Merge pull request #28347 from Honny1/machine-cpu-limits

Reject `--cpus` above host CPU count on podman machine init and set

Author: TomSweeneyRedHat

cmd/podman/machine/init.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"runtime"
 	"slices"
 
 	"github.com/containers/podman/v6/cmd/podman/registry"
@@ -252,10 +253,11 @@ func initMachine(cmd *cobra.Command, args []string) error {
 		initOpts.UserModeNetworking = &initOptionalFlags.UserModeNetworking
 	}
 
-	if cmd.Flags().Changed("memory") {
-		if err := checkMaxMemory(strongunits.MiB(initOpts.Memory)); err != nil {
-			return err
-		}
+	if err := checkMaxMemory(strongunits.MiB(initOpts.Memory)); err != nil {
+		return err
+	}
+	if err := checkMaxCPUs(initOpts.CPUS); err != nil {
+		return err
 	}
 
 	// initOpts.SkipTlsVerify defaults to OptionalBoolUndefined, which means the backend library
@@ -320,3 +322,12 @@ func checkMaxMemory(newMem strongunits.MiB) error {
 	}
 	return nil
 }
+
+// checkMaxCPUs compares requested CPUs to the host (runtime.NumCPU).
+func checkMaxCPUs(requestedCPUs uint64) error {
+	hostCPUs := uint64(runtime.NumCPU())
+	if requestedCPUs > hostCPUs {
+		return fmt.Errorf("requested number of CPUs (%d) greater than number of host CPUs (%d)", requestedCPUs, hostCPUs)
+	}
+	return nil
+}

cmd/podman/machine/set.go

@@ -98,6 +98,9 @@ func setMachine(cmd *cobra.Command, args []string) error {
 		setOpts.Rootful = &setFlags.Rootful
 	}
 	if cmd.Flags().Changed("cpus") {
+		if err := checkMaxCPUs(setFlags.CPUs); err != nil {
+			return err
+		}
 		setOpts.CPUs = &setFlags.CPUs
 	}
 	if cmd.Flags().Changed("memory") {

pkg/machine/e2e/init_test.go

@@ -81,6 +81,12 @@ var _ = Describe("podman machine init", func() {
 		Expect(err).ToNot(HaveOccurred())
 		Expect(badMemSession.errorToString()).To(ContainSubstring(fmt.Sprintf("greater than total system memory (%d MB)", systemMem)))
 		Expect(badMemSession).To(Exit(125))
+
+		badCPU := initMachine{}
+		badCPUSession, err := mb.setCmd(badCPU.withCPUs(9999999)).run()
+		Expect(err).ToNot(HaveOccurred())
+		Expect(badCPUSession).To(Exit(125))
+		Expect(badCPUSession.errorToString()).To(ContainSubstring("greater than number of host CPUs"))
 	})
 
 	It("init volume check", func() {

pkg/machine/e2e/set_test.go

@@ -13,6 +13,21 @@ import (
 )
 
 var _ = Describe("podman machine set", func() {
+	It("machine set rejects excessive cpus", func() {
+		skipIfWSL("WSL cannot change cpus via set")
+		name := randomString()
+		i := new(initMachine)
+		session, err := mb.setName(name).setCmd(i.withImage(mb.imagePath)).run()
+		Expect(err).ToNot(HaveOccurred())
+		Expect(session).To(Exit(0))
+
+		badSet := setMachine{}
+		badCPUSession, err := mb.setName(name).setCmd(badSet.withCPUs(9999999)).run()
+		Expect(err).ToNot(HaveOccurred())
+		Expect(badCPUSession).To(Exit(125))
+		Expect(badCPUSession.errorToString()).To(ContainSubstring("greater than number of host CPUs"))
+	})
+
 	It("set machine cpus, disk, memory", func() {
 		skipIfWSL("WSL cannot change set properties of disk, processor, or memory")
 		name := randomString()