From 9fc7246e8a0c1b8dbce20fd5bef8e96049cb3cd1 Mon Sep 17 00:00:00 2001
From: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
Date: Mon, 26 Aug 2019 18:21:43 -0500
Subject: [PATCH] sandbox: delete cgroup for SandboxOnly option

Use all subsystems for SandboxOnly option to make sure
all cgroups are deleted.

Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
---
 virtcontainers/sandbox.go | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/virtcontainers/sandbox.go b/virtcontainers/sandbox.go
index 7cfe60e496..2a2850eb55 100644
--- a/virtcontainers/sandbox.go
+++ b/virtcontainers/sandbox.go
@@ -1907,21 +1907,37 @@ func (s *Sandbox) cgroupsUpdate() error {
 
 func (s *Sandbox) cgroupsDelete() error {
 	s.Logger().Debug("Deleting sandbox cgroup")
+	if s.state.CgroupPath == "" {
+		s.Logger().Warnf("sandox cgroups path is empty")
+		return nil
+	}
 
-	path := cgroupNoConstraintsPath(s.state.CgroupPath)
-	s.Logger().WithField("path", path).Debug("Deleting no constraints cgroup")
-	noConstraintsCgroup, err := cgroupsLoadFunc(V1NoConstraints, cgroups.StaticPath(path))
+	var path string
+	cgroupSubystems := V1NoConstraints
+
+	if s.config.SandboxCgroupOnly {
+		// Override V1NoConstraints, if SandboxCgroupOnly is enabled
+		cgroupSubystems = cgroups.V1
+		path = s.state.CgroupPath
+		s.Logger().WithField("path", path).Debug("Deleting sandbox cgroups (all subsystems)")
+	} else {
+		path = cgroupNoConstraintsPath(s.state.CgroupPath)
+		s.Logger().WithField("path", path).Debug("Deleting no constraints cgroup")
+	}
+
+	sandboxCgroups, err := cgroupsLoadFunc(cgroupSubystems, cgroups.StaticPath(path))
 	if err == cgroups.ErrCgroupDeleted {
 		// cgroup already deleted
+		s.Logger().Warnf("cgroup already deleted: '%s'", err)
 		return nil
 	}
 
 	if err != nil {
-		return fmt.Errorf("Could not load cgroup without constraints %v: %v", path, err)
+		return fmt.Errorf("Could not load cgroups %v: %v", path, err)
 	}
 
 	// move running process here, that way cgroup can be removed
-	parent, err := parentCgroup(V1NoConstraints, path)
+	parent, err := parentCgroup(cgroupSubystems, path)
 	if err != nil {
 		// parent cgroup doesn't exist, that means there are no process running
 		// and the no constraints cgroup was removed.
@@ -1929,12 +1945,12 @@ func (s *Sandbox) cgroupsDelete() error {
 		return nil
 	}
 
-	if err := noConstraintsCgroup.MoveTo(parent); err != nil {
+	if err := sandboxCgroups.MoveTo(parent); err != nil {
 		// Don't fail, cgroup can be deleted
-		s.Logger().WithError(err).Warn("Could not move process from no constraints to parent cgroup")
+		s.Logger().WithError(err).Warnf("Could not move process from %s to parent cgroup", path)
 	}
 
-	return noConstraintsCgroup.Delete()
+	return sandboxCgroups.Delete()
 }
 
 func (s *Sandbox) constrainHypervisorVCPUs(cgroup cgroups.Cgroup) error {