Merge pull request #14764 from cdoern/cgroup

limit cgroupfs when rootless

libpod/runtime_pod_linux.go

@@ -78,21 +78,24 @@ func (r *Runtime) NewPod(ctx context.Context, p specgen.PodSpecGenerator, option
 					pod.state.CgroupPath = filepath.Join(pod.config.CgroupParent, pod.ID())
 					if p.InfraContainerSpec != nil {
 						p.InfraContainerSpec.CgroupParent = pod.state.CgroupPath
-						res, err := GetLimits(p.InfraContainerSpec.ResourceLimits)
+						// cgroupfs + rootless = permission denied when creating the cgroup.
-						if err != nil {
+						if !rootless.IsRootless() {
-							return nil, err
+							res, err := GetLimits(p.InfraContainerSpec.ResourceLimits)
-						}
+							if err != nil {
-						// Need to both create and update the cgroup
+								return nil, err
-						// rather than create a new path in c/common for pod cgroup creation
+							}
-						// just create as if it is a ctr and then update figures out that we need to
+							// Need to both create and update the cgroup
-						// populate the resource limits on the pod level
+							// rather than create a new path in c/common for pod cgroup creation
-						cgc, err := cgroups.New(pod.state.CgroupPath, &res)
+							// just create as if it is a ctr and then update figures out that we need to
-						if err != nil {
+							// populate the resource limits on the pod level
-							return nil, err
+							cgc, err := cgroups.New(pod.state.CgroupPath, &res)
-						}
+							if err != nil {
-						err = cgc.Update(&res)
+								return nil, err
-						if err != nil {
+							}
-							return nil, err
+							err = cgc.Update(&res)
+							if err != nil {
+								return nil, err
+							}
 						}
 					}
 				}