Files
coder/cli
Danielle Maywood 13f6645ab9 fix(cli): improve container detection when cgroupns=private (#15156)
Fixes https://github.com/coder/coder/issues/12721

If a container in docker is started with `--cgroupns=private` (which is
the default behaviour in docker) then `/proc/1/cgroup` has the following
content:
```
0::/
```

If a container in docker is started with `--cgroupns=host` then
`/proc/1/cgroup` has the following content (hash will vary):
```
0::/docker/aa86ac98959eeedeae0ecb6e0c9ddd8ae8b97a9d0fdccccf7ea7a474f4e0bb1f
```

Currently we are determining if a host is containerized by assuming the
second scenario. This means the existing behaviour of sniffing
`/proc/1/cgroup` is not always sufficient for checking if a host is
containerized.

According to [the cgroups(7)
man-page](https://man7.org/linux/man-pages/man7/cgroups.7.html) there
exists a `cgroup.type` file in a nonroot cgroup. This exists in Linux
versions after `4.14`.

> Linux 4.14 added thread mode for cgroups v2.

> With the addition of thread mode, each nonroot cgroup now contains a
new file, cgroup.type

This means we can check for the existence of
`/sys/fs/cgroup/cgroup.type` to see if we are in a container or not.
2024-10-21 15:28:32 +01:00
..