Import security updates

config/config.go

@@ -444,6 +444,45 @@ func Set(c *Configuration) {
 	_config = c
 }
 
+// ResolveToken populates the derived Token field, preferring values pinned
+// through the environment over those in the configuration itself.
+//
+// Set remote when the values came from the Panel. Local values may use
+// "file://" or "$VAR" indirection; expanding one sent over the network would
+// leak files and environment variables back out through the token we attach to
+// every request. Environment overrides must already match remote values so a
+// configuration update cannot leave Wings and the Panel using different keys.
+func (c *Configuration) ResolveToken(remote bool) error {
+	resolve := func(name, env, local string) (string, error) {
+		if remote && (strings.Contains(local, "$") || strings.HasPrefix(local, "file://")) {
+			return "", fmt.Errorf("config: remote %s cannot use token indirection", name)
+		}
+		if env != "" {
+			value, err := Expand(env)
+			if err != nil {
+				return "", err
+			}
+			if remote && value != local {
+				return "", fmt.Errorf("config: remote %s does not match environment override", name)
+			}
+			return value, nil
+		}
+		if remote {
+			return local, nil
+		}
+		return Expand(local)
+	}
+
+	var err error
+	if c.Token.ID, err = resolve("token ID", os.Getenv("WINGS_TOKEN_ID"), c.AuthenticationTokenId); err != nil {
+		return err
+	}
+	if c.Token.Token, err = resolve("token", os.Getenv("WINGS_TOKEN"), c.AuthenticationToken); err != nil {
+		return err
+	}
+	return nil
+}
+
 // SetDebugViaFlag tracks if the application is running in debug mode because of
 // a command line flag argument. If so we do not want to store that configuration
 // change to the disk.
@@ -614,31 +653,14 @@ func FromFile(path string) error {
 		return err
 	}
 
-	c.Token = Token{
-		ID:    os.Getenv("WINGS_TOKEN_ID"),
-		Token: os.Getenv("WINGS_TOKEN"),
-	}
-	if c.Token.ID == "" {
-		c.Token.ID = c.AuthenticationTokenId
-	}
-	if c.Token.Token == "" {
-		c.Token.Token = c.AuthenticationToken
-	}
-
-	c.Token.ID, err = Expand(c.Token.ID)
-	if err != nil {
-		return err
-	}
-	c.Token.Token, err = Expand(c.Token.Token)
-	if err != nil {
+	if err := c.ResolveToken(false); err != nil {
 		return err
 	}
 
 	// Store this configuration in the global state.
 	Set(c)
 	return nil
 }
-
 // ConfigureDirectories ensures that all the system directories exist on the
 // system. These directories are created so that only the owner can read the data,
 // and no other users.
@@ -863,7 +885,7 @@ func Expand(v string) (string, error) {
 
 		b, err := os.ReadFile(p)
 		if err != nil {
-			return "", nil
+			return "", err
 		}
 		v = string(bytes.TrimRight(bytes.TrimRight(b, "\r"), "\n"))
 	}

config/config_docker.go

@@ -78,6 +78,28 @@ type DockerConfiguration struct {
 		Cpu    int64 `default:"100" json:"cpu" yaml:"cpu"`
 	} `json:"installer_limits" yaml:"installer_limits"`
 
+	// CpuPeriod is the length of a CFS scheduling window in microseconds. Server
+	// quotas scale with it, so the configured CPU limits stay the same. A shorter
+	// period reduces the worst case throttle latency at the cost of additional
+	// scheduler overhead.
+	CpuPeriod int64 `default:"100000" json:"cpu_period" yaml:"cpu_period"`
+
+	// CpuBurst allows containers to bank unused CFS quota within a period and spend
+	// it on short spikes without raising their long term CPU limit. Percent sizes the
+	// burst relative to a server's quota and is capped at 100 by the kernel. Requires
+	// Linux 5.14 or newer, it is skipped silently otherwise.
+	CpuBurst struct {
+		Enabled bool  `default:"true" json:"enabled" yaml:"enabled"`
+		Percent int64 `default:"100" json:"percent" yaml:"percent"`
+	} `json:"cpu_burst" yaml:"cpu_burst"`
+
+	// CpuShares is the relative CFS weight of server containers when the host is
+	// fully saturated, it limits nothing on an idle host. Zero leaves containers
+	// at the engine default. Wings historically set 1024, which cgroup v2 converts
+	// to less than half of the default weight, set that value to restore the old
+	// bias towards host system services.
+	CpuShares int64 `default:"0" json:"cpu_shares" yaml:"cpu_shares"`
+
 	// Overhead controls the memory overhead given to all containers to circumvent certain
 	// software such as the JVM not staying below the maximum memory limit.
 	Overhead Overhead `json:"overhead" yaml:"overhead"`
@@ -101,6 +123,12 @@ type DockerConfiguration struct {
 	} `json:"log_config" yaml:"log_config"`
 }
 
+// CpuPeriodMicroseconds returns the configured CFS period clamped to the range
+// the kernel accepts.
+func (c DockerConfiguration) CpuPeriodMicroseconds() int64 {
+	return min(max(c.CpuPeriod, 1_000), 1_000_000)
+}
+
 func (c DockerConfiguration) ContainerLogConfig() container.LogConfig {
 	if c.LogConfig.Type == "" {
 		return container.LogConfig{}

config/config_docker_test.go

@@ -82,6 +82,28 @@ func TestDockerRegistryCredentialsForImage(t *testing.T) {
 	}
 }
 
+func TestCpuPeriodMicroseconds(t *testing.T) {
+	tests := []struct {
+		name     string
+		period   int64
+		expected int64
+	}{
+		{name: "default period", period: 100_000, expected: 100_000},
+		{name: "shorter period", period: 20_000, expected: 20_000},
+		{name: "below kernel minimum", period: 500, expected: 1_000},
+		{name: "above kernel maximum", period: 5_000_000, expected: 1_000_000},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := DockerConfiguration{CpuPeriod: tt.period}
+			if v := cfg.CpuPeriodMicroseconds(); v != tt.expected {
+				t.Errorf("expected %d, got %d", tt.expected, v)
+			}
+		})
+	}
+}
+
 func TestDockerRegistryPathCredentialsDoNotMatchSiblingPath(t *testing.T) {
 	cfg := DockerConfiguration{
 		Registries: map[string]RegistryConfiguration{

config/config_token_test.go

@@ -0,0 +1,60 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestResolveRemoteToken(t *testing.T) {
+	t.Setenv("WINGS_TOKEN_ID", "")
+	t.Setenv("WINGS_TOKEN", "")
+
+	cfg := Configuration{
+		AuthenticationTokenId: "panel-id",
+		AuthenticationToken:   "panel-token",
+	}
+	if err := cfg.ResolveToken(true); err != nil {
+		t.Fatalf("expected remote credentials to resolve: %v", err)
+	}
+	if cfg.Token.ID != "panel-id" || cfg.Token.Token != "panel-token" {
+		t.Fatalf("unexpected resolved credentials: %#v", cfg.Token)
+	}
+}
+
+func TestResolveRemoteTokenRejectsIndirection(t *testing.T) {
+	t.Setenv("WINGS_TOKEN_ID", "")
+	t.Setenv("WINGS_TOKEN", "")
+
+	tests := []Configuration{
+		{AuthenticationTokenId: "file:///tmp/id", AuthenticationToken: "panel-token"},
+		{AuthenticationTokenId: "panel-id", AuthenticationToken: "$PANEL_TOKEN"},
+	}
+	for _, cfg := range tests {
+		if err := cfg.ResolveToken(true); err == nil {
+			t.Fatal("expected remote token indirection to be rejected")
+		}
+	}
+}
+
+func TestResolveRemoteTokenRequiresEnvironmentMatch(t *testing.T) {
+	secret := filepath.Join(t.TempDir(), "token")
+	if err := os.WriteFile(secret, []byte("panel-token\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("WINGS_TOKEN_ID", "panel-id")
+	t.Setenv("WINGS_TOKEN", "file://"+secret)
+
+	cfg := Configuration{
+		AuthenticationTokenId: "panel-id",
+		AuthenticationToken:   "panel-token",
+	}
+	if err := cfg.ResolveToken(true); err != nil {
+		t.Fatalf("expected matching environment credentials to resolve: %v", err)
+	}
+
+	cfg.AuthenticationToken = "rotated-token"
+	if err := cfg.ResolveToken(true); err == nil {
+		t.Fatal("expected mismatched environment credentials to be rejected")
+	}
+}

environment/docker/cgroup_burst.go

@@ -0,0 +1,131 @@
+package docker
+
+import (
+	"context"
+	"os"
+	"path"
+	"strconv"
+	"strings"
+	"sync"
+
+	"emperror.dev/errors"
+	"github.com/apex/log"
+	"github.com/docker/docker/client"
+
+	"github.com/pelican/wings/config"
+)
+
+// cgroupV2 reports whether the host uses the unified cgroup v2 hierarchy.
+var cgroupV2 = sync.OnceValue(func() bool {
+	_, err := os.Stat("/sys/fs/cgroup/cgroup.controllers")
+	return err == nil
+})
+
+var burstWarning sync.Once
+
+// cpuBurstMicroseconds returns the burst allowance in microseconds for the given
+// CFS quota and configured percentage. The kernel rejects a burst larger than the
+// quota, so the value is clamped to it.
+func cpuBurstMicroseconds(quota int64, percent int64) int64 {
+	if quota <= 0 || percent <= 0 {
+		return 0
+	}
+	if percent > 100 {
+		percent = 100
+	}
+	return quota * percent / 100
+}
+
+// resolveCgroupCpuFile parses the contents of a /proc/<pid>/cgroup file and
+// returns the absolute path of the CFS burst file for that process's cgroup.
+func resolveCgroupCpuFile(procCgroup string, v2 bool) (string, error) {
+	for _, line := range strings.Split(procCgroup, "\n") {
+		parts := strings.SplitN(line, ":", 3)
+		if len(parts) != 3 || !strings.HasPrefix(parts[2], "/") || strings.Contains(parts[2], "..") {
+			continue
+		}
+		if v2 {
+			if parts[0] == "0" && parts[1] == "" {
+				return path.Join("/sys/fs/cgroup", parts[2], "cpu.max.burst"), nil
+			}
+			continue
+		}
+		for _, controller := range strings.Split(parts[1], ",") {
+			if controller == "cpu" {
+				return path.Join("/sys/fs/cgroup/cpu", parts[2], "cpu.cfs_burst_us"), nil
+			}
+		}
+	}
+	return "", errors.New("environment/docker: no cpu controller found in cgroup file")
+}
+
+// writeCpuBurst writes a burst value in microseconds into the cpu cgroup of the
+// given process. This is expected to fail on kernels older than 5.14 or when the
+// cgroup hierarchy is not writable by Wings, so failures are only logged.
+func writeCpuBurst(l *log.Entry, pid int, burst int64) {
+	if pid <= 0 {
+		return
+	}
+	if err := writeBurstFile(pid, burst); err != nil {
+		logBurstFailure(l.WithField("error", err), burst)
+		return
+	}
+	l.WithField("burst_us", burst).Debug("updated container cpu burst")
+}
+
+func writeBurstFile(pid int, burst int64) error {
+	b, err := os.ReadFile("/proc/" + strconv.Itoa(pid) + "/cgroup")
+	if err != nil {
+		return err
+	}
+	f, err := resolveCgroupCpuFile(string(b), cgroupV2())
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(f, []byte(strconv.FormatInt(burst, 10)), 0o644)
+}
+
+// logBurstFailure warns the first time a burst cannot be applied and stays at
+// debug otherwise. Failed clears are always quiet since a host that never
+// accepted a burst has nothing to clear.
+func logBurstFailure(l *log.Entry, burst int64) {
+	if burst > 0 {
+		first := false
+		burstWarning.Do(func() { first = true })
+		if first {
+			l.Warn("failed to set cpu burst, this requires Linux 5.14 or newer and a writable cgroup hierarchy")
+			return
+		}
+	}
+	l.Debug("failed to set cpu burst")
+}
+
+// SetCpuBurst applies the configured CFS burst to a running container based on
+// the CFS quota in microseconds it was created with. This is a no-op when
+// bursting is disabled or the container has no CPU limit.
+func SetCpuBurst(ctx context.Context, cli *client.Client, containerID string, quota int64) {
+	cfg := config.Get().Docker.CpuBurst
+	if !cfg.Enabled || quota <= 0 {
+		return
+	}
+	c, err := cli.ContainerInspect(ctx, containerID)
+	if err != nil || c.State == nil {
+		return
+	}
+	writeCpuBurst(log.WithField("container_id", containerID), c.State.Pid, cpuBurstMicroseconds(quota, cfg.Percent))
+}
+
+// applyCpuBurst applies the configured CFS burst to the environment's container
+// using its current CPU limit.
+func (e *Environment) applyCpuBurst(ctx context.Context) {
+	quota := e.Configuration.Limits().CpuLimit * config.Get().Docker.CpuPeriodMicroseconds() / 100
+	SetCpuBurst(ctx, e.client, e.Id, quota)
+}
+
+// clearCpuBurst zeroes the CFS burst for the given container process. This must
+// happen before a quota change is applied since the kernel rejects a quota lower
+// than the current burst. It runs even when bursting is disabled so a value set
+// before the feature was turned off cannot block future quota changes.
+func (e *Environment) clearCpuBurst(pid int) {
+	writeCpuBurst(e.log(), pid, 0)
+}