cgroup: add support for more systemd properties

[giuseppe]

Closes: #1576

[kolyshkin]

LGTM

PS you can see which props runc translates in https://github.com/opencontainers/runc/blob/main/docs/systemd.md#cgroup-v2

[giuseppe]

Thanks for the review and the hint!

I've done some fixes to handle MemoryLow (so now memory->reservation is honored) and added a patch to handle cpu.idle.

[giuseppe]

I've added basic support for devices management as well (barely tested though!). Pushed to trigger the CI

[kolyshkin]

One thing runc does is it checks systemd version to make sure we only set properties that this version of systemd can understand. For example, MemoryZSwapMax is only available since systemd v253 and it should not be set if we're running an older version.

This gets more complicated for distros which backports some systemd stuff, and I haven't found an easy solution to that. Theoretically, we can list all properties of whatever uint and see if the one we're about to set is among them, but as far as I remember I played with it only to realize this is costly (even when done once per container start).

[giuseppe]

One thing runc does is it checks systemd version to make sure we only set properties that this version of systemd can understand. For example, MemoryZSwapMax is only available since systemd v253 and it should not be set if we're running an older version.

This gets more complicated for distros which backports some systemd stuff, and I haven't found an easy solution to that. Theoretically, we can list all properties of whatever uint and see if the one we're about to set is among them, but as far as I remember I played with it only to realize this is costly (even when done once per container start).

I've added a mechanism to detect unsupported properties and cache the result.

[packit-as-a-service]

Ephemeral COPR build failed. @containers/packit-build please check.

[sohankunkerkar]

LGTM from the CRI-O side (k8s e2e tests looks green).

[giuseppe]

@rhatdan @flouthoc PTAL

[flouthoc]

LGTM