config: Add DisableSpeculationMitigations

Kenta Tada · Kenta Tada · commit df667500fe09 · 2020-06-01T12:08:23.000+09:00
It disables speculative execution mitigations in the container. For more information about that, please refer to: opencontainers/runc#2430 Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>
diff --git a/config.md b/config.md
@@ -208,6 +208,7 @@ For Linux-based systems, the `process` object supports the following process-spe
     For more information on how these two settings work together, see [the memory cgroup documentation section 10. OOM Contol][cgroup-v1-memory_2].
 * **`selinuxLabel`** (string, OPTIONAL) specifies the SELinux label for the process.
     For more information about SELinux, see  [SELinux documentation][selinux].
+* **`disableSpeculationMitigations`** (bool, OPTIONAL) setting `disableSpeculationMitigations` to true disable speculative execution mitigations to improve the performance.
 
 ### <a name="configUser" />User
 
diff --git a/schema/config-schema.json b/schema/config-schema.json
@@ -166,6 +166,9 @@
                             }
                         }
                     }
+                },
+                "disableSpeculationMitigations": {
+                    "type": "boolean"
                 }
             }
         },
diff --git a/schema/test/config/good/spec-example.json b/schema/test/config/good/spec-example.json
@@ -56,7 +56,8 @@
         ],
         "apparmorProfile": "acme_secure_profile",
         "selinuxLabel": "system_u:system_r:svirt_lxc_net_t:s0:c124,c675",
-        "noNewPrivileges": true
+        "noNewPrivileges": true,
+        "disableSpeculationMitigations": false
     },
     "root": {
         "path": "rootfs",
diff --git a/specs-go/config.go b/specs-go/config.go
@@ -58,6 +58,8 @@ type Process struct {
 	OOMScoreAdj *int `json:"oomScoreAdj,omitempty" platform:"linux"`
 	// SelinuxLabel specifies the selinux context that the container process is run as.
 	SelinuxLabel string `json:"selinuxLabel,omitempty" platform:"linux"`
+	// DisableSpeculationMitigations disables speculative execution mitigations
+	DisableSpeculationMitigations bool `json:"disableSpeculationMitigations,omitempty" platform:"linux"`
 }
 
 // LinuxCapabilities specifies the whitelist of capabilities that are kept for a process.

Original file line number	Diff line number	Diff line change
`@@ -166,6 +166,9 @@`
`166`	`166`	`}`
`167`	`167`	`}`
`168`	`168`	`}`
	`169`	`+ },`
	`170`	`+ "disableSpeculationMitigations": {`
	`171`	`+ "type": "boolean"`
`169`	`172`	`}`
`170`	`173`	`}`
`171`	`174`	`},`
Original file line number	Diff line number	Diff line change
`@@ -58,6 +58,8 @@ type Process struct {`
`58`	`58`	OOMScoreAdj *int `json:"oomScoreAdj,omitempty" platform:"linux"`
`59`	`59`	`// SelinuxLabel specifies the selinux context that the container process is run as.`
`60`	`60`	SelinuxLabel string `json:"selinuxLabel,omitempty" platform:"linux"`
	`61`	`+ // DisableSpeculationMitigations disables speculative execution mitigations`
	`62`	+ DisableSpeculationMitigations bool `json:"disableSpeculationMitigations,omitempty" platform:"linux"`
`61`	`63`	`}`
`62`	`64`
`63`	`65`	`// LinuxCapabilities specifies the whitelist of capabilities that are kept for a process.`