libcontainer/cgroups: do not enable kmem on broken kernels

libcontainer/cgroups/fs/memory.go

@@ -4,6 +4,7 @@ package fs
 
 import (
 	"bufio"
+	"bytes"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -27,6 +28,8 @@ const (
 type MemoryGroup struct {
 }
 
+var kernelMemoryAccountingBroken = isKernelMemoryAccountingBroken()
+
 func (s *MemoryGroup) Name() string {
 	return "memory"
 }
@@ -68,6 +71,9 @@ func (s *MemoryGroup) Apply(d *cgroupData) (err error) {
 }
 
 func EnableKernelMemoryAccounting(path string) error {
+	if kernelMemoryAccountingBroken {
+		return nil
+	}
 	// Check if kernel memory is enabled
 	// We have to limit the kernel memory here as it won't be accounted at all
 	// until a limit is set on the cgroup and limit cannot be set once the
@@ -311,3 +317,24 @@ func getMemoryData(path, name string) (cgroups.MemoryData, error) {
 
 	return memoryData, nil
 }
+
+func getKernelRelease() string {
+	uts := &unix.Utsname{}
+	if err := unix.Uname(uts); err != nil {
+		return ""
+	}
+	// trim \0
+	return string(uts.Release[:bytes.IndexByte(uts.Release[:], 0)])
+}
+
+func isRHEL7Kernel() bool {
+	r := getKernelRelease()
+
+	return strings.HasPrefix(r, "3.10.0") && strings.Index(r, ".el7.") != -1
+}
+
+func isKernelMemoryAccountingBroken() bool {
+	// kmem limit is well known to be badly roken for RHEL7 kernels,
+	// (up to and including RHEL 7.5).
+	return isRHEL7Kernel()
+}

vendor.conf

@@ -18,7 +18,7 @@ github.com/golang/protobuf 18c9bb3261723cd5401db4d0c9fbc5c3b6c70fe8
 github.com/cyphar/filepath-securejoin v0.2.1
 github.com/docker/go-units v0.2.0
 github.com/urfave/cli d53eb991652b1d438abdd34ce4bfa3ef1539108e
-golang.org/x/sys 7ddbeae9ae08c6a06a59597f0c9edbc5ff2444ce https://github.com/golang/sys
+golang.org/x/sys ac767d655b305d4e9612f5f6e33120b9176c4ad4
 
 # console dependencies
 github.com/containerd/console 2748ece16665b45a47f884001d5831ec79703880