8349988: Change cgroup version detection logic to not depend on /proc/cgroups by jmtd · Pull Request #779 · openjdk/jdk8u-dev

jmtd · 2026-03-24T11:03:30Z

This is a backport of an improvement to cgroup detection logic. This fixes mis-detection on some systems e.g. Debian and Ubuntu systems, or systems running a recent enough mainline kernel which no longer propagates the older /proc/cgroups file with necessary controllers.

This wasn't clean: there are a few C++ changes (nullptr to NULL substitutions, os namespacing on cstd functions); logging mechanism changes; removal of PID controller related stuff.

Cherry-picking note: for reasons unknown git failed to apply the hunks for whitebox.cpp so I did those manually. It also patched the wrong copy of WhiteBox.java. I'm hoping we can pick up JDK-8327993 which should resolve this for future cgroups backports.

The modified CgroupSubsystemFactory.java passes.

I confirm that I make this contribution in accordance with the OpenJDK Interim AI Policy.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue
JDK-8354878 needs maintainer approval
JDK-8347811 needs maintainer approval
JDK-8349988 needs maintainer approval
JDK-8347129 needs maintainer approval

Issues

JDK-8349988: Change cgroup version detection logic to not depend on /proc/cgroups (Sub-task - P3)
JDK-8347811: Container detection code for cgroups v2 should use cgroup.controllers (Enhancement - P3)
JDK-8354878: File Leak in CgroupSubsystemFactory::determine_type of cgroupSubsystem_linux.cpp:300 (Bug - P3)
JDK-8347129: cpuset cgroups controller is required for no good reason (Bug - P3)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk8u-dev.git pull/779/head:pull/779
$ git checkout pull/779

Update a local copy of the PR:
$ git checkout pull/779
$ git pull https://git.openjdk.org/jdk8u-dev.git pull/779/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 779

View PR using the GUI difftool:
$ git pr show -t 779

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk8u-dev/pull/779.diff

Using Webrev

Link to Webrev Comment

bridgekeeper · 2026-03-24T11:04:27Z

👋 Welcome back jdowland! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2026-03-24T11:06:00Z

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

openjdk · 2026-03-24T11:07:18Z

⚠️ @jmtd the commit 59c7c8ed4b3392d3c8ee26128aaa71d10f46a595 does not refer to an issue in project JDK.

…71d10f46a595 For whatever reason, `git cherry-pick` could not resolve the path to whitebox.cpp in 8u and didn't apply the changes. Here they are. This wasn't clean: the `validate_cgroup` change had context differences. I've opted to incorporate 11u's use of CG_INFO_LENGTH for cg_infos. Signed-off-by: Jonathan Dowland <jdowland@redhat.com>

remove reference to pids controller remove os namespacing of fopen replace log_debug with tty->print_cr Signed-off-by: Jonathan Dowland <jdowland@redhat.com>

openjdk · 2026-03-24T13:58:26Z

This backport pull request has now been updated with issues from the original commit.

jmtd · 2026-03-24T14:15:30Z

# newfailures.txt
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#digicerttlseccrootg5 
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#digicerttlsrsarootg5 
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca1g3 
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca2g3 
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca3g3 
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#teliarootcav2

gut feeling is these will be unrelated but I will investigate further.

jmtd · 2026-03-24T16:24:14Z

reproduced those failures locally. now trying the master branch. Edit: yes same failures

gnu-andrew · 2026-04-03T17:58:05Z

# newfailures.txt
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#digicerttlseccrootg5 
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#digicerttlsrsarootg5 
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca1g3 
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca2g3 
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca3g3 
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#teliarootcav2

gut feeling is these will be unrelated but I will investigate further.

They are.

I haven't looked at this one in detail yet, but I would wait until the 11u one is in, as I did spot a few issues with that one.

Signed-off-by: Jonathan Dowland <jdowland@redhat.com>

jmtd · 2026-05-08T08:37:42Z

Local testing: hotspot/test/runtime/containers/cgroup/CgroupSubsystemFactory.java passes. Manual check:

before:

    $ /usr/lib/jvm/java-8-openjdk-amd64/bin/java -XX:+UnlockDiagnosticVMOptions -XX:+PrintContainerInfo -version
    OSContainer::init: Initializing Container Support
    One or more required controllers disabled at kernel level.
    openjdk version "1.8.0_482"
    OpenJDK Runtime Environment (build 1.8.0_482-8u482-ga-1-b08)
    OpenJDK 64-Bit Server VM (build 25.482-b08, mixed mode)

after:

    $ ./build/linux-x64/jdk/bin/java -XX:+UnlockDiagnosticVMOptions -XX:+PrintContainerInfo -version
    OSContainer::init: Initializing Container Support
    Detected optional cpuset controller entry in /sys/fs/cgroup/cgroup.controllers
    Detected cgroups v2 unified hierarchy
    Path to /cpu.max is /sys/fs/cgroup/user.slice/user-1000.slice/session-41.scope/cpu.max
    Raw value for CPU quota is: max
    CPU Quota is: -1
    Path to /cpu.max is /sys/fs/cgroup/user.slice/user-1000.slice/session-41.scope/cpu.max
    CPU Period is: 100000
    Path to /cpu.weight is /sys/fs/cgroup/user.slice/user-1000.slice/session-41.scope/cpu.weight
    Raw value for CPU Shares is: 100
    CPU Shares is: -1
    OSContainer::active_processor_count: 24
    CgroupSubsystem::active_processor_count (cached): 24
    total physical memory: 33498771456
    Path to /memory.max is /sys/fs/cgroup/user.slice/user-1000.slice/session-41.scope/memory.max
    Raw value for memory limit is: max
    Memory Limit is: Unlimited
    container memory limit unlimited: -1, using host value 33498771456
    CgroupSubsystem::active_processor_count (cached): 24
    Path to /cpu.max is /sys/fs/cgroup/user.slice/user-1000.slice/session-41.scope/cpu.max
    Raw value for CPU quota is: max
    CPU Quota is: -1
    Path to /cpu.max is /sys/fs/cgroup/user.slice/user-1000.slice/session-41.scope/cpu.max
    CPU Period is: 100000
    Path to /cpu.weight is /sys/fs/cgroup/user.slice/user-1000.slice/session-41.scope/cpu.weight
    Raw value for CPU Shares is: 100
    CPU Shares is: -1
    OSContainer::active_processor_count: 24
    openjdk version "1.8.0_502-internal"
    OpenJDK Runtime Environment (build 1.8.0_502-internal-jon_2026_05_08_09_24-b00)
    OpenJDK 64-Bit Server VM (build 25.502-b00, mixed mode)

mlbridge · 2026-05-08T09:45:02Z

Webrevs

mlbridge · 2026-05-08T22:09:32Z

Mailing list message from Jonathan Dowland on jdk8u-dev:

On Fri May 8, 2026 at 10:45 AM BST, Andrew John Hughes wrote:
(snip)

Skara has posted Andrew's comment today in response to me marking the PR
(which was draft) ready for review: Andrew's original comment was on Apr
3.

This is finally RFR from my POV: GHA tests pass (all bar windows/x84
which is an unrelated failure: CAInterop.java#comodorsaca); modified
test in backport passes; correct behaviour confirmed by hand on affected
machine (see my last comment on the PR, which has not been echoed to the
mailing list); PR up to date with master; and I've incorporated changes
suggested from the 11u backport.

Thanks,

--
👱🏻 Jonathan Dowland
✎ jon@dow.land
🔗 jmtd.net

bridgekeeper · 2026-06-05T11:36:53Z

@jmtd This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply issue a /touch or /keepalive command to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

jmtd · 2026-06-05T14:03:49Z

/touch

Still RFR. Thanks!

openjdk · 2026-06-05T14:07:17Z

@jmtd The pull request is being re-evaluated and the inactivity timeout has been reset.

jerboaa

A few things need some touch-ups IMO. Let me know what you think.

jerboaa · 2026-06-16T16:21:35Z

+  // cpuset might not be enabled on newer Linux distros (Fedora 41)
+  bool all_required_controllers_enabled = true;


This comment about cpuset is about JDK-8347129 which isn't in 8u. Perhaps this should get added - with /issue add - as after this patch it's essentially optional.

jerboaa · 2026-06-16T16:23:22Z

+          if (i == CPUSET_IDX && PrintContainerInfo) {
+            tty->print_cr("Detected optional %s controller entry in %s",
+                          controller, controllers_file);


Same comment regarding JDK-8347129

jerboaa · 2026-06-16T16:33:49Z

+            sysFsCgroupCgroupControllersNoPidsPath = Paths.get(existingDirectory.toString(), "sys_fs_cgroup_cgroup_controllers_no_pids");
+            Files.write(sysFsCgroupCgroupControllersNoPidsPath, sysFsCgroupCgroupControllersNoPidsContent.getBytes(StandardCharsets.UTF_8));


With the pids controller support not present. I'm doubtful this should be included as a test.

jerboaa · 2026-06-16T16:38:16Z

+  public native int validateCgroup(boolean cgroupsV2Enabled,
+                                   String controllersFile,
+                                   String procSelfCgroup,
+                                   String procSelfMountinfo);
  public native void printOsInfo();
  public native int validateCgroup(String procCgroups,
                                   String procSelfCgroup,
                                   String procSelfMountinfo);


The public native int validateCgroup() native method should only be there once. It's there twice with different signatures.

Co-authored-by: Severin Gehwolf <jerboaa@gmail.com>

jmtd · 2026-06-22T13:30:39Z

/issue add JDK-8354878

openjdk · 2026-06-22T13:30:55Z

@jmtd
Adding additional issue to issue list: 8354878: File Leak in CgroupSubsystemFactory::determine_type of cgroupSubsystem_linux.cpp:300.

Signed-off-by: Jonathan Dowland <jdowland@redhat.com>

jmtd · 2026-06-22T13:39:01Z

/issue add JDK-8347129

openjdk · 2026-06-22T13:39:21Z

@jmtd
Adding additional issue to issue list: 8347129: cpuset cgroups controller is required for no good reason.

jerboaa and others added 3 commits March 24, 2026 13:48

Backport dd842c440e3f50028fc991b29ea096f0e64e967b

e6e2d34

Adjustments for 8u

dee8acd

remove reference to pids controller remove os namespacing of fopen replace log_debug with tty->print_cr Signed-off-by: Jonathan Dowland <jdowland@redhat.com>

jmtd force-pushed the 8349988-8u branch from cb6e50d to dee8acd Compare March 24, 2026 13:51

jmtd changed the title ~~Backport 59c7c8ed4b3392d3c8ee26128aaa71d10f46a595~~ Backport dd842c440e3f50028fc991b29ea096f0e64e967b Mar 24, 2026

openjdk Bot changed the title ~~Backport dd842c440e3f50028fc991b29ea096f0e64e967b~~ 8349988: Change cgroup version detection logic to not depend on /proc/cgroups Mar 24, 2026

openjdk Bot added the backport Port of a pull request already in a different code base label Mar 24, 2026

Merge remote-tracking branch 'jdk8u-dev/master' into 8349988-8u

f04d436

jmtd and others added 2 commits May 8, 2026 09:22

restore double-space in comment (reduce delta to original patch)

f4d6ad8

Signed-off-by: Jonathan Dowland <jdowland@redhat.com>

Merge remote-tracking branch 'jdk8u-dev/master' into 8349988-8u

d8a5cf6

jmtd marked this pull request as ready for review May 8, 2026 09:38

openjdk Bot added the rfr Pull request is ready for review label May 8, 2026

jerboaa reviewed Jun 16, 2026

View reviewed changes

Update hotspot/src/os/linux/vm/cgroupSubsystem_linux.cpp

3757a21

Co-authored-by: Severin Gehwolf <jerboaa@gmail.com>

remove comment ref to pid controller (not in 8u)

09cda0c

Signed-off-by: Jonathan Dowland <jdowland@redhat.com>

		// cpuset might not be enabled on newer Linux distros (Fedora 41)
		bool all_required_controllers_enabled = true;

		sysFsCgroupCgroupControllersNoPidsPath = Paths.get(existingDirectory.toString(), "sys_fs_cgroup_cgroup_controllers_no_pids");
		Files.write(sysFsCgroupCgroupControllersNoPidsPath, sysFsCgroupCgroupControllersNoPidsContent.getBytes(StandardCharsets.UTF_8));

Uh oh!

Conversation

jmtd commented Mar 24, 2026 • edited by openjdk Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issues

Reviewing

Uh oh!

bridgekeeper Bot commented Mar 24, 2026

Uh oh!

openjdk Bot commented Mar 24, 2026

Uh oh!

openjdk Bot commented Mar 24, 2026

Uh oh!

openjdk Bot commented Mar 24, 2026

Uh oh!

jmtd commented Mar 24, 2026

Uh oh!

jmtd commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gnu-andrew commented Apr 3, 2026

Uh oh!

jmtd commented May 8, 2026

Uh oh!

mlbridge Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

mlbridge Bot commented May 8, 2026

Uh oh!

bridgekeeper Bot commented Jun 5, 2026

Uh oh!

jmtd commented Jun 5, 2026

Uh oh!

openjdk Bot commented Jun 5, 2026

Uh oh!

jerboaa left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jerboaa Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

jerboaa Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jerboaa Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

jerboaa Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jmtd commented Jun 22, 2026

Uh oh!

openjdk Bot commented Jun 22, 2026

Uh oh!

jmtd commented Jun 22, 2026

Uh oh!

openjdk Bot commented Jun 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

jmtd commented Mar 24, 2026 •

edited by openjdk Bot

Loading

jmtd commented Mar 24, 2026 •

edited

Loading

mlbridge Bot commented May 8, 2026 •

edited

Loading