executor: warn when rootless drops resource limits

client/client_exec_test.go

@@ -144,6 +144,39 @@ func testLinuxResources(t *testing.T, sb integration.Sandbox) {
 	require.Equal(t, "50000 100000", strings.TrimSpace(string(dt3)))
 }
 
+func testLinuxResourcesIgnoredWarning(t *testing.T, sb integration.Sandbox) {
+	integration.SkipOnPlatform(t, "windows")
+
+	c, err := New(sb.Context(), sb.Address())
+	require.NoError(t, err)
+	defer c.Close()
+
+	img := llb.Image("alpine:latest")
+	st := img.Run(llb.Shlex(`sh -c "echo limited > /out"`), llb.MemoryLimit(64*1024*1024)).Root()
+	st = st.Run(llb.Shlex(`sh -c "echo unlimited > /out"`)).Root()
+
+	def, err := st.Marshal(sb.Context())
+	require.NoError(t, err)
+
+	wc := newWarningsCapture()
+	_, err = c.Solve(sb.Context(), def, SolveOpt{}, wc.status)
+	require.NoError(t, err)
+
+	var ignored []*VertexWarning
+	for _, w := range wc.wait() {
+		if strings.Contains(string(w.Short), "resource limits are ignored") {
+			ignored = append(ignored, w)
+		}
+	}
+	if sb.Rootless() {
+		// Only the step that asked for a limit gets the warning.
+		require.Len(t, ignored, 1)
+		require.Equal(t, 1, ignored[0].Level)
+	} else {
+		require.Empty(t, ignored)
+	}
+}
+
 func testPassthroughOp(t *testing.T, sb integration.Sandbox) {
 	requiresLinux(t)
 

client/client_test.go

@@ -56,6 +56,7 @@ var allTests = []func(t *testing.T, sb integration.Sandbox){
 	// client_exec_test.go
 	testCgroupParent,
 	testLinuxResources,
+	testLinuxResourcesIgnoredWarning,
 	testPassthroughOp,
 	testRelativeMountpoint,
 	testRelativeWorkDir,

executor/containerdexecutor/executor_unix.go

@@ -159,6 +159,7 @@ func (w *containerdExecutor) createOCISpec(ctx context.Context, id, resolvConf,
 	releasers = append(releasers, cleanup)
 	spec.Process.Terminal = meta.Tty
 	if w.rootless {
+		executor.WarnLinuxResourcesIgnored(ctx, meta.LinuxResources)
 		removedMounts, err := rootlessspecconv.ToRootless(spec)
 		if err != nil {
 			releaseAll()

executor/resources_warning.go

@@ -0,0 +1,49 @@
+package executor
+
+import (
+	"context"
+
+	"github.com/moby/buildkit/client"
+	"github.com/moby/buildkit/identity"
+	"github.com/moby/buildkit/solver/pb"
+	"github.com/moby/buildkit/util/bklog"
+	"github.com/moby/buildkit/util/progress"
+	"google.golang.org/protobuf/reflect/protoreflect"
+)
+
+const linuxResourcesIgnoredMsg = "resource limits are ignored by the rootless worker"
+
+// WarnLinuxResourcesIgnored reports that the resource limits requested for a
+// step were not applied. Rootless executors call it because they run steps
+// without a cgroup. The warning goes to the daemon log and to the build
+// output of the step that ctx belongs to.
+func WarnLinuxResourcesIgnored(ctx context.Context, res *pb.LinuxResources) {
+	if !hasLinuxResources(res) {
+		return
+	}
+	bklog.G(ctx).Warn(linuxResourcesIgnoredMsg)
+	pw, ok, _ := progress.NewFromContext(ctx)
+	if !ok {
+		return
+	}
+	pw.Write(identity.NewID(), client.VertexWarning{
+		Level: 1,
+		Short: []byte(linuxResourcesIgnoredMsg),
+	})
+	pw.Close()
+}
+
+// hasLinuxResources reports whether any limit is set in res. Range only visits
+// fields with a non-zero value, so new fields are covered without listing them
+// here.
+func hasLinuxResources(res *pb.LinuxResources) bool {
+	if res == nil {
+		return false
+	}
+	set := false
+	res.ProtoReflect().Range(func(protoreflect.FieldDescriptor, protoreflect.Value) bool {
+		set = true
+		return false
+	})
+	return set
+}

executor/resources_warning_test.go

@@ -0,0 +1,52 @@
+package executor
+
+import (
+	"testing"
+
+	"github.com/moby/buildkit/client"
+	"github.com/moby/buildkit/solver/pb"
+	"github.com/moby/buildkit/util/progress"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWarnLinuxResourcesIgnored(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		res  *pb.LinuxResources
+		warn bool
+	}{
+		{name: "nil", res: nil},
+		{name: "empty", res: &pb.LinuxResources{}},
+		{name: "memory", res: &pb.LinuxResources{Memory: 64 << 20}, warn: true},
+		{name: "cpu quota", res: &pb.LinuxResources{CpuQuota: 50000, CpuPeriod: 100000}, warn: true},
+		{name: "cpuset", res: &pb.LinuxResources{CpusetCpus: "0"}, warn: true},
+		{name: "memory swap", res: &pb.LinuxResources{MemorySwap: -1}, warn: true},
+		{name: "cpu shares", res: &pb.LinuxResources{CpuShares: 512}, warn: true},
+		{name: "cpuset mems", res: &pb.LinuxResources{CpusetMems: "0"}, warn: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			pr, ctx, cancel := progress.NewContext(t.Context())
+			WarnLinuxResourcesIgnored(ctx, tc.res)
+			cancel(nil)
+
+			var warnings []client.VertexWarning
+			for {
+				ps, err := pr.Read(t.Context())
+				if err != nil || len(ps) == 0 {
+					break
+				}
+				for _, p := range ps {
+					if w, ok := p.Sys.(client.VertexWarning); ok {
+						warnings = append(warnings, w)
+					}
+				}
+			}
+			if !tc.warn {
+				require.Empty(t, warnings)
+				return
+			}
+			require.Len(t, warnings, 1)
+			require.Equal(t, linuxResourcesIgnoredMsg, string(warnings[0].Short))
+		})
+	}
+}

executor/runcexecutor/executor.go

@@ -343,6 +343,7 @@ func (w *runcExecutor) Run(ctx context.Context, id string, root executor.Mount,
 	spec.Process.Terminal = meta.Tty
 	spec.Process.OOMScoreAdj = w.oomScoreAdj
 	if w.rootless {
+		executor.WarnLinuxResourcesIgnored(ctx, meta.LinuxResources)
 		var removedMounts []string
 		removedMounts, err = rootlessspecconv.ToRootless(spec)
 		if err != nil {