add Linux numa memory policy support

.github/workflows/codeql-analysis.yml

@@ -35,7 +35,7 @@ jobs:
 
     - run: |
        sudo apt-get update
-       sudo apt-get install -y make git gcc build-essential pkgconf libtool libsystemd-dev libcap-dev libseccomp-dev libyajl-dev go-md2man libtool autoconf python3 automake libprotobuf-c-dev
+       sudo apt-get install -y make git gcc build-essential pkgconf libtool libsystemd-dev libcap-dev libseccomp-dev libyajl-dev go-md2man libtool autoconf python3 automake libprotobuf-c-dev libnuma-dev
        ./autogen.sh
        ./configure
        make -j $(nproc)

.github/workflows/release.yaml

@@ -19,7 +19,7 @@ jobs:
 
       - run: sudo apt-get update
 
-      - run: sudo apt-get install -y make git gcc build-essential pkgconf libtool libsystemd-dev libcap-dev libseccomp-dev libyajl-dev go-md2man libtool autoconf python3 automake libprotobuf-c-dev
+      - run: sudo apt-get install -y make git gcc build-essential pkgconf libtool libsystemd-dev libcap-dev libseccomp-dev libyajl-dev go-md2man libtool autoconf python3 automake libprotobuf-c-dev libnuma-dev
 
       - run: |
           set -ex

.github/workflows/test.yaml

@@ -40,7 +40,7 @@ jobs:
 
           install: |
             apt-get update -y
-            apt-get install -y automake libtool autotools-dev libseccomp-dev git make libcap-dev cmake pkg-config gcc wget go-md2man libsystemd-dev gperf clang-format libyajl-dev libprotobuf-c-dev clang mawk
+            apt-get install -y automake libtool autotools-dev libseccomp-dev git make libcap-dev cmake pkg-config gcc wget go-md2man libsystemd-dev gperf clang-format libyajl-dev libprotobuf-c-dev clang mawk libnuma-dev
 
           run: |
             find $(pwd) -name '.git' -exec bash -c 'git config --global --add safe.directory ${0%/.git}' {} \;
@@ -94,7 +94,7 @@ jobs:
 
           sudo add-apt-repository -y ppa:criu/ppa
           # add-apt-repository runs apt-get update so we don't have to.
-          sudo apt-get install -q -y criu automake libtool autotools-dev libseccomp-dev git make libcap-dev cmake pkg-config gcc wget go-md2man libsystemd-dev gperf clang-format libyajl-dev containerd runc libasan6 libprotobuf-c-dev mawk
+          sudo apt-get install -q -y criu automake libtool autotools-dev libseccomp-dev git make libcap-dev cmake pkg-config gcc wget go-md2man libsystemd-dev gperf clang-format libyajl-dev containerd runc libasan6 libprotobuf-c-dev mawk libnuma-dev
 
       - name: run autogen.sh
         run: |
@@ -210,7 +210,7 @@ jobs:
       - name: install dependencies
         run: |
           sudo apt-get update -q -y
-          sudo apt-get install -q -y automake libtool autotools-dev libseccomp-dev git make libcap-dev cmake pkg-config gcc wget go-md2man libsystemd-dev gperf clang-format libyajl-dev libprotobuf-c-dev mawk
+          sudo apt-get install -q -y automake libtool autotools-dev libseccomp-dev git make libcap-dev cmake pkg-config gcc wget go-md2man libsystemd-dev gperf clang-format libyajl-dev libprotobuf-c-dev mawk libnuma-dev
       - uses: lumaxis/shellcheck-problem-matchers@v2
       - name: shellcheck
         run: |

Makefile.am

@@ -67,6 +67,7 @@ libcrun_SOURCES = src/libcrun/utils.c \
 		src/libcrun/linux.c \
 		src/libcrun/mount_flags.c \
 		src/libcrun/scheduler.c \
+		src/libcrun/mempolicy.c \
 		src/libcrun/seccomp.c \
 		src/libcrun/seccomp_notify.c \
 		src/libcrun/signals.c \
@@ -160,7 +161,7 @@ EXTRA_DIST = COPYING COPYING.libcrun README.md NEWS SECURITY.md rpm/crun.spec au
 	src/libcrun/custom-handler.h src/libcrun/io_priority.h \
 	src/libcrun/handlers/handler-utils.h \
 	src/libcrun/linux.h src/libcrun/utils.h src/libcrun/error.h src/libcrun/criu.h \
-	src/libcrun/scheduler.h src/libcrun/status.h src/libcrun/terminal.h \
+	src/libcrun/scheduler.h src/libcrun/mempolicy.h src/libcrun/mempolicy_internal.h src/libcrun/status.h src/libcrun/terminal.h \
 	src/libcrun/mount_flags.h src/libcrun/intelrdt.h src/libcrun/ring_buffer.h src/libcrun/string_map.h \
 	src/libcrun/net_device.h \
 	crun.1.md crun.1 libcrun.lds \
@@ -179,7 +180,7 @@ noinst_PROGRAMS = crun
 endif
 
 if BUILD_TESTS
-check_PROGRAMS = tests/init $(UNIT_TESTS) tests/tests_libcrun_fuzzer
+check_PROGRAMS = tests/init $(UNIT_TESTS) tests/tests_libcrun_fuzzer tests/tests_mempolicy_helper
 
 TESTS_LDADD = libcrun_testing.la $(FOUND_LIBS) $(maybe_libyajl.la)
 
@@ -212,6 +213,11 @@ tests_tests_libcrun_errors_SOURCES = tests/tests_libcrun_errors.c
 tests_tests_libcrun_errors_LDADD = $(TESTS_LDADD)
 tests_tests_libcrun_errors_LDFLAGS = $(crun_LDFLAGS)
 
+tests_tests_mempolicy_helper_CFLAGS = -I $(abs_top_builddir)/libocispec/src -I $(abs_top_srcdir)/libocispec/src -I $(abs_top_builddir)/src/libcrun -I $(abs_top_srcdir)/src/libcrun
+tests_tests_mempolicy_helper_SOURCES = tests/tests_mempolicy_helper.c
+tests_tests_mempolicy_helper_LDADD = $(TESTS_LDADD)
+tests_tests_mempolicy_helper_LDFLAGS = $(crun_LDFLAGS)
+
 endif
 TEST_EXTENSIONS = .py
 PY_LOG_COMPILER = $(PYTHON)
@@ -225,6 +231,7 @@ PYTHON_TESTS = tests/test_capabilities.py \
 	tests/test_hostname.py \
 	tests/test_limits.py \
 	tests/test_oci_features.py \
+	tests/test_mempolicy.py \
 	tests/test_mounts.py \
 	tests/test_paths.py \
 	tests/test_pid.py \

README.md

@@ -59,7 +59,8 @@ These dependencies are required for the build:
 $ sudo dnf install -y \
     autoconf automake gcc git-core glibc-static go-md2man \
     libcap-devel libseccomp-devel libtool make pkg-config \
-    python python-libmount systemd-devel yajl-devel
+    python python-libmount systemd-devel yajl-devel \
+    numactl-devel
 ```
 
 ### RHEL/CentOS Stream 9
@@ -69,7 +70,8 @@ $ sudo dnf config-manager --set-enabled crb
 $ sudo dnf install -y \
     autoconf automake gcc git-core glibc-static go-md2man \
     libcap-devel libseccomp-devel libtool make pkg-config \
-    python python-libmount systemd-devel yajl-devel
+    python python-libmount systemd-devel yajl-devel \
+    numactl-devel
 ```
 
 ### RHEL/CentOS Stream 10
@@ -79,7 +81,7 @@ $ sudo dnf config-manager --set-enabled crb
 $ sudo dnf install -y \
     autoconf automake gcc git-core glibc-static go-md2man \
     libcap-devel libseccomp-devel libtool make pkg-config \
-    python python-libmount systemd-devel
+    python python-libmount systemd-devel numactl-devel
 ```
 
 NOTE that you need to add `--enable-embedded-yajl` to `./configure` flags below.
@@ -89,22 +91,23 @@ NOTE that you need to add `--enable-embedded-yajl` to `./configure` flags below.
 ```console
 $ sudo apt-get install -y make git gcc build-essential pkgconf libtool \
    libsystemd-dev libprotobuf-c-dev libcap-dev libseccomp-dev libyajl-dev \
-   go-md2man autoconf python3 automake
+   go-md2man autoconf python3 automake libnuma-dev
 ```
 
 ### Alpine
 
 ```console
 # apk add gcc automake autoconf libtool gettext pkgconf git make musl-dev \
-    python3 libcap-dev libseccomp-dev yajl-dev argp-standalone go-md2man
+    python3 libcap-dev libseccomp-dev yajl-dev argp-standalone go-md2man \
+    numactl-dev
 ```
 
 ### Tumbleweed
 
 ```console
 # zypper install make automake autoconf gettext libtool gcc libcap-devel \
-systemd-devel libyajl-devel libseccomp-devel python3 go-md2man \
-glibc-static;
+    systemd-devel libyajl-devel libseccomp-devel python3 go-md2man \
+    glibc-static libnuma-devel
 ```
 
 Note that Tumbleweed requires you to specify libseccomp's header file location

configure.ac

@@ -173,6 +173,17 @@ AS_IF([test "x$enable_systemd" != "xno"], [
 	])
 ])
 
+dnl numa
+AC_ARG_ENABLE([numa],
+	AS_HELP_STRING([--disable-numa], [Ignore numa and disable support]))
+AS_IF([test "x$enable_numa" != "xno"], [
+	AC_CHECK_HEADERS([numa.h], [], [AC_MSG_ERROR([*** Missing numa headers])])
+	AC_CHECK_HEADERS([numaif.h], [], [AC_MSG_ERROR([*** Missing numa interface headers])])
+	AS_IF([test "$ac_cv_header_numaif_h" = "yes"], [
+		AC_SEARCH_LIBS(set_mempolicy, [numa], [AC_DEFINE([HAVE_NUMA], 1, [Define if libnuma is available])], [AC_MSG_ERROR([*** Failed to find libnuma])])
+	])
+])
+
 dnl ebpf
 AC_ARG_ENABLE([bpf],
 	AS_HELP_STRING([--disable-bpf], [Ignore eBPF and disable support]))

nix/derivation.nix

@@ -30,6 +30,7 @@ with pkgs; stdenv.mkDerivation {
       libseccomp
       libsystemd
       yajl
+      numactl
     ] ++ lib.optionals enableCriu [ criu ];
   configureFlags = [ "--enable-static" ] ++ lib.optional (!enableSystemd) [ "--disable-systemd" ];
   prePatch = ''

nix/overlay.nix

@@ -28,6 +28,7 @@ self: super:
   libassuan = (static super.libassuan);
   libgpgerror = (static super.libgpgerror);
   libseccomp = (static super.libseccomp);
+  numactl = (static super.numactl);
   libcap = (static super.libcap).overrideAttrs (x: {
     postInstall = ''
       mkdir -p "$doc/share/doc/${x.pname}-${x.version}"

rpm/Makefile

@@ -10,7 +10,7 @@ endif
 srpm-dep:
 	$(SUDO_CMD) dnf -y install autoconf automake git git-archive-all \
 		libcap-devel libseccomp-devel libtool m4 rpm-build systemd-devel \
-		yajl-devel
+		yajl-devel numactl-devel
 
 .ONESHELL:
 tarball-prep: srpm-dep

rpm/crun.spec

@@ -74,6 +74,7 @@ BuildRequires: wasmedge-devel
 %endif
 BuildRequires: python
 BuildRequires: glibc-static
+BuildRequires: numactl-devel
 Provides: oci-runtime
 
 %description

src/libcrun/container.c

@@ -23,6 +23,7 @@
 #include "container.h"
 #include "utils.h"
 #include "seccomp.h"
+#include "mempolicy.h"
 #ifdef HAVE_SECCOMP
 #  include <seccomp.h>
 #endif
@@ -2805,6 +2806,10 @@ libcrun_container_run_internal (libcrun_container_t *container, libcrun_context_
   if (UNLIKELY (ret < 0))
     return ret;
 
+  ret = libcrun_set_mempolicy (def, err);
+  if (UNLIKELY (ret < 0))
+    return ret;
+
   ret = libcrun_configure_handler (container_args.context->handler_manager,
                                    container_args.context,
                                    container,

src/libcrun/error.c

@@ -480,6 +480,23 @@ libcrun_warning (const char *msg, ...)
   va_end (args_list);
 }
 
+#ifdef HAVE_NUMA
+/* override libnuma internal numa_warn implementation
+ * that is defined as WEAK to allow consumers to define
+ * their own behavior.
+ * symbol has to be public for linker to use our version
+ * and allow to convert numa messages into libcrun messages */
+LIBCRUN_PUBLIC
+void
+numa_warn (int number arg_unused, char *msg, ...)
+{
+  va_list args_list;
+  va_start (args_list, msg);
+  write_log (0, LIBCRUN_VERBOSITY_WARNING, msg, args_list);
+  va_end (args_list);
+}
+#endif
+
 void
 libcrun_error (int errno_, const char *msg, ...)
 {