From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christian Brauner Subject: Re: [PATCH 2/5] docs/cgroup: add entry for cgroup.kill Date: Fri, 30 Apr 2021 08:50:36 +0200 Message-ID: <20210430065036.uinuugxw6dhdqytc@wittgenstein> References: <20210429120113.2238065-1-brauner@kernel.org> <20210429120113.2238065-2-brauner@kernel.org> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Roman Gushchin Cc: Christian Brauner , Tejun Heo , Shakeel Butt , Zefan Li , Johannes Weiner , cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org On Thu, Apr 29, 2021 at 08:22:03PM -0700, Roman Gushchin wrote: > On Thu, Apr 29, 2021 at 02:01:10PM +0200, Christian Brauner wrote: > > From: Christian Brauner > > > > Give a brief overview of the cgroup.kill functionality. > > > > Cc: Roman Gushchin > > Cc: Tejun Heo > > Cc: cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org > > Signed-off-by: Christian Brauner > > --- > > Documentation/admin-guide/cgroup-v2.rst | 17 +++++++++++++++++ > > 1 file changed, 17 insertions(+) > > > > diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst > > index 64c62b979f2f..c9f656a84590 100644 > > --- a/Documentation/admin-guide/cgroup-v2.rst > > +++ b/Documentation/admin-guide/cgroup-v2.rst > > @@ -949,6 +949,23 @@ All cgroup core files are prefixed with "cgroup." > > it's possible to delete a frozen (and empty) cgroup, as well as > > create new sub-cgroups. > > > > + cgroup.kill > > + A write-only single value file which exists in non-root cgroups. > > + The only allowed value is "1". > > + > > + Writing "1" to the file causes the cgroup and all descendant cgroups to > > + be killed. This means that all processes located in the affected cgroup > > + tree will be killed via SIGKILL. > > + > > + Killing a cgroup tree will deal with concurrent forks appropriately and > > + is protected against migrations. If callers require strict guarantees > > + they can issue the cgroup.kill request after a freezing the cgroup via > > + cgroup.freeze. > > Hm, is it necessarily? What additional guarantees adds using the freezer? Every new process that get's added is frozen. So even if the a process ends up escaping the cgroup.kill request somehow it will be frozen in the cgroup and can't itself fork again right away. So you could do: echo 1 > cgroup.freeze wait for frozen notification echo 1 > cgroup.kill wait for unpopulated notification