Re: [HTCondor-users] cgroup job scope

[Thomas Hartmann <thomas.hartmann@xxxxxxx>]

Hi Greg,


> The scope is intended to for users. There is a cgroup(v2) rule the 
> kernel tries to enforce -- that processes can only live in the leaf node 
> of the cgroup hierarchy. Following the systemd convention, htcondor 
> puts the processes of a job in a cgroup whose name ends in the string 
> ".slice". Because of this rule, if a job wants to create a sub-cgroup, 
> it can't just make a sub-directory of the .slice cgroup it was born in. 
> To allow jobs to further constrain their resource usage, the 
> job's .slice cgroup has a parent cgroup named .scope which has no 
> processes directly in it. The intention is that jobs can create 
> subdirectories of the .scope cgroup. HTCondor reports memory and cpu 
> usage from the .scope on down.
hmmmk, OK, but then I do not see right now, how a job/user could create 
their subdirs in the scope dir/cgroup?
On a EP with 25.0.3 the job slice is owned by the user [1], so it could 
operate there - but the scope subdir is owned by root [2], so that the 
user does not have a chance to branch into it, or? AFAIS the slice 
parent dir instead of the scope dir is owned to the user - could be a bug?

Cheers,
  Thomas

[1]
[root@batch1505 ~]# stat 
/sys/fs/cgroup/system.slice/condordesy.service/condorjob.slice/_var_lib_condor_execute_slot1_39@xxxxxxxxxxxxxxxxxxxxxxx
  File: 
/sys/fs/cgroup/system.slice/condordesy.service/condorjob.slice/_var_lib_condor_execute_slot1_39@xxxxxxxxxxxxxxxxxxxxxxx
  Size: 0               Blocks: 0          IO Block: 4096   directory
Device: 19h/25d Inode: 6948519     Links: 3
Access: (0755/drwxr-xr-x)  Uid: (40901/cmsplt001)   Gid: ( 4090/  cmsplt)
Context: system_u:object_r:cgroup_t:s0
Access: 2025-11-24 02:05:57.203940867 +0100
Modify: 2025-11-24 02:05:57.203940867 +0100
Change: 2025-11-24 02:05:57.202669615 +0100
 Birth: -

[2]
[root@batch1505 ~]# stat 
/sys/fs/cgroup/system.slice/condordesy.service/condorjob.slice/_var_lib_condor_execute_slot1_39@xxxxxxxxxxxxxxxxxxxxxxx/_var_lib_condor_execute_slot1_39@xxxxxxxxxxxxxxxxxxxxxxx/
  File: 
/sys/fs/cgroup/system.slice/condordesy.service/condorjob.slice/_var_lib_condor_execute_slot1_39@xxxxxxxxxxxxxxxxxxxxxxx/_var_lib_condor_execute_slot1_39@xxxxxxxxxxxxxxxxxxxxxxx/
  Size: 0               Blocks: 0          IO Block: 4096   directory
Device: 19h/25d Inode: 6948568     Links: 2
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Context: system_u:object_r:cgroup_t:s0
Access: 2025-11-25 02:05:57.973796271 +0100
Modify: 2025-11-24 02:05:57.182669586 +0100
Change: 2025-11-24 02:05:57.182669586 +0100
 Birth: -

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature