Adjust CPU usage based on host cgroup usage

gVisor approximates CPU usage because it doesn't have full control over
task scheduling. Scheduling is handled by the Golang's scheduler and the
host kernel. This can cause gVisor to overeatimate CPU usage, especially
in cases where there are multiple processes executing or cgroups restricts
usage to fractions of a CPU.

In order to report CPU usage more accurately, we use the sandbox's cgroup
CPU usage to estimate how much CPU each container is using.

PiperOrigin-RevId: 829002053

Author: fvoznika

runsc/boot/events.go

@@ -154,7 +154,11 @@ func (cm *containerManager) Event(cid *string, out *EventOut) error {
 	}
 
 	// Memory usage.
-	memFile := control.CgroupControlFile{"memory", "/" + *cid, "memory.usage_in_bytes"}
+	memFile := control.CgroupControlFile{
+		Controller: "memory",
+		Path:       "/" + *cid,
+		Name:       "memory.usage_in_bytes",
+	}
 	memUsage, err := cm.getUsageFromCgroups(memFile)
 	if err != nil {
 		// Cgroups is not installed or there was an error to get usage
@@ -183,16 +187,34 @@ func (cm *containerManager) Event(cid *string, out *EventOut) error {
 	out.Event.Data.Memory.Usage.Usage = memUsage
 
 	// CPU usage by container.
-	cpuacctFile := control.CgroupControlFile{"cpuacct", "/" + *cid, "cpuacct.usage"}
-	if cpuUsage, err := cm.getUsageFromCgroups(cpuacctFile); err != nil {
+	out.ContainerUsage, err = cm.getCPUUsageFromCgroups()
+	if err != nil {
 		// Cgroups is not installed or there was an error to get usage
 		// from the cgroups. Fall back to the old method of getting the
 		// usage from the sentry and host cgroups.
 		log.Warningf("could not get container cpu usage from cgroups, error:  %v", err)
-
 		out.ContainerUsage = control.ContainerUsage(cm.l.k)
-	} else {
-		out.Event.Data.CPU.Usage.Total = cpuUsage
 	}
 	return nil
 }
+
+func (cm *containerManager) getCPUUsageFromCgroups() (map[string]uint64, error) {
+	usage := make(map[string]uint64)
+
+	cm.l.mu.Lock()
+	defer cm.l.mu.Unlock()
+
+	for cid := range cm.l.containerIDs {
+		cpuacctFile := control.CgroupControlFile{
+			Controller: "cpuacct",
+			Path:       "/" + cid,
+			Name:       "cpuacct.usage",
+		}
+		cpuUsage, err := cm.getUsageFromCgroups(cpuacctFile)
+		if err != nil {
+			return nil, err
+		}
+		usage[cid] = cpuUsage
+	}
+	return usage, nil
+}

runsc/container/container.go

@@ -574,10 +574,8 @@ func (c *Container) Event() (*boot.EventOut, error) {
 		return nil, err
 	}
 
-	if len(event.ContainerUsage) > 0 {
-		// Some stats can utilize host cgroups for accuracy.
-		c.populateStats(event)
-	}
+	// CPU stats can utilize host cgroups for accuracy.
+	c.populateStats(event)
 
 	return event, nil
 }
@@ -1708,9 +1706,9 @@ func (c *Container) populateStats(event *boot.EventOut) {
 
 	var containerUsage uint64
 	var allContainersUsage uint64
-	for ID, usage := range event.ContainerUsage {
+	for id, usage := range event.ContainerUsage {
 		allContainersUsage += usage
-		if ID == c.ID {
+		if id == c.ID {
 			containerUsage = usage
 		}
 	}