 01:17 io.pressure
-rw-r--r-- 1 root root 0 Jan 8 01:17 io.prio.class
-r--r--r-- 1 root root 0 Jan 8 01:17 io.stat
drwxr-xr-x 4 root root 0 Jan 8 01:17 kubepods.slice/
-r--r--r-- 1 root root 0 Jan 8 01:17 memory.numa_stat
-rw-r--r-- 1 root root 0 Jan 8 01:17 memory.pressure
-r--r--r-- 1 root root 0 Jan 8 01:17 memory.stat
-r--r--r-- 1 root root 0 Jan 8 01:17 misc.capacity
drwxr-xr-x 2 root root 0 Jan 8 01:17 proc-sys-fs-binfmt_misc.mount/
drwxr-xr-x 2 root root 0 Jan 8 01:17 sys-fs-fuse-connections.mount/
drwxr-xr-x 2 root root 0 Jan 8 01:17 sys-kernel-config.mount/
drwxr-xr-x 2 root root 0 Jan 8 01:17 sys-kernel-debug.mount/
drwxr-xr-x 2 root root 0 Jan 8 01:17 sys-kernel-tracing.mount/
drwxr-xr-x 27 root root 0 Jan 15 04:55 system.slice/
drwxr-xr-x 3 root root 0 Jan 8 01:18 user.slice/
最后在一偏文章找到了Mount方法，参考文章结尾的
# mount -t cgroup2 none $MOUNT_POINT
但是看起来不能利用
Cgroup v2 release notification
Cgroups v2 provides a new mechanism for obtaining notification
when a cgroup becomes empty. The cgroups v1 release_agent and
notify_on_release files are removed, and replaced by the
populated key in the cgroup.events file. This key either has the
value 0, meaning that the cgroup (and its descendants) contain no
(nonzombie) member processes, or 1, meaning that the cgroup (or
one of its descendants) contains member processes.
The cgroups v2 release-notification mechanism offers the
following advantages over the cgroups v1 release_agent mechanism:
• It allows for cheaper notification, since a single process can
monitor multiple cgroup.events files (using the techniques
described earlier). By contrast, the cgroups v1 mechanism
requires the expense of creating a process for each
notification.
• Notification for different cgroup subhierarchies can be
delegated to different processes. By contrast, the cgroups v1
mechanism allows only one release agent for an entire
hierarchy.
参考
Container security fundamentals part 4: Cgroups | Datadog Security Labs
https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html