8349988: Change cgroup version detection logic to not depend on /proc/cgroups

[jerboaa]

Please review this backport of the cgroup version detection logic which affects JDK 17 as well. Newer systems which are affected, like Ubuntu 2025-XX, get more commonly used. Therefore, I propose to backport it there too. The JDK 21 backport got shipped with the 21.0.10 update in January. The patch is not clean due to nullptr vs NULL differences and more context changes (e.g. JDK-8261242 not in JDK 17). Since the patch is not clean anyway, I've included the one-liner of JDK-8354878 right away.

Testing:

• GHA
• Container tests on cg v1 and cg v2 on Linux x86_64 (RHEL 8 and Fedora 42). Manual testing on an affected cg v2 system that container limits are detected.

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue
• JDK-8354878 needs maintainer approval
• JDK-8347811 needs maintainer approval
• JDK-8349988 needs maintainer approval

Issues

• JDK-8349988: Change cgroup version detection logic to not depend on /proc/cgroups (Sub-task - P3)
• JDK-8347811: Container detection code for cgroups v2 should use cgroup.controllers (Enhancement - P3)
• JDK-8354878: File Leak in CgroupSubsystemFactory::determine_type of cgroupSubsystem_linux.cpp:300 (Bug - P3)

Reviewers

• Thomas Fitzsimmons (@fitzsim - no project role)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk17u-dev.git pull/4271/head:pull/4271
$ git checkout pull/4271

Update a local copy of the PR:
$ git checkout pull/4271
$ git pull https://git.openjdk.org/jdk17u-dev.git pull/4271/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 4271

View PR using the GUI difftool:
$ git pr show -t 4271

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk17u-dev/pull/4271.diff

Using Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back sgehwolf! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

[openjdk]

This backport pull request has now been updated with issues from the original commit.

[jerboaa]

/issue add JDK-8347811
/issue add JDK-8354878

[openjdk]

@jerboaa
Updating description of additional solved issue: 8347811: Container detection code for cgroups v2 should use cgroup.controllers.

[openjdk]

@jerboaa
Adding additional issue to issue list: 8354878: File Leak in CgroupSubsystemFactory::determine_type of cgroupSubsystem_linux.cpp:300.

[jerboaa]

I've included JDK-8354878 - a one-liner - directly in here so as to not regress.

[jerboaa]

On an affected system (Ubuntu 2025-10) we have this before/after.

Before

$ podman run --rm -ti --cpus 2 --memory 200m --memory-swap=200m -v $(pwd)/jdk-17.0.18+8:/opt/jdk ubuntu:latest /opt/jdk/bin/java -Xlog:os+container=trace --version
[0.000s][trace][os,container] OSContainer::init: Initializing Container Support
[0.000s][debug][os,container] Detected optional pids controller entry in /proc/cgroups
[0.001s][debug][os,container] controller cpuset is not enabled

[0.001s][debug][os,container] controller memory is not enabled

[0.001s][debug][os,container] One or more required controllers disabled at kernel level.
openjdk 17.0.18 2026-01-20
OpenJDK Runtime Environment Temurin-17.0.18+8 (build 17.0.18+8)
OpenJDK 64-Bit Server VM Temurin-17.0.18+8 (build 17.0.18+8, mixed mode, sharing)

After

$ podman run --rm -ti --cpus 2 --memory 200m --memory-swap=200m -v $(pwd)/jdk17-jdk:/opt/jdk ubuntu:latest /opt/jdk/bin/java -Xlog:os+container=trace --version
[0.000s][trace][os,container] OSContainer::init: Initializing Container Support
[0.000s][debug][os,container] Detected optional pids controller entry in /sys/fs/cgroup/cgroup.controllers
[0.000s][debug][os,container] controller cpuset is not enabled
[0.000s][debug][os,container] Detected cgroups v2 unified hierarchy
[0.000s][trace][os,container] Path to /cpu.max is /sys/fs/cgroup/cpu.max
[0.000s][trace][os,container] Raw value for CPU quota is: 200000
[0.000s][trace][os,container] CPU Quota is: 200000
[0.000s][trace][os,container] Path to /cpu.max is /sys/fs/cgroup/cpu.max
[0.000s][trace][os,container] CPU Period is: 100000
[0.000s][trace][os,container] CPU Quota count based on quota/period: 2
[0.000s][trace][os,container] OSContainer::active_processor_count: 2
[0.001s][trace][os,container] CgroupSubsystem::active_processor_count (cached): 2
[0.001s][trace][os,container] total physical memory: 7687462912
[0.001s][trace][os,container] Path to /memory.max is /sys/fs/cgroup/memory.max
[0.001s][trace][os,container] Raw value for memory limit is: 209715200
[0.001s][trace][os,container] Memory Limit is: 209715200
[0.001s][trace][os,container] CgroupSubsystem::active_processor_count (cached): 2
[0.032s][trace][os,container] Path to /cpu.max is /sys/fs/cgroup/cpu.max
[0.032s][trace][os,container] Raw value for CPU quota is: 200000
[0.032s][trace][os,container] CPU Quota is: 200000
[0.032s][trace][os,container] Path to /cpu.max is /sys/fs/cgroup/cpu.max
[0.032s][trace][os,container] CPU Period is: 100000
[0.032s][trace][os,container] CPU Quota count based on quota/period: 2
[0.032s][trace][os,container] OSContainer::active_processor_count: 2
openjdk 17.0.19-internal 2026-04-21
OpenJDK Runtime Environment (fastdebug build 17.0.19-internal+0-adhoc.sgehwolf.jdk17u-dev)
OpenJDK 64-Bit Server VM (fastdebug build 17.0.19-internal+0-adhoc.sgehwolf.jdk17u-dev, mixed mode, sharing)

[jerboaa]

@fitzsim Could you please take a look? Thank you!

[mlbridge]

Webrevs

• 00: Full (e9767f22)

[fitzsim]

@jerboaa taking a look...

[fitzsim]

/reviewer credit @fitzsim

[openjdk]

@fitzsim Only the author (@jerboaa) is allowed to issue the reviewer command.

[jerboaa]

/reviewer credit @fitzsim

[openjdk]

@jerboaa
Reviewer fitzsim successfully credited.

[fitzsim]

This looks good to me. I no longer have the virtual machines at hand to test, so I didn't test it. I confirmed the changes versus the original patch seem fine though:

• copyright date updated, OK
• fclose addition per JDK-8354878, good fix
• context differences around match_mount_info, expected
• double-space to single-space change in comment, fine
• comment differences due to JDK-8261242 not having been backported, expected

At least make test TEST=test/hotspot/jtreg/containers/cgroup/CgroupSubsystemFactory.java succeeds for me on Fedora 43 x86-64.

[fitzsim]

See #4271 (comment).

[jerboaa]

Thanks for the review!

[jmtd]

On my host (Debian, kernel 6.16.9+deb14-amd64), with the parent PID (the shell) memory.max set to 200MiB.

before:

$ ./build/linux-x64/jdk/bin/java -Xlog:os+container=trace -XshowSettings:system -version
...
[0.000s][debug][os,container] controller memory is not enabled
[0.000s][debug][os,container] One or more required controllers disabled at kernel level.

after:

$ ./build/linux-x64/jdk/bin/java -Xlog:os+container=trace -XshowSettings:system -version
...
[0.004s][trace][os,container] Raw value for memory limit is: 209715200
...
    Memory Limit: 200.00M

i.e., the warning about missing memory controller has gone.

[jmtd]

I'm not sure how useful this is, but CgroupSubsystemFactory.java on master passes for me (prior to this change) so it doesn't seem a useful way to demonstrate the bug being fixed.
The modified version of the test in this PR fails against a build from master but not for a useful reason (java.lang.UnsatisfiedLinkError: 'int jdk.test.whitebox.WhiteBox.validateCgroup(boolean, java.lang.String, java.lang.String, java.lang.String)'). I recall a different test failing for me due to missing mem controller in /proc/cgroups, I'm going to see if I can figure out which one it was.