specs-go/config: add systemd cgroup support

The `--systemd-cgroup` flag and the systemd cgroup path convention
currently implemented in `runc/crun` should be added to the spec.

This patch adds in the spec:
* the option to enable systemd cgroup;
* the configs of systemd units and the containing slice to map to the
  cgroup tree.

Fixes #1021

Signed-off-by: Kailun Qin <[email protected]>

Author: kailun-qin

config-linux.md

@@ -214,6 +214,54 @@ Runtimes MAY attach the container process to additional cgroup controllers beyon
 }
 ```
 
+### <a name="configLinuxSystemdCgroup" />Systemd Cgroup
+
+* **`systemdCgroup`** *(bool, OPTIONAL)* - enables or disables systemd cgroup support.
+    If enabled (`true`), the container runtime switches to the systemd cgroup driver for creating
+    cgroups and setting cgroup limits.
+
+* **`systemdCgroupsPath`** (object, OPTIONAL) - sets the systemd cgroups path configurations.
+    By specifying with the transient systemd unit to create for the container and the containing
+    slice which hosts the unit, the systemd units directly map to objects in the cgroup tree.
+    When these units are activated, they map directly to cgroup paths built from the unit names.
+
+The following parameters can be specified to set up the `systemdCgroupsPath`:
+Each entry has the following structure:
+
+* **`type`** *(string, REQUIRED)* - type of the systemd unit: `scope` or `slice`.
+* **`parentSlice`** *(string, OPTIONAL)* - name of the parent slice with type suffix, under which the container is placed.
+    Note that `slice` can contain dashes to denote a sub-slice (e.g. `user-1000.slice` is a correct
+    notation, meaning a subslice of `user.slice`), but it must not contain slashes (e.g.
+    `user.slice/user-1000.slice` is invalid).
+    There might be some slices already created by default, for example:
+	`-.slice` - the root slice;
+	`system.slice` - the default place for all system services;
+	`user.slice` - the default place for all user sessions.
+* **`name`** *(string, OPTIONAL)* - systemd unit name (without type suffix).
+
+### Example
+
+```json
+"systemdCgroup": true,
+"systemdCgroupsPath": {
+    "type": "scope",
+    "parentSlice": "user.slice",
+    "name": "runtime-foo"
+},
+"resources": {
+    "memory": {
+    "limit": 100000,
+    "reservation": 200000
+    },
+    "devices": [
+        {
+            "allow": false,
+            "access": "rwm"
+        }
+    ]
+}
+```
+
 ### <a name="configLinuxDeviceAllowedlist" />Allowed Device list
 
 **`devices`** (array of objects, OPTIONAL) configures the [allowed device list][cgroup-v1-devices].

specs-go/config.go

@@ -163,6 +163,13 @@ type Linux struct {
 	// The path is expected to be relative to the cgroups mountpoint.
 	// If resources are specified, the cgroups at CgroupsPath will be updated based on resources.
 	CgroupsPath string `json:"cgroupsPath,omitempty"`
+	// SystemdCgroup controls whether to enable systemd cgroup support.
+	SystemdCgroup bool `json:"systemdCgroup,omitempty"`
+	// SystemdCgroupsPath specifies the transient systemd unit to create for the container and the
+	// containing slice which hosts the unit. The systemd units directly map to objects in the
+	// cgroup tree. When these units are activated, they map directly to cgroup paths built from the
+	// unit names.
+	SystemdCgroupsPath LinuxSystemdCgroupsPath `json:"systemdCgroupsPath,omitempty"`
 	// Namespaces contains the namespaces that are created and/or joined by the container
 	Namespaces []LinuxNamespace `json:"namespaces,omitempty"`
 	// Devices are a list of device nodes that are created for the container
@@ -184,6 +191,36 @@ type Linux struct {
 	Personality *LinuxPersonality `json:"personality,omitempty"`
 }
 
+// LinuxSystemdCgroupsPath specifies the transient systemd unit to create for the container and the
+// containing slice which hosts the unit.
+type LinuxSystemdCgroupsPath struct {
+	// Type is the type of the systemd unit.
+	Type SystemdUnitType `json:"type"`
+	// ParentSlice specifies the name of the parent slice with type suffix, under which the
+	// container is placed. Some examples below:
+	// `-.slice` - the root slice;
+	// `system.slice` - the default place for all system services;
+	// `user.slice` - the default place for all user sessions.
+	ParentSlice string `json:"parentSlice,omitempty"`
+	// Name is the systemd unit name (without type suffix).
+	Name string `json:"name,omitempty"`
+}
+
+// SystemdUnitType defines the type of the systemd unit.
+type SystemdUnitType string
+
+// SystemdUnitType defines the type of the systemd unit.
+const (
+	// Scope is a group of externally created processes.
+	// Scopes encapsulate processes that are started and stopped by arbitrary processes through the
+	// fork() function and then registered by systemd at runtime.
+	Scope SystemdUnitType = "scope"
+	// Slice is a group of hierarchically organized units.
+	// Slices do not contain processes, they organize a hierarchy in which scopes and services are
+	// placed.
+	Slice SystemdUnitType = "slice"
+)
+
 // LinuxNamespace is the configuration for a Linux namespace
 type LinuxNamespace struct {
 	// Type is the type of namespace