如果容器不与主机共享内核，解析 cgroup 文件是否可行？

Question

Stats found in cgroup files on the host, are they reliable if the container does not share the kernel with the host?

I'm asking this because while it was reliable with docker, with multiple runtimes being supported by K8s - some that offer containers with their own kernels, should I rely on the runtime daemons for stats or can I bypass them and still look at cgroup files.

Answer 1

If you are referring to Kata Containers with Docker and Kubernetes the short answer is yes. Make sure you configure sandbox_cgroup_only=true to get the accurate stats.

Also, make sure you use Kata Containers 1.11.0 or later as the cgroups implementation fix went into that version. Kata Containers creates its own cgroups in the Kernel running in the VM but that matches what's created at the host level. The resources for these cgroups created at the host level are not used, but rather the resources allocated by the VMM. Some more info here .