codeql-action icon indicating copy to clipboard operation
codeql-action copied to clipboard

Executing the CodeQL GitHub Action within a Docker container results in the detection of only a single CPU, due to the `/sys/fs/cgroup/cpuset.cpus` file being empty.

Open kouberl-bosch opened this issue 2 years ago • 3 comments

Hi,

when using the github action in a container action with a docker image which has cgroup v2 it cannot be run multithreaded.

Example output:

While resolving threads, found a cgroup CPUs file with 32 CPUs in /sys/fs/cgroup/cpuset.cpus.effective.
While resolving threads, found a cgroup CPUs file with 1 CPUs in /sys/fs/cgroup/cpuset.cpus.

This happens because at my docker image (ubuntu:22.04) the /sys/fs/cgroup/cpuset.cpus is empty which is legit: see https://www.kernel.org/doc/Documentation/admin-guide/cgroup-v2.rst

If "cpuset.cpus" is empty, the "cpuset.cpus.effective" file shows all the CPUs from the parent cgroup that can be available to be used by this cgroup.

Now this lead to a maximum number of 1 CPU. Relates to #2083

kouberl-bosch avatar Feb 14 '24 11:02 kouberl-bosch

Hello! Thank you for reporting. I can look into this for you as I authored https://github.com/github/codeql-action/pull/2083. I'd like to understand why /sys/fs/cgroup/cpuset.cpus is reporting 1 CPU here: https://github.com/github/codeql-action/blob/dc983b33c32da66f1acc44a1d5ed69d94e9ffb64/src/util.ts#L469. If I understand correctly, the file exists in your container but is empty. Is that right?

angelapwen avatar Feb 15 '24 12:02 angelapwen

Yes the file exists, but it is empty, I'm using ubuntu 22.04 docker image. Edit: Empty is not correct, it has no content. It has a newline character:

$ xxd /sys/fs/cgroup/cpuset.cpus
$ 00000000: 0a

kouberl-bosch avatar Feb 15 '24 13:02 kouberl-bosch

Ah, I understand why the count is reporting as 1 now. I've put up https://github.com/github/codeql-action/pull/2151 which should address this issue. Thank you!

angelapwen avatar Feb 15 '24 14:02 angelapwen