[1.4] runtime-spec: update pids.limit handling to match new guidance#5004
Merged
AkihiroSuda merged 3 commits intoopencontainers:release-1.4from Nov 18, 2025
Merged
[1.4] runtime-spec: update pids.limit handling to match new guidance#5004AkihiroSuda merged 3 commits intoopencontainers:release-1.4from
AkihiroSuda merged 3 commits intoopencontainers:release-1.4from
Conversation
The main update is actually in github.com/opencontainers/cgroups, but we need to also update runtime-spec to a newer pre-release version to get the updates from there as well. In short, the behaviour change is now that "0" is treated as a valid value to set in "pids.max", "-1" means "max" and unset/nil means "do nothing". As described in the opencontainers/cgroups PR, this change is actually backwards compatible because our internal state.json stores PidsLimit, and that entry is marked as "omitempty". So, an old runc would omit PidsLimit=0 in state.json, and this will be parsed by a new runc as being "nil" -- and both would treat this case as "do not set anything". Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (cherry picked from commit 3b75374) Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (cherry picked from commit 72421e0) Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
This is much easier to read and removes the need for explicit per-type helper functions. Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (cherry picked from commit 8ab2458) Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
kolyshkin
approved these changes
Nov 12, 2025
AkihiroSuda
approved these changes
Nov 18, 2025
e3bfca3
into
opencontainers:release-1.4
53 of 55 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #4949.
The main update is actually in github.com/opencontainers/cgroups, but we
need to also update runtime-spec to a newer pre-release version to get
the updates from there as well.
In short, the behaviour change is now that "0" is treated as a valid
value to set in "pids.max", "-1" means "max" and unset/nil means "do
nothing". As described in the opencontainers/cgroups PR, this change is
actually backwards compatible because our internal state.json stores
PidsLimit, and that entry is marked as "omitempty". So, an old runc
would omit PidsLimit=0 in state.json, and this will be parsed by a new
runc as being "nil" -- and both would treat this case as "do not set
anything".
Fixes #4014
Closes #4015
Closes #4023
Signed-off-by: Aleksa Sarai cyphar@cyphar.com