Merge pull request containerd#228 from jseba/delete_empty_cgroups_only

Check that cgroup is empty before deleting

cgroup.go

@@ -84,7 +84,7 @@ func Load(hierarchy Hierarchy, path Path, opts ...InitOpts) (Cgroup, error) {
 	for _, s := range pathers(subsystems) {
 		p, err := path(s.Name())
 		if err != nil {
-			if  errors.Is(err, os.ErrNotExist) {
+			if errors.Is(err, os.ErrNotExist) {
 				return nil, ErrCgroupDeleted
 			}
 			if err == ErrControllerNotActive {
@@ -228,6 +228,15 @@ func (c *cgroup) Delete() error {
 	}
 	var errs []string
 	for _, s := range c.subsystems {
+		// kernel prevents cgroups with running process from being removed, check the tree is empty
+		procs, err := c.processes(s.Name(), true, cgroupProcs)
+		if err != nil {
+			return err
+		}
+		if len(procs) > 0 {
+			errs = append(errs, fmt.Sprintf("%s (contains running processes)", string(s.Name())))
+			continue
+		}
 		if d, ok := s.(deleter); ok {
 			sp, err := c.path(s.Name())
 			if err != nil {
@@ -247,6 +256,7 @@ func (c *cgroup) Delete() error {
 			if err := remove(path); err != nil {
 				errs = append(errs, path)
 			}
+			continue
 		}
 	}
 	if len(errs) > 0 {

v2/manager.go

@@ -345,6 +345,14 @@ func (c *Manager) AddThread(tid uint64) error {
 }
 
 func (c *Manager) Delete() error {
+	// kernel prevents cgroups with running process from being removed, check the tree is empty
+	processes, err := c.Procs(true)
+	if err != nil {
+		return err
+	}
+	if len(processes) > 0 {
+		return fmt.Errorf("cgroups: unable to remove path %q: still contains running processes", c.path)
+	}
 	return remove(c.path)
 }