mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Shailend ChandandgVisor bot
46e35291a0
Fix a panic when writing to cgroup v2 control files from outside the sandbox (e.g., via Cgroups.WriteControlFiles / WriteControl), where writes occur without an open in-sandbox VFS file descriptor (fd == nil). cgroup.procs now safely falls back to context credentials with unconfined namespace migration, and checkNSDelegateWrite skips namespace delegation checks. Add an integration test for runsc cgroup v2 control file writes. Also: - Export cgroup2fs.InitHierarchy to initialize sandbox-wide cgroup2 state and root controller enablement. - Plumb CgroupNamespace through sentry lifecycle and task context to derive initial container cgroup2 placements. PiperOrigin-RevId: 978087817