Add cgroupV2 CPUQuotaPeriodUSec support

Signed-off-by: Austin Vazquez <[email protected]>

Author: austinvazquez

cgroup2/cpu.go

@@ -39,6 +39,14 @@ type CPU struct {
 	Mems   string
 }
 
+const (
+	// Copied from https://github.com/opencontainers/cgroups/blob/9657f5a18b8d60a0f39fbb34d0cb7771e28e6278/systemd/common.go#L22-L25
+	// Default kernel value for cpu quota period is 100000 us (100 ms), same for v1 and v2.
+	// v1: https://www.kernel.org/doc/html/latest/scheduler/sched-bwc.html and
+	// v2: https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html
+	defCPUQuotaPeriod = uint64(100000)
+)
+
 func (c CPUMax) extractQuotaAndPeriod() (int64, uint64) {
 	var (
 		quota  int64
@@ -51,6 +59,10 @@ func (c CPUMax) extractQuotaAndPeriod() (int64, uint64) {
 		quota, _ = strconv.ParseInt(values[0], 10, 64)
 	}
 	period, _ = strconv.ParseUint(values[1], 10, 64)
+	if period == 0 {
+		// assume the default
+		period = defCPUQuotaPeriod
+	}
 	return quota, period
 }
 

cgroup2/manager.go

@@ -27,6 +27,7 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/containerd/cgroups/v3/cgroup2/stats"
@@ -47,7 +48,12 @@ const (
 	defaultSlice       = "system.slice"
 )
 
-var canDelegate bool
+var (
+	canDelegate bool
+
+	versionOnce sync.Once
+	version     int
+)
 
 type Event struct {
 	Low     uint64
@@ -876,6 +882,16 @@ func NewSystemd(slice, group string, pid int, resources *Resources) (*Manager, e
 
 	if resources.CPU != nil && resources.CPU.Max != "" {
 		quota, period := resources.CPU.Max.extractQuotaAndPeriod()
+		if period != 0 {
+			// systemd only supports CPUQuotaPeriodUSec since v242
+			if sdVer := systemdVersion(conn); sdVer >= 242 {
+				properties = append(properties, newSystemdProperty("CPUQuotaPeriodUSec", period))
+			} else {
+				log.G(context.TODO()).Debugf("systemd v%d is too old to support CPUQuotaPeriodSec "+
+					" (setting will still be applied to cgroupfs)", sdVer)
+			}
+		}
+
 		// cpu.cfs_quota_us and cpu.cfs_period_us are controlled by systemd.
 		// corresponds to USEC_INFINITY in systemd
 		// if USEC_INFINITY is provided, CPUQuota is left unbound by systemd
@@ -915,6 +931,41 @@ func NewSystemd(slice, group string, pid int, resources *Resources) (*Manager, e
 	}, nil
 }
 
+// Adapted from https://github.com/opencontainers/cgroups/blob/9657f5a18b8d60a0f39fbb34d0cb7771e28e6278/systemd/common.go#L245-L281
+func systemdVersion(conn *systemdDbus.Conn) int {
+	versionOnce.Do(func() {
+		version = -1
+		verStr, err := conn.GetManagerProperty("Version")
+		if err == nil {
+			version, err = systemdVersionAtoi(verStr)
+		}
+
+		if err != nil {
+			log.G(context.TODO()).WithError(err).Error("Unable to get systemd version")
+		}
+	})
+
+	return version
+}
+
+func systemdVersionAtoi(str string) (int, error) {
+	// Unconditionally remove the leading prefix ("v).
+	str = strings.TrimLeft(str, `"v`)
+	// Match on the first integer we can grab.
+	for i := range len(str) {
+		if str[i] < '0' || str[i] > '9' {
+			// First non-digit: cut the tail.
+			str = str[:i]
+			break
+		}
+	}
+	ver, err := strconv.Atoi(str)
+	if err != nil {
+		return -1, fmt.Errorf("can't parse version: %w", err)
+	}
+	return ver, nil
+}
+
 func startUnit(conn *systemdDbus.Conn, group string, properties []systemdDbus.Property, ignoreExists bool) error {
 	ctx := context.TODO()