Cgroup adopt

[reboss]

- What I did

Added support for automatic cgroup adoption via a new daemon configuration option --adopt-user-cgroups. When enabled, containers automatically inherit their creator's cgroup parent instead of running under the default Docker cgroup. This enables better resource isolation and accounting in multi-user environments where users should not be able to escape their systemd resource constraints.

This feature is particularly useful in:

• Multi-tenant environments where users have resource limits enforced via systemd
• HPC environments where job schedulers track resource usage via cgroups
• Systems where containers should respect the resource constraints of the user who created them

- How I did it

The implementation follows a clean architectural pattern:

1. Peer credential extraction - Created middleware (daemon/server/middleware/peercred_linux.go) that extracts UID/GID/PID from Unix socket connections using the SO_PEERCRED syscall and stores them in the request context.

2. Cgroup derivation - Added utility (pkg/cgroups/adoption_linux.go) that reads /proc/<pid>/cgroup and parses both cgroup v1 and v2 formats to derive the user's cgroup parent (extracts the deepest .slice component).

3. Daemon configuration - Added AdoptUserCgroups bool field to daemon config with corresponding --adopt-user-cgroups CLI flag.

4. Enforcement at daemon layer - Modified adaptContainerSettings() in daemon/daemon_unix.go to call applyCgroupAdoption() when the feature is enabled. The enforcement uses a strict model: if a user tries to specify a different cgroup parent than the adopted one, the request is rejected with an InvalidParameter error.

5. Platform support - Linux-specific implementations with no-op stubs for other platforms.

All code follows test-driven development with comprehensive unit and integration tests.

- How to verify it

1. Start dockerd with the feature enabled:

   sudo dockerd --adopt-user-cgroups

2. Check your current cgroup:

   cat /proc/$$/cgroup
   # Example output (cgroup v2): 0::/user.slice/user-1000.slice/session-3.scope

3. Create a container:

   docker run -d --name test nginx

4. Verify the container inherited your cgroup parent:

   docker inspect test | jq '.[0].HostConfig.CgroupParent'
   # Should show: /user.slice/user-1000.slice (or similar)

5. Verify enforcement - attempting to override should fail:

   docker run --cgroup-parent /custom/parent nginx
   # Should error: "cannot set cgroup parent when --adopt-user-cgroups is enabled"

6. Run the test suite:

   # Unit tests
   make test-unit TESTDIRS='./pkg/cgroups ./daemon/server/middleware'
   
   # Integration tests
   make test-integration TESTFLAGS='-test.run TestCgroupAdoption'

- Human readable description for the release notes

+ Add `--adopt-user-cgroups` daemon flag to automatically set container cgroup parent based on the API client's cgroup (Linux only)

- A picture of a cute animal (not mandatory but encouraged)