Skip to content

fix(bootstrap): use host cgroup namespace for gateway container #329

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
drew merged 1 commit into from
Mar 16, 2026
Merged

fix(bootstrap): use host cgroup namespace for gateway container #329

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions crates/openshell-bootstrap/src/docker.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@ use bollard::API_DEFAULT_VERSION;
use bollard::Docker;
use bollard::errors::Error as BollardError;
use bollard::models::{
ContainerCreateBody, DeviceRequest, HostConfig, NetworkCreateRequest, NetworkDisconnectRequest,
PortBinding, VolumeCreateRequest,
ContainerCreateBody, DeviceRequest, HostConfig, HostConfigCgroupnsModeEnum,
NetworkCreateRequest, NetworkDisconnectRequest, PortBinding, VolumeCreateRequest,
};
use bollard::query_parameters::{
CreateContainerOptions, CreateImageOptions, InspectContainerOptions, InspectNetworkOptions,
Expand Down Expand Up @@ -523,6 +523,11 @@ pub async fn ensure_container(

let mut host_config = HostConfig {
privileged: Some(true),
// Use host cgroup namespace so k3s kubelet can manage cgroup controllers
// (cpu, cpuset, memory, pids, etc.) required for pod QoS. With cgroup v2
// and a private cgroupns, the controllers are not delegated into the
// container's namespace, causing kubelet ContainerManager to fail.
cgroupns_mode: Some(HostConfigCgroupnsModeEnum::HOST),
port_bindings: Some(port_bindings),
binds: Some(vec![format!("{}:/var/lib/rancher/k3s", volume_name(name))]),
network_mode: Some(network_name(name)),
Expand Down
Loading