Add ability to limit cpu usage rate by CFS cgroup

README.md

@@ -61,11 +61,13 @@ The `executorserver` need root privilege to create `cgroup`. Either creates sub-
 - The default CGroup prefix is `executor_server`, Can be specified with `-cgroup-prefix` flag.
 - `-auth-token` to add token-based authentication to REST / gRPC
 - `-src-prefix` to restrict `src` copyIn path (need to be absolute path)
-- `-time-limit-checker-interval` specifies time limit checker interval (default 100ms)
+- `-time-limit-checker-interval` specifies time limit checker interval (default 100ms) (valid value: \[1ms, 1s\])
 - `-output-limit` specifies size limit of POSIX rlimit of output
 - `-cpuset` specifies `cpuset.cpus` cgroup for each container
 - `-container-cred-start` specifies container `setuid` / `setgid` credential start point (default: 10000)
     - for example, by default container 0 will run with 10001 uid & gid and container 1 will run with 10002 uid & gid...
+- `-enable-cpu-rate` enabled `cpu` cgroup to control cpu rate using cfs_quota & cfs_period control
+- `-cpu-cfs-period` specifies cfs_period if cpu rate is enabled (default 100ms) (valid value: \[1ms, 1s\])
 
 #### Environment Variables
 
@@ -593,3 +595,41 @@ Compile On Windows (cygwin):
     }
 ]
 ```
+
+Infinite loop with cpu rate control:
+
+```json
+{
+	"cmd": [{
+		"args": ["/usr/bin/python3", "1.py"],
+		"env": ["PATH=/usr/bin:/bin"],
+		"files": [{"content": ""}, {"name": "stdout","max": 10240}, {"name": "stderr","max": 10240}],
+		"cpuLimit": 3000000000,
+        "realCpuLimit": 4000000000,
+		"memoryLimit": 104857600,
+		"procLimit": 50,
+        "cpuRate": 0.1,
+		"copyIn": {
+			"1.py": {
+				"content": "while True:\n    pass"
+			}
+		}
+	}]
+}
+```
+
+```json
+[
+    {
+        "status": "Time Limit Exceeded",
+        "exitStatus": 9,
+        "time": 414803599,
+        "memory": 3657728,
+        "runTime": 4046054900,
+        "files": {
+            "stderr": "",
+            "stdout": ""
+        }
+    }
+]
+```

cmd/executorserver/config/config.go

@@ -29,6 +29,8 @@ type Config struct {
 	ExtraMemoryLimit         *envexec.Size `flagUsage:"specifies extra memory buffer for check memory limit" default:"16k"`
 	OutputLimit              *envexec.Size `flagUsage:"specifies POSIX rlimit for output for each command" default:"256m"`
 	Cpuset                   string        `flagUsage:"control the usage of cpuset for all containerd process"`
+	EnableCPURate            bool          `flagUsage:"enable cpu cgroup rate control"`
+	CPUCfsPeriod             time.Duration `flagUsage:"set cpu.cfs_period" default:"100ms"`
 
 	// server config
 	HTTPAddr      string `flagUsage:"specifies the http binding address" default:":5050"`

cmd/executorserver/grpc.go

@@ -177,6 +177,7 @@ func convertPBCmd(c *pb.Request_CmdType, srcPrefix string) (cm worker.Cmd, strea
 		MemoryLimit:   c.GetMemoryLimit(),
 		StackLimit:    c.GetStackLimit(),
 		ProcLimit:     c.GetProcLimit(),
+		CPURateLimit:  c.GetCPURateLimit(),
 		CopyOut:       c.GetCopyOut(),
 		CopyOutCached: c.GetCopyOutCached(),
 		CopyOutMax:    c.GetCopyOutMax(),

cmd/executorserver/main.go

@@ -77,6 +77,8 @@ func main() {
 		CgroupPrefix:       conf.CgroupPrefix,
 		Cpuset:             conf.Cpuset,
 		ContainerCredStart: conf.ContainerCredStart,
+		EnableCPURate:      conf.EnableCPURate,
+		CPUCfsPeriod:       conf.CPUCfsPeriod,
 		Logger:             logger.Sugar(),
 	})
 	if err != nil {

cmd/executorserver/model/model.go

@@ -26,11 +26,12 @@ type Cmd struct {
 	Files []*CmdFile `json:"files,omitempty"`
 	TTY   bool       `json:"tty,omitempty"`
 
-	CPULimit     uint64 `json:"cpuLimit"`
-	RealCPULimit uint64 `json:"realCpuLimit"`
-	MemoryLimit  uint64 `json:"memoryLimit"`
-	StackLimit   uint64 `json:"stackLimit"`
-	ProcLimit    uint64 `json:"procLimit"`
+	CPULimit     uint64  `json:"cpuLimit"`
+	RealCPULimit uint64  `json:"realCpuLimit"`
+	MemoryLimit  uint64  `json:"memoryLimit"`
+	StackLimit   uint64  `json:"stackLimit"`
+	ProcLimit    uint64  `json:"procLimit"`
+	CPURateLimit float64 `json:"cpuRateLimit"`
 
 	CopyIn map[string]CmdFile `json:"copyIn"`
 
@@ -164,6 +165,7 @@ func convertCmd(c Cmd, srcPrefix string) (worker.Cmd, error) {
 		MemoryLimit:   c.MemoryLimit,
 		StackLimit:    c.StackLimit,
 		ProcLimit:     c.ProcLimit,
+		CPURateLimit:  c.CPURateLimit,
 		CopyOut:       c.CopyOut,
 		CopyOutCached: c.CopyOutCached,
 		CopyOutMax:    c.CopyOutMax,

env/config.go

@@ -1,5 +1,7 @@
 package env
 
+import "time"
+
 // Logger defines logger to print logs
 type Logger interface {
 	Debug(args ...interface{})
@@ -17,5 +19,7 @@ type Config struct {
 	CgroupPrefix       string
 	Cpuset             string
 	ContainerCredStart int
+	EnableCPURate      bool
+	CPUCfsPeriod       time.Duration
 	Logger
 }

env/env_linux.go

@@ -91,6 +91,9 @@ func NewBuilder(c Config) (pool.EnvBuilder, error) {
 	if c.Cpuset != "" {
 		cgb = cgb.WithCPUSet()
 	}
+	if c.EnableCPURate {
+		cgb = cgb.WithCPU()
+	}
 	cgb, err = cgb.FilterByEnv()
 	if err != nil {
 		return nil, err
@@ -106,9 +109,9 @@ func NewBuilder(c Config) (pool.EnvBuilder, error) {
 
 	var cgroupPool pool.CgroupPool
 	if cgb != nil {
-		cgroupPool = pool.NewFakeCgroupPool(cgb)
+		cgroupPool = pool.NewFakeCgroupPool(cgb, c.CPUCfsPeriod)
 	}
-	return pool.NewEnvBuilder(b, cgroupPool, workDir, c.Cpuset), nil
+	return pool.NewEnvBuilder(b, cgroupPool, workDir, c.Cpuset, c.EnableCPURate), nil
 }
 
 type credGen struct {