beldpro-ci

# try to run more than the amount of PIDs that are allowed
# - we should see `fork()` syscall erroring:
docker run --pids-limit 100 cirocosta/stress pid  -n 300

Starting to spawn 300 blocking children
Error:
  
  Fork returned -1.

  File: src/pid.c 

beldpro-ci

docker run -d --name nginx --pids-limit 100 nginx:alpine
d9bd65d2e98ec...

find  /sys/fs/cgroup/ -name "d9bd65d2e98*"
/sys/fs/cgroup/cpu,cpuacct/docker/d9bd65d2e...
/sys/fs/cgroup/cpuset/docker/d9bd65d2e98ec4...
/sys/fs/cgroup/devices/docker/d9bd65d2e98ec...
/sys/fs/cgroup/pids/docker/d9bd65d2e98ec418...
/sys/fs/cgroup/freezer/docker/d9bd65d2e98ec...
/sys/fs/cgroup/perf_event/docker/d9bd65d2e9...

beldpro-ci

# let's get the ID of the container. Docker uses that ID
# to name things in the host to we can probably use it to
# find the cgroup created for the container
# under the parent docker cgroup
docker ps
CONTAINER ID        IMAGE               COMMAND       
a730051832e7        cirocosta/stress    "pid -n 300"  

 # Having the prefix in hands, let's search for it under the
 # mountpoint for cgroups in our system

beldpro-ci

# Run a container that will spawn 300 processes.
docker run cirocosta/stress pid  -n 300
Starting to spawn 300 blocking children
[1] Waiting for SIGINT

# Open another window and see that we have 300
# PIDS
docker stats
CONTAINER      …   MEM USAGE / LIMIT          PIDS
a730051832     …   21.02MiB / 1.951GiB     300

beldpro-ci

docker-runc exec -t ece80(...)bc19 sh
/mnt
└── cloudstor
    └── max
        └── my-volume-1  # the volume I created!
            └── my-file

beldpro-ci

docker plugin inspect <plugin-id>
...
            "PidHost": false,
            "PropagatedMount": "/mnt",   # this is interesting
            "User": {},
...

beldpro-ci

# docker plugin ls --no-trunc
ID                   NAME                DESCR...
ece80624f9b17(...)   cloudstor:aws       cloud...


cat /run/docker/libcontainerd/ece806249b1(...)/config.json | jq

{
  "ociVersion": "1.0.0-rc2-dev",
  "platform": {

beldpro-ci

beldpro-ci

docker run \
  --rm \           # remove the container after we run it
  -it \            # add a tty and start it w/ interactive mode
  --privileged \   # grant all permissions to the container
  --pid=host \     # share the host PID space
  justincormack/nsenter1 \  # magic 🎩
  /bin/sh          # start /bin/sh

beldpro-ci

docker4x/shell-aws:17.05.0-ce-aws2         0.0.0.0:22->22/tcp              shell-aws
docker4x/l4controller-aws:17.05.0-ce-aws2                                  l4controller-aws
docker4x/meta-aws:17.05.0-ce-aws2          <internal-ip>:9024->8080/tcp    meta-aws
docker4x/guide-aws:17.05.0-ce-aws2                                         guide-aws