Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ci/actuated: re-enable CRIU tests #4252

Merged
merged 2 commits into from
Apr 25, 2024
Merged

ci/actuated: re-enable CRIU tests #4252

merged 2 commits into from
Apr 25, 2024

Conversation

kolyshkin
Copy link
Contributor

@kolyshkin kolyshkin commented Apr 25, 2024 •
edited
Loading

This re-enables previously disabled CRIU tests for actuated-arm64 as they appear to be working just fine now.

The only test we need to skip is criu pre-dump; apparently, ARM kernel lacks dirty memory tracking feature.

See individual commits for more details.

@kolyshkin kolyshkin force-pushed the test-actuated-cr branch 3 times, most recently from 306c883 to b541817 Compare April 25, 2024 01:53
@kolyshkin
tests/int/checkpoint: add requires criu_feature_xxx
f6b7167 
1. A few tests use "criu check --feature" to check for a specific
   feature. Let's generalize it.

2. Fix "checkpoint --pre-dump and restore" test to require memory
   tracking (which is missing on ARM).

Signed-off-by: Kir Kolyshkin <[email protected]>
@kolyshkin
ci/actuated: re-enable CRIU tests
baba55e 
They were failing earlier but are working now.

This includes a fix to criu repo path assignment so it works for actuated case.

Signed-off-by: Kir Kolyshkin <[email protected]>
@kolyshkin kolyshkin changed the title [DNM] ci/actuated: re-enable CRIU tests ci/actuated: re-enable CRIU tests Apr 25, 2024
@kolyshkin kolyshkin marked this pull request as ready for review April 25, 2024 02:47
@kolyshkin kolyshkin requested a review from lifubang April 25, 2024 02:47
@lifubang lifubang merged commit e74ff0f into opencontainers:main Apr 25, 2024
40 checks passed
@alexellis
Copy link

Hi @kolyshkin @AkihiroSuda

Glad to hear that CRIU is working on the 5.10.201 Kernel.

We've got a 6.1.90 Kernel available for testing, who would be the best person to work with to co-ordinate testing on the Kernel?

https://docs.actuated.dev/faq/#what-kernel-version-is-being-used

Alex

@alexellis alexellis mentioned this pull request May 7, 2024
Closed
@adrianreber
Copy link
Contributor

This re-enables previously disabled CRIU tests for actuated-arm64 as they appear to be working just fine now.

As mentioned in the previous pull request that is because the glibc in the container is too old to use restartable sequence. Once a newer glibc would be used it will fail. CRI-O has a simple workaround to disable restartable sequences in the container: GLIBC_TUNABLES=glibc.pthread.rseq=0.

The only test we need to skip is criu pre-dump; apparently, ARM kernel lacks dirty memory tracking feature.

Correct.

@alexellis
Copy link

What are you referring to by "in the container"?

@adrianreber
Copy link
Contributor

What are you referring to by "in the container"?

The containers that are created by runc to test runc. That is also how CRI-O solved the problem, the glibc inside of the containers that CRI-O creates are told to not use restartable sequences by GLIBC_TUNABLES=glibc.pthread.rseq=0.

@lifubang
Copy link
Member

lifubang commented May 7, 2024

Glad to hear that CRIU is working on the 5.10.201 Kernel.

The time you said this sentence, there is an error occured in test (actuated-arm64-6cpu-8gb, 1.21.x).
I have restarted the test, but the error still exists.

=== RUN   TestCheckpoint
    checkpoint_test.go:115: === /tmp/TestCheckpoint1387080808/003/criu-parent/dump.log ===
    checkpoint_test.go:115: open /tmp/TestCheckpoint1387080808/003/criu-parent/dump.log: no such file or directory
    checkpoint_test.go:119: CRIU feature check failed
--- FAIL: TestCheckpoint (0.24s)

@adrianreber
Copy link
Contributor

Glad to hear that CRIU is working on the 5.10.201 Kernel.

The time you said this sentence, there is an error occured in test (actuated-arm64-6cpu-8gb, 1.21.x). I have restarted the test, but the error still exists.

=== RUN   TestCheckpoint
    checkpoint_test.go:115: === /tmp/TestCheckpoint1387080808/003/criu-parent/dump.log ===
    checkpoint_test.go:115: open /tmp/TestCheckpoint1387080808/003/criu-parent/dump.log: no such file or directory
    checkpoint_test.go:119: CRIU feature check failed
--- FAIL: TestCheckpoint (0.24s)

Like @kolyshkin said, pre-dump tests are not working on aarch64. That failure comes from running a pre-dump. I think the line 115 (https://github.com/opencontainers/runc/blob/main/libcontainer/integration/checkpoint_test.go#L115) should be after the skip.

@adrianreber
Copy link
Contributor

Oh, and https://github.com/opencontainers/runc/blob/main/libcontainer/criu_linux.go#L52 also looks wrong. That should return: return ErrCriuMissingFeature.

@lifubang
Copy link
Member

lifubang commented May 7, 2024

I think the line 115 (https://github.com/opencontainers/runc/blob/main/libcontainer/integration/checkpoint_test.go#L115) should be after the skip.

Thanks, I think it should be in the if block, not after the skip.
I open an issue to track this flaky test: #4274

@alexellis
Copy link

We've got the CNCF organisations now running on both Kernel versions, it could be why you saw this fail now. The old CONFIG_ settings were copied across to 6.1.90, but are there any other specifics for me to double check in the Kernel's config?

@lifubang
Copy link
Member

lifubang commented May 7, 2024

Ah, yes, the CI running on 6.1.90 will fail, but on 5.10.201 will success.

@lifubang
Copy link
Member

lifubang commented May 7, 2024

The kernel config:
6.1.90:

Generally Necessary:
- cgroup hierarchy: cgroupv2
- CONFIG_NAMESPACES: enabled
- CONFIG_NET_NS: enabled
- CONFIG_PID_NS: enabled
- CONFIG_IPC_NS: enabled
- CONFIG_UTS_NS: enabled
- CONFIG_CGROUPS: enabled
- CONFIG_CGROUP_CPUACCT: enabled
- CONFIG_CGROUP_DEVICE: enabled
- CONFIG_CGROUP_FREEZER: enabled
- CONFIG_CGROUP_SCHED: enabled
- CONFIG_CPUSETS: enabled
- CONFIG_MEMCG: enabled
- CONFIG_KEYS: enabled
- CONFIG_VETH: enabled
- CONFIG_BRIDGE: enabled
- CONFIG_BRIDGE_NETFILTER: enabled
- CONFIG_IP_NF_FILTER: enabled (as module)
- CONFIG_IP_NF_TARGET_MASQUERADE: enabled (as module)
- CONFIG_NETFILTER_XT_MATCH_ADDRTYPE: enabled
- CONFIG_NETFILTER_XT_MATCH_COMMENT: enabled
- CONFIG_NETFILTER_XT_MATCH_CONNTRACK: enabled
- CONFIG_NETFILTER_XT_MATCH_IPVS: enabled (as module)
- CONFIG_IP_NF_NAT: enabled (as module)
- CONFIG_NF_NAT: enabled
- CONFIG_POSIX_MQUEUE: enabled
- CONFIG_CGROUP_BPF: enabled

Optional Features:
- CONFIG_USER_NS: enabled
- CONFIG_SECCOMP: enabled
- CONFIG_SECCOMP_FILTER: enabled
- CONFIG_CGROUP_PIDS: enabled
- CONFIG_BLK_CGROUP_IOCOST: missing
- CONFIG_BLK_CGROUP: enabled
- CONFIG_BLK_DEV_THROTTLING: enabled
- CONFIG_CGROUP_PERF: enabled
- CONFIG_CGROUP_HUGETLB: enabled
- CONFIG_NET_CLS_CGROUP: enabled (as module)
- CONFIG_CGROUP_NET_PRIO: enabled
- CONFIG_CFS_BANDWIDTH: enabled
- CONFIG_FAIR_GROUP_SCHED: enabled
- CONFIG_RT_GROUP_SCHED: enabled
- CONFIG_IP_NF_TARGET_REDIRECT: enabled (as module)
- CONFIG_IP_VS: enabled (as module)
- CONFIG_IP_VS_NFCT: enabled
- CONFIG_IP_VS_PROTO_TCP: enabled
- CONFIG_IP_VS_PROTO_UDP: enabled
- CONFIG_IP_VS_RR: enabled (as module)
- CONFIG_SECURITY_SELINUX: enabled
- CONFIG_SECURITY_APPARMOR: missing
- CONFIG_CHECKPOINT_RESTORE: enabled

5.10.201:

Generally Necessary:
- cgroup hierarchy: cgroupv2
- CONFIG_NAMESPACES: enabled
- CONFIG_NET_NS: enabled
- CONFIG_PID_NS: enabled
- CONFIG_IPC_NS: enabled
- CONFIG_UTS_NS: enabled
- CONFIG_CGROUPS: enabled
- CONFIG_CGROUP_CPUACCT: enabled
- CONFIG_CGROUP_DEVICE: enabled
- CONFIG_CGROUP_FREEZER: enabled
- CONFIG_CGROUP_SCHED: enabled
- CONFIG_CPUSETS: enabled
- CONFIG_MEMCG: enabled
- CONFIG_KEYS: enabled
- CONFIG_VETH: enabled
- CONFIG_BRIDGE: enabled
- CONFIG_BRIDGE_NETFILTER: enabled
- CONFIG_IP_NF_FILTER: enabled
- CONFIG_IP_NF_TARGET_MASQUERADE: enabled
- CONFIG_NETFILTER_XT_MATCH_ADDRTYPE: enabled
- CONFIG_NETFILTER_XT_MATCH_COMMENT: enabled
- CONFIG_NETFILTER_XT_MATCH_CONNTRACK: enabled
- CONFIG_NETFILTER_XT_MATCH_IPVS: enabled (as module)
- CONFIG_IP_NF_NAT: enabled
- CONFIG_NF_NAT: enabled
- CONFIG_POSIX_MQUEUE: enabled
- CONFIG_CGROUP_BPF: enabled

Optional Features:
- CONFIG_USER_NS: enabled
- CONFIG_SECCOMP: enabled
- CONFIG_SECCOMP_FILTER: enabled
- CONFIG_CGROUP_PIDS: enabled
- CONFIG_MEMCG_SWAP: enabled
- CONFIG_BLK_CGROUP_IOCOST: missing
- CONFIG_BLK_CGROUP: enabled
- CONFIG_BLK_DEV_THROTTLING: enabled
- CONFIG_CGROUP_PERF: enabled
- CONFIG_CGROUP_HUGETLB: enabled
- CONFIG_NET_CLS_CGROUP: enabled (as module)
- CONFIG_CGROUP_NET_PRIO: enabled
- CONFIG_CFS_BANDWIDTH: enabled
- CONFIG_FAIR_GROUP_SCHED: enabled
- CONFIG_RT_GROUP_SCHED: enabled
- CONFIG_IP_NF_TARGET_REDIRECT: enabled
- CONFIG_IP_VS: enabled (as module)
- CONFIG_IP_VS_NFCT: enabled
- CONFIG_IP_VS_PROTO_TCP: enabled
- CONFIG_IP_VS_PROTO_UDP: enabled
- CONFIG_IP_VS_RR: enabled (as module)
- CONFIG_SECURITY_SELINUX: enabled
- CONFIG_SECURITY_APPARMOR: missing
- CONFIG_CHECKPOINT_RESTORE: enabled

@kolyshkin
Copy link
Contributor Author

Oh, and https://github.com/opencontainers/runc/blob/main/libcontainer/criu_linux.go#L52 also looks wrong. That should return: return ErrCriuMissingFeature.

@adrianreber it seems it's worse than that. The code in criuCheckFeatures assumes that if a feature is not available, criu swrk succeeds, returning features, and when it checks those.

What happens instead is criu swrk fails.

Might be a problem with swrk rather than runc, but nevertheless.

@lifubang lifubang mentioned this pull request Jun 10, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@AkihiroSuda AkihiroSuda AkihiroSuda approved these changes

@lifubang lifubang lifubang approved these changes

Assignees
No one assigned
Labels
area/checkpoint-restore area/ci
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@kolyshkin @alexellis @adrianreber @lifubang @AkihiroSuda