89e59902c4
Modernize code for Go 1.24
...
Brought to you by
modernize -fix -test ./...
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com >
2025-08-27 19:11:02 -07:00
17570625c0
Use for range over integers
...
This appears in Go 1.22 (see https://tip.golang.org/ref/spec#For_range ).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com >
2025-03-31 17:15:06 -07:00
9a54594752
libct/int: add BenchmarkExecInBigEnv
...
Here's what it shows on my laptop (with -count 10 -benchtime 10s,
summarized by benchstat):
│ sec/op │
ExecTrue-20 8.477m ± 2%
ExecInBigEnv-20 61.53m ± 1%
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com >
2025-01-09 18:22:53 +08:00
1e674098f5
libct/int: add exec benchmark
...
This is a benchmark which checks how fast we can execute /bin/true
inside a container.
Results from my machine are below. As you can see, in default setup
about 70% of exec time is spent for CVE-2019-5736 (copying runc binary),
and using either RUNC_DMZ=true or memfd-bind helps a lot.
This can also be used for profiling (using -test.cpuprofile option).
=== Default setup ===
[kir@kir-tp1 integration]$ sudo ./integration.test -test.run xxx -test.v -test.benchtime 5s -test.count 5 -test.bench . .
goos: linux
goarch: amd64
pkg: github.com/opencontainers/runc/libcontainer/integration
cpu: 12th Gen Intel(R) Core(TM) i7-12800H
BenchmarkExecTrue
BenchmarkExecTrue-20 327 24475677 ns/op
BenchmarkExecTrue-20 244 25242718 ns/op
BenchmarkExecTrue-20 232 26187174 ns/op
BenchmarkExecTrue-20 237 26780030 ns/op
BenchmarkExecTrue-20 318 18487219 ns/op
PASS
=== With DMZ enabled ===
[kir@kir-tp1 integration]$ sudo -E RUNC_DMZ=true ./integration.test -test.run xxx -test.v -test.benchtime 5s -test.count 5 -test.bench . .
goos: linux
goarch: amd64
pkg: github.com/opencontainers/runc/libcontainer/integration
cpu: 12th Gen Intel(R) Core(TM) i7-12800H
BenchmarkExecTrue
BenchmarkExecTrue-20 694 8263744 ns/op
BenchmarkExecTrue-20 778 8483228 ns/op
BenchmarkExecTrue-20 784 8456018 ns/op
BenchmarkExecTrue-20 732 8160239 ns/op
BenchmarkExecTrue-20 769 8236972 ns/op
PASS
=== With memfd-bind ===
[kir@kir-tp1 integration]$ sudo systemctl start memfd-bind@$(systemd-escape -p $PWD/integration.test)
[kir@kir-tp1 integration]$ sudo ./integration.test -test.run xxx -test.v -test.benchtime 5s -test.count 5 -test.bench . .
goos: linux
goarch: amd64
pkg: github.com/opencontainers/runc/libcontainer/integration
cpu: 12th Gen Intel(R) Core(TM) i7-12800H
BenchmarkExecTrue
BenchmarkExecTrue-20 800 7538839 ns/op
BenchmarkExecTrue-20 717 7424755 ns/op
BenchmarkExecTrue-20 848 7747787 ns/op
BenchmarkExecTrue-20 800 7668740 ns/op
BenchmarkExecTrue-20 751 7304373 ns/op
PASS
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com >
2024-10-24 13:39:26 -07:00
Kir Kolyshkin