Repository navigation
Conversation
Cellblocks are created with sysvshm=disable, the jail default, so nothing inside them can use SysV shared memory. Some services need it. PostgreSQL still creates a small SysV segment at startup, which it uses as a data directory interlock, even with shared_memory_type=mmap. Add "cblock launch -S/--sysvshm" (and "sysvshm: true" in the cblock_warden manifest). The option gives the jail its own SysV shared memory namespace (sysvshm=new): segments created in the cellblock are hidden from the host's namespace and from other cellblocks, even ones running under the same user ID. It is off by default to keep the syscall surface small for images that do not need it. The option is carried in a new p_sysvshm field of struct cblock_launch. This changes the wire format, so CBLOCK_PROTO_VERSION goes to 2. cblockd passes CBLOCK_SYSVSHM=new|disable to stage_launch.sh, which sets sysvshm explicitly on both the vnet and non-vnet jail -c paths. Add examples/postgres: a PostgreSQL 17 image whose entrypoint runs initdb only when the data directory holds no cluster yet. The superuser password comes from /run/secrets/postgres_password. The README covers the data volume, the secrets mount and --sysvshm. Document --sysvshm in README.md, including that kern.ipc limits are system-wide and how to cap each cellblock with RCTL.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cellblocks are created with sysvshm=disable, the jail default, so nothing inside them can use SysV shared memory. Some services need it. PostgreSQL still creates a small SysV segment at startup, which it uses as a data directory interlock, even with shared_memory_type=mmap.
Add "cblock launch -S/--sysvshm" (and "sysvshm: true" in the cblock_warden manifest). The option gives the jail its own SysV shared memory namespace (sysvshm=new): segments created in the cellblock are hidden from the host's namespace and from other cellblocks, even ones running under the same user ID. It is off by default to keep the syscall surface small for images that do not need it.
The option is carried in a new p_sysvshm field of struct cblock_launch. This changes the wire format, so CBLOCK_PROTO_VERSION goes to 2. cblockd passes CBLOCK_SYSVSHM=new|disable to stage_launch.sh, which sets sysvshm explicitly on both the vnet and non-vnet jail -c paths.
Add examples/postgres: a PostgreSQL 17 image whose entrypoint runs initdb only when the data directory holds no cluster yet. The superuser password comes from /run/secrets/postgres_password. The README covers the data volume, the secrets mount and --sysvshm.
Document --sysvshm in README.md, including that kern.ipc limits are system-wide and how to cap each cellblock with RCTL.