You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by mp...@apache.org on 2016/09/15 00:49:05 UTC

[4/6] mesos git commit: Cleaned up usage of namespace-qualified identifiers.

Cleaned up usage of namespace-qualified identifiers.

If a file contains `using foo::bar`, the remainder of the file
should generally use `bar`, rather than `foo::bar` (or worse, a mix
of `foo::bar` and `bar`).

Review: https://reviews.apache.org/r/51150/


Project: http://git-wip-us.apache.org/repos/asf/mesos/repo
Commit: http://git-wip-us.apache.org/repos/asf/mesos/commit/4a7490a2
Tree: http://git-wip-us.apache.org/repos/asf/mesos/tree/4a7490a2
Diff: http://git-wip-us.apache.org/repos/asf/mesos/diff/4a7490a2

Branch: refs/heads/master
Commit: 4a7490a2833de791a5ac6f61964f5ffea54fe134
Parents: 5ef0b08
Author: Neil Conway <ne...@gmail.com>
Authored: Tue Sep 13 19:16:29 2016 +0200
Committer: Michael Park <mp...@apache.org>
Committed: Wed Sep 14 15:01:58 2016 +0200

----------------------------------------------------------------------
 src/common/http.cpp                             |   6 +-
 src/docker/executor.cpp                         |   2 +-
 src/linux/fs.cpp                                |   2 +-
 src/local/local.cpp                             |   2 +-
 src/master/allocator/mesos/hierarchical.cpp     |   2 +-
 src/master/allocator/sorter/drf/metrics.cpp     |   2 +-
 src/master/http.cpp                             |   6 +-
 src/master/weights_handler.cpp                  |   6 +-
 .../mesos/isolators/cgroups/net_cls.cpp         | 500 +++++++++++++++++++
 .../mesos/isolators/docker/volume/driver.cpp    |   2 +-
 .../mesos/isolators/network/cni/cni.cpp         |   8 +-
 .../containerizer/mesos/isolators/xfs/disk.cpp  |   2 +-
 .../containerizer/mesos/isolators/xfs/utils.cpp |   2 +-
 src/slave/containerizer/mesos/launch.cpp        |   4 +-
 .../mesos/provisioner/appc/cache.cpp            |   2 +-
 src/slave/slave.cpp                             |   6 +-
 src/tests/containerizer/xfs_quota_tests.cpp     |   4 +-
 src/tests/dynamic_weights_tests.cpp             |   2 +-
 src/tests/files_tests.cpp                       |   6 +-
 src/tests/log_tests.cpp                         |   2 +-
 src/tests/mesos.cpp                             |  24 +-
 src/tests/partition_tests.cpp                   |   2 +-
 src/tests/resources_tests.cpp                   |   2 +-
 src/tests/slave_recovery_tests.cpp              |  12 +-
 24 files changed, 554 insertions(+), 54 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/common/http.cpp
----------------------------------------------------------------------
diff --git a/src/common/http.cpp b/src/common/http.cpp
index 65e7323..538330a 100644
--- a/src/common/http.cpp
+++ b/src/common/http.cpp
@@ -802,10 +802,10 @@ bool approveViewFlags(
 
 
 process::Future<bool> authorizeEndpoint(
-    const std::string& endpoint,
-    const std::string& method,
+    const string& endpoint,
+    const string& method,
     const Option<Authorizer*>& authorizer,
-    const Option<std::string>& principal)
+    const Option<string>& principal)
 {
   if (authorizer.isNone()) {
     return true;

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/docker/executor.cpp
----------------------------------------------------------------------
diff --git a/src/docker/executor.cpp b/src/docker/executor.cpp
index f5981b0..ab3f047 100644
--- a/src/docker/executor.cpp
+++ b/src/docker/executor.cpp
@@ -732,7 +732,7 @@ int main(int argc, char** argv)
 
     // Convert from JSON to map.
     foreachpair (
-        const std::string& key,
+        const string& key,
         const JSON::Value& value,
         json->values) {
       if (!value.is<JSON::String>()) {

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/linux/fs.cpp
----------------------------------------------------------------------
diff --git a/src/linux/fs.cpp b/src/linux/fs.cpp
index 14ae5a9..369a302 100644
--- a/src/linux/fs.cpp
+++ b/src/linux/fs.cpp
@@ -53,7 +53,7 @@ namespace internal {
 namespace fs {
 
 
-Try<bool> supported(const std::string& fsname)
+Try<bool> supported(const string& fsname)
 {
   hashset<string> overlayfs{"overlay", "overlayfs"};
 

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/local/local.cpp
----------------------------------------------------------------------
diff --git a/src/local/local.cpp b/src/local/local.cpp
index 1e1d246..450e2c1 100644
--- a/src/local/local.cpp
+++ b/src/local/local.cpp
@@ -176,7 +176,7 @@ PID<Master> launch(const Flags& flags, Allocator* _allocator)
       << flags.work_dir << "': " << mkdir.error();
   }
 
-  std::map<std::string, std::string> propagated_flags;
+  map<string, string> propagated_flags;
   propagated_flags["work_dir"] = flags.work_dir;
 
   {

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/master/allocator/mesos/hierarchical.cpp
----------------------------------------------------------------------
diff --git a/src/master/allocator/mesos/hierarchical.cpp b/src/master/allocator/mesos/hierarchical.cpp
index 992031a..e866fd2 100644
--- a/src/master/allocator/mesos/hierarchical.cpp
+++ b/src/master/allocator/mesos/hierarchical.cpp
@@ -130,7 +130,7 @@ void HierarchicalAllocatorProcess::initialize(
              const hashmap<SlaveID, UnavailableResources>&)>&
       _inverseOfferCallback,
     const hashmap<string, double>& _weights,
-    const Option<set<std::string>>& _fairnessExcludeResourceNames)
+    const Option<set<string>>& _fairnessExcludeResourceNames)
 {
   allocationInterval = _allocationInterval;
   offerCallback = _offerCallback;

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/master/allocator/sorter/drf/metrics.cpp
----------------------------------------------------------------------
diff --git a/src/master/allocator/sorter/drf/metrics.cpp b/src/master/allocator/sorter/drf/metrics.cpp
index c793f32..baede07 100644
--- a/src/master/allocator/sorter/drf/metrics.cpp
+++ b/src/master/allocator/sorter/drf/metrics.cpp
@@ -40,7 +40,7 @@ namespace allocator {
 Metrics::Metrics(
     const UPID& _context,
     DRFSorter& _sorter,
-    const std::string& _prefix)
+    const string& _prefix)
   : context(_context),
     sorter(&_sorter),
     prefix(_prefix) {}

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/master/http.cpp
----------------------------------------------------------------------
diff --git a/src/master/http.cpp b/src/master/http.cpp
index df10b4e..9005e7c 100644
--- a/src/master/http.cpp
+++ b/src/master/http.cpp
@@ -1722,11 +1722,11 @@ public:
   explicit FlagsError(Type _type)
     : Error(stringify(_type)), type(_type) {}
 
-  FlagsError(Type _type, const std::string& _message)
+  FlagsError(Type _type, const string& _message)
     : Error(stringify(_type)), type(_type), message(_message) {}
 
   const Type type;
-  const std::string message;
+  const string message;
 };
 
 
@@ -3204,7 +3204,7 @@ string Master::Http::ROLES_HELP()
 
 
 Future<vector<string>> Master::Http::_roles(
-        const Option<std::string>& principal) const
+        const Option<string>& principal) const
 {
   // Retrieve `ObjectApprover`s for authorizing roles.
   Future<Owned<ObjectApprover>> rolesApprover;

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/master/weights_handler.cpp
----------------------------------------------------------------------
diff --git a/src/master/weights_handler.cpp b/src/master/weights_handler.cpp
index 9a901e7..c240fb2 100644
--- a/src/master/weights_handler.cpp
+++ b/src/master/weights_handler.cpp
@@ -155,7 +155,7 @@ Future<vector<WeightInfo>> Master::WeightsHandler::_filterWeights(
 
 Future<http::Response> Master::WeightsHandler::update(
     const http::Request& request,
-    const Option<std::string>& principal) const
+    const Option<string>& principal) const
 {
   VLOG(1) << "Updating weights from request: '" << request.body << "'";
 
@@ -185,7 +185,7 @@ Future<http::Response> Master::WeightsHandler::update(
 
 Future<http::Response> Master::WeightsHandler::update(
     const mesos::master::Call& call,
-    const Option<std::string>& principal,
+    const Option<string>& principal,
     ContentType /*contentType*/) const
 {
   CHECK_EQ(mesos::master::Call::UPDATE_WEIGHTS, call.type());
@@ -278,7 +278,7 @@ Future<http::Response> Master::WeightsHandler::__updateWeights(
 
 
 void Master::WeightsHandler::rescindOffers(
-    const std::vector<WeightInfo>& weightInfos) const
+    const vector<WeightInfo>& weightInfos) const
 {
   bool rescind = false;
 

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/slave/containerizer/mesos/isolators/cgroups/net_cls.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/isolators/cgroups/net_cls.cpp b/src/slave/containerizer/mesos/isolators/cgroups/net_cls.cpp
new file mode 100644
index 0000000..0a03990
--- /dev/null
+++ b/src/slave/containerizer/mesos/isolators/cgroups/net_cls.cpp
@@ -0,0 +1,500 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <list>
+#include <sstream>
+#include <vector>
+
+#include <process/defer.hpp>
+#include <process/future.hpp>
+#include <process/pid.hpp>
+
+#include <stout/numify.hpp>
+#include <stout/os.hpp>
+#include <stout/path.hpp>
+#include <stout/try.hpp>
+
+#include "linux/cgroups.hpp"
+
+#include "slave/flags.hpp"
+
+#include "slave/containerizer/mesos/isolators/cgroups/net_cls.hpp"
+
+using std::bitset;
+using std::list;
+using std::ostream;
+using std::set;
+using std::string;
+using std::stringstream;
+using std::vector;
+
+using process::Failure;
+using process::Future;
+using process::Owned;
+using process::PID;
+
+using mesos::slave::ContainerConfig;
+using mesos::slave::ContainerLaunchInfo;
+using mesos::slave::ContainerLimitation;
+using mesos::slave::ContainerState;
+using mesos::slave::Isolator;
+
+namespace mesos {
+namespace internal {
+namespace slave {
+
+Try<Isolator*> CgroupsNetClsIsolatorProcess::create(const Flags& flags)
+{
+  Try<string> hierarchy = cgroups::prepare(
+      flags.cgroups_hierarchy,
+      "net_cls",
+      flags.cgroups_root);
+
+  if (hierarchy.isError()) {
+    return Error("Failed to create net_cls cgroup: " + hierarchy.error());
+  }
+
+  // Ensure that no unexpected subsystem is attached to the hierarchy.
+  Try<set<string>> subsystems = cgroups::subsystems(hierarchy.get());
+  if (subsystems.isError()) {
+    return Error(
+        "Failed to get the list of attached subsystems for hierarchy "
+        "'" + hierarchy.get() + "'");
+  } else if (subsystems.get().size() != 1) {
+    // Some Linux distributions mount net_cls and net_prio subsystems
+    // to the same hierarchy.
+    // TODO(jieyu): If we ever introduce a cgroups net_prio isolator,
+    // we need to make sure it will not conflict with this isolator if
+    // two subsystems are co-mounted into the same hierarchy. For
+    // instance, we should not remove a cgroup twice.
+    foreach (const string& subsystem, subsystems.get()) {
+      if (subsystem != "net_cls" && subsystem != "net_prio") {
+        return Error(
+            "Unexpected subsystems found attached to hierarchy "
+            "'" + hierarchy.get() + "'");
+      }
+    }
+  }
+
+  IntervalSet<uint32_t> primaries;
+  IntervalSet<uint32_t> secondaries;
+
+  // Primary handle.
+  if (flags.cgroups_net_cls_primary_handle.isSome()) {
+    Try<uint16_t> primary = numify<uint16_t>(
+        flags.cgroups_net_cls_primary_handle.get());
+
+    if (primary.isError()) {
+      return Error(
+          "Failed to parse the primary handle '" +
+          flags.cgroups_net_cls_primary_handle.get() +
+          "' set in flag --cgroups_net_cls_primary_handle");
+    }
+
+    primaries +=
+      (Bound<uint32_t>::closed(primary.get()),
+       Bound<uint32_t>::closed(primary.get()));
+
+    // Range of valid secondary handles.
+    if (flags.cgroups_net_cls_secondary_handles.isSome()) {
+      vector<string> range =
+        strings::tokenize(flags.cgroups_net_cls_secondary_handles.get(), ",");
+
+      if (range.size() != 2) {
+        return Error(
+            "Failed to parse the range of secondary handles " +
+            flags.cgroups_net_cls_secondary_handles.get() +
+            " set in flag --cgroups_net_cls_secondary_handles");
+      }
+
+      Try<uint16_t> lower = numify<uint16_t>(range[0]);
+      if (lower.isError()) {
+        return Error(
+            "Failed to parse the lower bound of range of secondary handles" +
+            flags.cgroups_net_cls_secondary_handles.get() +
+            " set in flag --cgroups_net_cls_secondary_handles");
+      }
+
+      if (lower.get() == 0) {
+        return Error("The secondary handle has to be a non-zero value.");
+      }
+
+      Try<uint16_t> upper =  numify<uint16_t>(range[1]);
+      if (upper.isError()) {
+        return Error(
+            "Failed to parse the upper bound of range of secondary handles" +
+            flags.cgroups_net_cls_secondary_handles.get() +
+            " set in flag --cgroups_net_cls_secondary_handles");
+      }
+
+      secondaries +=
+        (Bound<uint32_t>::closed(lower.get()),
+         Bound<uint32_t>::closed(upper.get()));
+
+      if (secondaries.empty()) {
+        return Error(
+            "Secondary handle range specified " +
+            flags.cgroups_net_cls_secondary_handles.get() +
+            ", in flag --cgroups_net_cls_secondary_handles, is an empty set");
+      }
+    }
+  }
+
+  process::Owned<MesosIsolatorProcess> process(
+      new CgroupsNetClsIsolatorProcess(
+          flags,
+          hierarchy.get(),
+          primaries,
+          secondaries));
+
+  return new MesosIsolator(process);
+}
+
+
+CgroupsNetClsIsolatorProcess::CgroupsNetClsIsolatorProcess(
+    const Flags& _flags,
+    const string& _hierarchy,
+    const IntervalSet<uint32_t>& primaries,
+    const IntervalSet<uint32_t>& secondaries)
+  : ProcessBase(process::ID::generate("cgroups-net-cls-isolator")),
+    flags(_flags),
+    hierarchy(_hierarchy)
+{
+  if (!primaries.empty()) {
+    handleManager = NetClsHandleManager(primaries, secondaries);
+  }
+}
+
+
+CgroupsNetClsIsolatorProcess::~CgroupsNetClsIsolatorProcess() {}
+
+
+Future<Nothing> CgroupsNetClsIsolatorProcess::recover(
+    const list<ContainerState>& states,
+    const hashset<ContainerID>& orphans)
+{
+  foreach (const ContainerState& state, states) {
+    const ContainerID& containerId = state.container_id();
+    const string cgroup = path::join(flags.cgroups_root, containerId.value());
+
+    Try<bool> exists = cgroups::exists(hierarchy, cgroup);
+    if (exists.isError()) {
+      infos.clear();
+      return Failure(
+          "Failed to check cgroup for container " + stringify(containerId));
+    }
+
+    if (!exists.get()) {
+      VLOG(1) << "Couldn't find cgroup for container " << containerId;
+      // This may occur if the executor has exited and the isolator
+      // has destroyed the cgroup but the slave dies before noticing
+      // this. This will be detected when the containerizer tries to
+      // monitor the executor's pid.
+      continue;
+    }
+
+    // Read the net_cls handle.
+    Result<NetClsHandle> handle = recoverHandle(hierarchy, cgroup);
+    if (handle.isError()) {
+      infos.clear();
+      return Failure(
+          "Failed to recover the net_cls handle for " +
+          stringify(containerId) + ": " + handle.error());
+    }
+
+    if (handle.isSome()) {
+      infos.emplace(containerId, Info(cgroup, handle.get()));
+    } else {
+      infos.emplace(containerId, Info(cgroup));
+    }
+  }
+
+  // Remove orphan cgroups.
+  Try<vector<string>> cgroups = cgroups::get(hierarchy, flags.cgroups_root);
+  if (cgroups.isError()) {
+    infos.clear();
+    return Failure(cgroups.error());
+  }
+
+  foreach (const string& cgroup, cgroups.get()) {
+    // Ignore the slave cgroup (see the --agent_subsystems flag).
+    // TODO(idownes): Remove this when the cgroups layout is updated,
+    // see MESOS-1185.
+    if (cgroup == path::join(flags.cgroups_root, "slave")) {
+      continue;
+    }
+
+    ContainerID containerId;
+    containerId.set_value(Path(cgroup).basename());
+
+    if (infos.contains(containerId)) {
+      continue;
+    }
+
+    Result<NetClsHandle> handle = recoverHandle(hierarchy, cgroup);
+    if (handle.isError()) {
+      infos.clear();
+      return Failure(
+          "Failed to recover the net_cls handle for orphan container " +
+          stringify(containerId) + ": " + handle.error());
+    }
+
+    // Known orphan cgroups will be destroyed by the containerizer
+    // using the normal cleanup path. See MESOS-2367 for details.
+    if (orphans.contains(containerId)) {
+      if (handle.isSome()) {
+        infos.emplace(containerId, Info(cgroup, handle.get()));
+      } else {
+        infos.emplace(containerId, Info(cgroup));
+      }
+
+      continue;
+    }
+
+    LOG(INFO) << "Removing unknown orphaned cgroup '" << cgroup << "'";
+
+    // We don't wait on the destroy as we don't want to block recovery.
+    // TODO(jieyu): Release the handle after destroy has been done.
+    cgroups::destroy(hierarchy, cgroup, cgroups::DESTROY_TIMEOUT);
+  }
+
+  return Nothing();
+}
+
+
+// TODO(asridharan): Currently we haven't decided on the entity who
+// will allocate the net_cls handles, or the interfaces through which
+// the net_cls handles will be exposed to network isolators and
+// frameworks. Once the management entity is decided we might need to
+// revisit this implementation.
+Future<Nothing> CgroupsNetClsIsolatorProcess::update(
+    const ContainerID& containerId,
+    const Resources& resources)
+{
+  return Nothing();
+}
+
+
+Future<ContainerStatus> CgroupsNetClsIsolatorProcess::status(
+    const ContainerID& containerId)
+{
+  if (!infos.contains(containerId)) {
+    return Failure("Unknown container");
+  }
+
+  const Info& info = infos.at(containerId);
+
+  ContainerStatus status;
+
+  if (info.handle.isSome()) {
+    VLOG(1) << "Updating container status with net_cls classid: "
+            << info.handle.get();
+
+    CgroupInfo* cgroupInfo = status.mutable_cgroup_info();
+    CgroupInfo::NetCls* netCls = cgroupInfo->mutable_net_cls();
+
+    netCls->set_classid(info.handle->get());
+  }
+
+  return status;
+}
+
+
+Future<Option<ContainerLaunchInfo>> CgroupsNetClsIsolatorProcess::prepare(
+    const ContainerID& containerId,
+    const ContainerConfig& containerConfig)
+{
+  if (infos.contains(containerId)) {
+    return Failure("Container has already been prepared");
+  }
+
+  // Use this info to create the cgroup, but do not insert it into
+  // infos till the cgroup has been created successfully.
+  const string cgroup = path::join(flags.cgroups_root, containerId.value());
+
+  // Create a cgroup for this container.
+  Try<bool> exists = cgroups::exists(hierarchy, cgroup);
+  if (exists.isError()) {
+    return Failure(
+        "Failed to check if the cgroup already exists: " + exists.error());
+  } else if (exists.get()) {
+    return Failure("The cgroup already exists");
+  }
+
+  Try<Nothing> create = cgroups::create(hierarchy, cgroup);
+  if (create.isError()) {
+    return Failure("Failed to create the cgroup: " + create.error());
+  }
+
+  // 'chown' the cgroup so the executor can create nested cgroups. Do
+  // not recurse so the control files are still owned by the slave
+  // user and thus cannot be changed by the executor.
+  if (containerConfig.has_user()) {
+    Try<Nothing> chown = os::chown(
+        containerConfig.user(),
+        path::join(hierarchy, cgroup),
+        false);
+
+    if (chown.isError()) {
+      return Failure(
+          "Failed to change ownership of cgroup hierarchy: " + chown.error());
+    }
+  }
+
+  if (handleManager.isSome()) {
+    Try<NetClsHandle> handle = handleManager->alloc();
+    if (handle.isError()) {
+      return Failure (
+          "Failed to allocate a net_cls handle: " +
+          handle.error());
+    }
+
+    LOG(INFO) << "Allocated handle: " << handle.get()
+              << " to container " << containerId;
+
+    infos.emplace(containerId, Info(cgroup, handle.get()));
+  } else {
+    infos.emplace(containerId, Info(cgroup));
+  }
+
+  return update(containerId, containerConfig.executor_info().resources())
+    .then([]() -> Future<Option<ContainerLaunchInfo>> {
+      return None();
+    });
+}
+
+
+Future<Nothing> CgroupsNetClsIsolatorProcess::isolate(
+    const ContainerID& containerId,
+    pid_t pid)
+{
+  if (!infos.contains(containerId)) {
+    return Failure("Unknown container");
+  }
+
+  const Info& info = infos.at(containerId);
+
+  Try<Nothing> assign = cgroups::assign(hierarchy, info.cgroup, pid);
+  if (assign.isError()) {
+    return Failure(
+        "Failed to assign container " + stringify(containerId) +
+        " to its own cgroup '" + path::join(hierarchy, info.cgroup) +
+        "': " + assign.error());
+  }
+
+  // If info.handle is not specified, the assumption is that the
+  // operator is responsible for assigning the net_cls handles.
+  if (info.handle.isSome()) {
+    Try<Nothing> write = cgroups::net_cls::classid(
+        hierarchy,
+        info.cgroup,
+        info.handle->get());
+
+    if (write.isError()) {
+      return Failure(
+          "Failed to assign a net_cls handle to the cgroup: " +
+          write.error());
+    }
+  }
+
+  return Nothing();
+}
+
+
+// The net_cls handles are labels and hence there are no limitations
+// associated with them. This function would therefore always return
+// a pending future since the limitation is never reached.
+Future<ContainerLimitation> CgroupsNetClsIsolatorProcess::watch(
+    const ContainerID& containerId)
+{
+  if (!infos.contains(containerId)) {
+    return Failure("Unknown container");
+  }
+
+  return Future<ContainerLimitation>();
+}
+
+
+Future<Nothing> CgroupsNetClsIsolatorProcess::cleanup(
+    const ContainerID& containerId)
+{
+  // Multiple calls may occur during test clean up.
+  if (!infos.contains(containerId)) {
+    VLOG(1) << "Ignoring cleanup request for unknown container: "
+            << containerId;
+    return Nothing();
+  }
+
+  const Info& info = infos.at(containerId);
+
+  return cgroups::destroy(hierarchy, info.cgroup, cgroups::DESTROY_TIMEOUT)
+    .then(defer(PID<CgroupsNetClsIsolatorProcess>(this),
+                &CgroupsNetClsIsolatorProcess::_cleanup,
+                containerId));
+}
+
+
+Future<Nothing> CgroupsNetClsIsolatorProcess::_cleanup(
+    const ContainerID& containerId)
+{
+  if (!infos.contains(containerId)) {
+    return Nothing();
+  }
+
+  const Info& info = infos.at(containerId);
+
+  if (info.handle.isSome() && handleManager.isSome()) {
+    Try<Nothing> free = handleManager->free(info.handle.get());
+    if (free.isError()) {
+      return Failure("Could not free the net_cls handle: " + free.error());
+    }
+  }
+
+  infos.erase(containerId);
+
+  return Nothing();
+}
+
+
+Result<NetClsHandle> CgroupsNetClsIsolatorProcess::recoverHandle(
+    const string& hierarchy,
+    const string& cgroup)
+{
+  Try<uint32_t> classid = cgroups::net_cls::classid(hierarchy, cgroup);
+  if (classid.isError()) {
+    return Error("Failed to read 'net_cls.classid': " + classid.error());
+  }
+
+  if (classid.get() == 0) {
+    return None();
+  }
+
+  NetClsHandle handle(classid.get());
+
+  // Mark the handle as used in handle manager.
+  if (handleManager.isSome()) {
+    Try<Nothing> reserve = handleManager->reserve(handle);
+    if (reserve.isError()) {
+      return Error("Failed to reserve the handle: " + reserve.error());
+    }
+  }
+
+  return handle;
+}
+
+} // namespace slave {
+} // namespace internal {
+} // namespace mesos {

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/slave/containerizer/mesos/isolators/docker/volume/driver.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/isolators/docker/volume/driver.cpp b/src/slave/containerizer/mesos/isolators/docker/volume/driver.cpp
index ed3aa1d..2b2c6cf 100644
--- a/src/slave/containerizer/mesos/isolators/docker/volume/driver.cpp
+++ b/src/slave/containerizer/mesos/isolators/docker/volume/driver.cpp
@@ -51,7 +51,7 @@ constexpr Duration MOUNT_TIMEOUT = Seconds(120);
 constexpr Duration UNMOUNT_TIMEOUT = Seconds(120);
 
 Try<Owned<DriverClient>> DriverClient::create(
-    const std::string& dvdcli)
+    const string& dvdcli)
 {
   return Owned<DriverClient>(new DriverClient(dvdcli));
 }

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp b/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
index 822f11e..3594790 100644
--- a/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
+++ b/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
@@ -918,8 +918,8 @@ Future<Nothing> NetworkCniIsolatorProcess::__isolate(
 
 Future<Nothing> NetworkCniIsolatorProcess::attach(
     const ContainerID& containerId,
-    const std::string& networkName,
-    const std::string& netNsHandle)
+    const string& networkName,
+    const string& netNsHandle)
 {
   CHECK(infos.contains(containerId));
   CHECK(infos[containerId]->containerNetworks.contains(networkName));
@@ -1287,7 +1287,7 @@ Future<Nothing> NetworkCniIsolatorProcess::_cleanup(
 
 Future<Nothing> NetworkCniIsolatorProcess::detach(
     const ContainerID& containerId,
-    const std::string& networkName)
+    const string& networkName)
 {
   CHECK(infos.contains(containerId));
   CHECK(infos[containerId]->containerNetworks.contains(networkName));
@@ -1358,7 +1358,7 @@ Future<Nothing> NetworkCniIsolatorProcess::detach(
 
 Future<Nothing> NetworkCniIsolatorProcess::_detach(
     const ContainerID& containerId,
-    const std::string& networkName,
+    const string& networkName,
     const string& plugin,
     const tuple<Future<Option<int>>, Future<string>>& t)
 {

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/slave/containerizer/mesos/isolators/xfs/disk.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/isolators/xfs/disk.cpp b/src/slave/containerizer/mesos/isolators/xfs/disk.cpp
index 74ffcf5..dd4df86 100644
--- a/src/slave/containerizer/mesos/isolators/xfs/disk.cpp
+++ b/src/slave/containerizer/mesos/isolators/xfs/disk.cpp
@@ -175,7 +175,7 @@ Future<Nothing> XfsDiskIsolatorProcess::recover(
   // concerned with the on-disk state. We scan all the sandbox directories
   // for project IDs that we have not recovered and make a best effort to
   // remove all the corresponding on-disk state.
-  Try<std::list<std::string>> sandboxes = os::glob(path::join(
+  Try<list<string>> sandboxes = os::glob(path::join(
       paths::getSandboxRootDir(flags.work_dir),
       "*",
       "frameworks",

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/slave/containerizer/mesos/isolators/xfs/utils.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/isolators/xfs/utils.cpp b/src/slave/containerizer/mesos/isolators/xfs/utils.cpp
index e7ee466..b9d8e7d 100644
--- a/src/slave/containerizer/mesos/isolators/xfs/utils.cpp
+++ b/src/slave/containerizer/mesos/isolators/xfs/utils.cpp
@@ -390,7 +390,7 @@ Option<Error> validateProjectIds(const IntervalSet<prid_t>& projectRange)
 }
 
 
-bool pathIsXfs(const std::string& path)
+bool pathIsXfs(const string& path)
 {
   return ::platform_test_xfs_path(path.c_str()) == 1;
 }

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/slave/containerizer/mesos/launch.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/launch.cpp b/src/slave/containerizer/mesos/launch.cpp
index b8ad27e..fc51e04 100644
--- a/src/slave/containerizer/mesos/launch.cpp
+++ b/src/slave/containerizer/mesos/launch.cpp
@@ -340,9 +340,9 @@ int MesosContainerizerLaunch::execute()
 
 #ifdef __WINDOWS__
   // Not supported on Windows.
-  const Option<std::string> rootfs = None();
+  const Option<string> rootfs = None();
 #else
-  const Option<std::string> rootfs = flags.rootfs;
+  const Option<string> rootfs = flags.rootfs;
 #endif // __WINDOWS__
 
   // Change root to a new root, if provided.

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/slave/containerizer/mesos/provisioner/appc/cache.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/provisioner/appc/cache.cpp b/src/slave/containerizer/mesos/provisioner/appc/cache.cpp
index e075e48..20a7030 100644
--- a/src/slave/containerizer/mesos/provisioner/appc/cache.cpp
+++ b/src/slave/containerizer/mesos/provisioner/appc/cache.cpp
@@ -135,7 +135,7 @@ Cache::Key::Key(const Image::Appc& image)
 
 Cache::Key::Key(
     const string& _name,
-    const map<string, std::string> _labels)
+    const map<string, string> _labels)
   : name(_name),
     labels(_labels) {}
 

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/slave/slave.cpp
----------------------------------------------------------------------
diff --git a/src/slave/slave.cpp b/src/slave/slave.cpp
index 863ab9d..7bd5fad 100644
--- a/src/slave/slave.cpp
+++ b/src/slave/slave.cpp
@@ -140,7 +140,7 @@ namespace slave {
 
 using namespace state;
 
-Slave::Slave(const std::string& id,
+Slave::Slave(const string& id,
              const slave::Flags& _flags,
              MasterDetector* _detector,
              Containerizer* _containerizer,
@@ -5766,7 +5766,7 @@ double Slave::_executor_directory_max_allowed_age_secs()
 }
 
 
-Future<bool> Slave::authorizeLogAccess(const Option<std::string>& principal)
+Future<bool> Slave::authorizeLogAccess(const Option<string>& principal)
 {
   if (authorizer.isNone()) {
     return true;
@@ -5784,7 +5784,7 @@ Future<bool> Slave::authorizeLogAccess(const Option<std::string>& principal)
 
 
 Future<bool> Slave::authorizeSandboxAccess(
-    const Option<std::string>& principal,
+    const Option<string>& principal,
     const FrameworkID& frameworkId,
     const ExecutorID& executorId)
 {

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/tests/containerizer/xfs_quota_tests.cpp
----------------------------------------------------------------------
diff --git a/src/tests/containerizer/xfs_quota_tests.cpp b/src/tests/containerizer/xfs_quota_tests.cpp
index d0f5032..fb1d03b 100644
--- a/src/tests/containerizer/xfs_quota_tests.cpp
+++ b/src/tests/containerizer/xfs_quota_tests.cpp
@@ -581,7 +581,7 @@ TEST_F(ROOT_XFS_QuotaTest, NoCheckpointRecovery)
   // We should have no executors left because we didn't checkpoint.
   ASSERT_EQ(0, usage2.get().executors().size());
 
-  Try<std::list<std::string>> sandboxes = os::glob(path::join(
+  Try<std::list<string>> sandboxes = os::glob(path::join(
       slave::paths::getSandboxRootDir(mountPoint.get()),
       "*",
       "frameworks",
@@ -687,7 +687,7 @@ TEST_F(ROOT_XFS_QuotaTest, CheckpointRecovery)
   // We should have still have 1 executor using resources.
   ASSERT_EQ(1, usage1.get().executors().size());
 
-  Try<std::list<std::string>> sandboxes = os::glob(path::join(
+  Try<std::list<string>> sandboxes = os::glob(path::join(
       slave::paths::getSandboxRootDir(mountPoint.get()),
       "*",
       "frameworks",

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/tests/dynamic_weights_tests.cpp
----------------------------------------------------------------------
diff --git a/src/tests/dynamic_weights_tests.cpp b/src/tests/dynamic_weights_tests.cpp
index 88565d1..6f1e249 100644
--- a/src/tests/dynamic_weights_tests.cpp
+++ b/src/tests/dynamic_weights_tests.cpp
@@ -109,7 +109,7 @@ protected:
 
     ASSERT_SOME(weightInfos);
 
-    hashmap<std::string, double> weights =
+    hashmap<string, double> weights =
       convertToHashmap(weightInfos.get());
 
     if (_weights.isNone()) {

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/tests/files_tests.cpp
----------------------------------------------------------------------
diff --git a/src/tests/files_tests.cpp b/src/tests/files_tests.cpp
index 78719da..f6a6aea 100644
--- a/src/tests/files_tests.cpp
+++ b/src/tests/files_tests.cpp
@@ -183,7 +183,7 @@ TEST_F(FilesTest, ReadTest)
 
   // Test reads with authorization enabled.
   bool authorized = true;
-  auto authorization = [&authorized](const Option<std::string>&) {
+  auto authorization = [&authorized](const Option<string>&) {
     return authorized;
   };
 
@@ -373,7 +373,7 @@ TEST_F(FilesTest, BrowseTest)
   files.detach("one");
 
   bool authorized = true;
-  auto authorization = [&authorized](const Option<std::string>&) {
+  auto authorization = [&authorized](const Option<string>&) {
     return authorized;
   };
 
@@ -463,7 +463,7 @@ TEST_F(FilesTest, DownloadTest)
 
   // Test downloads with authorization enabled.
   bool authorized = true;
-  auto authorization = [&authorized](const Option<std::string>&) {
+  auto authorization = [&authorized](const Option<string>&) {
     return authorized;
   };
 

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/tests/log_tests.cpp
----------------------------------------------------------------------
diff --git a/src/tests/log_tests.cpp b/src/tests/log_tests.cpp
index 146a2dc..9995438 100644
--- a/src/tests/log_tests.cpp
+++ b/src/tests/log_tests.cpp
@@ -2096,7 +2096,7 @@ TEST_F(LogTest, Metrics)
   initializer.flags.path = path;
   ASSERT_SOME(initializer.execute());
 
-  Log log(1, path, std::set<process::UPID>(), false, "prefix/");
+  Log log(1, path, set<process::UPID>(), false, "prefix/");
 
   // Make sure the log is recovered. If the log is not recovered, the
   // writer cannot be elected.

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/tests/mesos.cpp
----------------------------------------------------------------------
diff --git a/src/tests/mesos.cpp b/src/tests/mesos.cpp
index f495fb7..204fe2e 100644
--- a/src/tests/mesos.cpp
+++ b/src/tests/mesos.cpp
@@ -322,7 +322,7 @@ Try<Owned<cluster::Slave>> MesosTest::StartSlave(
 Try<Owned<cluster::Slave>> MesosTest::StartSlave(
     MasterDetector* detector,
     slave::Containerizer* containerizer,
-    const std::string& id,
+    const string& id,
     const Option<slave::Flags>& flags)
 {
   return cluster::Slave::start(
@@ -495,7 +495,7 @@ MockResourceEstimator::MockResourceEstimator()
     .WillRepeatedly(DoDefault());
 
   ON_CALL(*this, oversubscribable())
-    .WillByDefault(Return(process::Future<Resources>()));
+    .WillByDefault(Return(Future<Resources>()));
   EXPECT_CALL(*this, oversubscribable())
     .WillRepeatedly(DoDefault());
 }
@@ -512,7 +512,7 @@ MockQoSController::MockQoSController()
 
   ON_CALL(*this, corrections())
     .WillByDefault(
-        Return(process::Future<list<mesos::slave::QoSCorrection>>()));
+        Return(Future<list<mesos::slave::QoSCorrection>>()));
   EXPECT_CALL(*this, corrections())
     .WillRepeatedly(DoDefault());
 }
@@ -590,7 +590,7 @@ void MockSlave::unmocked__run(
 
 
 void MockSlave::unmocked_runTaskGroup(
-    const process::UPID& from,
+    const UPID& from,
     const FrameworkInfo& frameworkInfo,
     const ExecutorInfo& executorInfo,
     const TaskGroupInfo& taskGroup)
@@ -625,7 +625,7 @@ void MockSlave::unmocked_qosCorrections()
 }
 
 
-process::Future<ResourceUsage> MockSlave::unmocked_usage()
+Future<ResourceUsage> MockSlave::unmocked_usage()
 {
   return slave::Slave::usage();
 }
@@ -690,8 +690,8 @@ MockDocker::~MockDocker() {}
 MockDockerContainerizer::MockDockerContainerizer(
     const slave::Flags& flags,
     slave::Fetcher* fetcher,
-    const process::Owned<ContainerLogger>& logger,
-    process::Shared<Docker> docker)
+    const Owned<ContainerLogger>& logger,
+    Shared<Docker> docker)
   : slave::DockerContainerizer(flags, fetcher, logger, docker)
 {
   initialize();
@@ -699,7 +699,7 @@ MockDockerContainerizer::MockDockerContainerizer(
 
 
 MockDockerContainerizer::MockDockerContainerizer(
-    const process::Owned<slave::DockerContainerizerProcess>& process)
+    const Owned<slave::DockerContainerizerProcess>& process)
   : slave::DockerContainerizer(process)
 {
   initialize();
@@ -712,8 +712,8 @@ MockDockerContainerizer::~MockDockerContainerizer() {}
 MockDockerContainerizerProcess::MockDockerContainerizerProcess(
     const slave::Flags& flags,
     slave::Fetcher* fetcher,
-    const process::Owned<ContainerLogger>& logger,
-    const process::Shared<Docker>& docker)
+    const Owned<ContainerLogger>& logger,
+    const Shared<Docker>& docker)
   : slave::DockerContainerizerProcess(flags, fetcher, logger, docker)
 {
   EXPECT_CALL(*this, fetch(_, _))
@@ -754,7 +754,7 @@ MockAuthorizer::MockAuthorizer()
 MockAuthorizer::~MockAuthorizer() {}
 
 
-process::Future<Nothing> MockFetcherProcess::unmocked__fetch(
+Future<Nothing> MockFetcherProcess::unmocked__fetch(
     const hashmap<CommandInfo::URI, Option<Future<shared_ptr<Cache::Entry>>>>&
       entries,
     const ContainerID& containerId,
@@ -773,7 +773,7 @@ process::Future<Nothing> MockFetcherProcess::unmocked__fetch(
 }
 
 
-process::Future<Nothing> MockFetcherProcess::unmocked_run(
+Future<Nothing> MockFetcherProcess::unmocked_run(
     const ContainerID& containerId,
     const string& sandboxDirectory,
     const Option<string>& user,

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/tests/partition_tests.cpp
----------------------------------------------------------------------
diff --git a/src/tests/partition_tests.cpp b/src/tests/partition_tests.cpp
index f3142ad..8e3827a 100644
--- a/src/tests/partition_tests.cpp
+++ b/src/tests/partition_tests.cpp
@@ -651,7 +651,7 @@ TEST_F(OneWayPartitionTest, MasterToScheduler)
   StandaloneMasterDetector detector(master.get()->pid);
   TestingMesosSchedulerDriver driver(&sched, &detector, frameworkInfo);
 
-  Future<process::Message> frameworkRegisteredMessage =
+  Future<Message> frameworkRegisteredMessage =
     FUTURE_MESSAGE(Eq(FrameworkRegisteredMessage().GetTypeName()), _, _);
 
   Future<Nothing> registered;

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/tests/resources_tests.cpp
----------------------------------------------------------------------
diff --git a/src/tests/resources_tests.cpp b/src/tests/resources_tests.cpp
index f627862..3ade1c0 100644
--- a/src/tests/resources_tests.cpp
+++ b/src/tests/resources_tests.cpp
@@ -1705,7 +1705,7 @@ TEST(ReservedResourcesTest, Equals)
   Labels labels2;
   labels2.add_labels()->CopyFrom(createLabel("foo", "baz"));
 
-  std::vector<Resources> unique = {
+  vector<Resources> unique = {
     // Unreserved.
     createReservedResource(
         "cpus", "8", "*", None()),

http://git-wip-us.apache.org/repos/asf/mesos/blob/4a7490a2/src/tests/slave_recovery_tests.cpp
----------------------------------------------------------------------
diff --git a/src/tests/slave_recovery_tests.cpp b/src/tests/slave_recovery_tests.cpp
index d58d9bc..389daf0 100644
--- a/src/tests/slave_recovery_tests.cpp
+++ b/src/tests/slave_recovery_tests.cpp
@@ -442,7 +442,7 @@ TYPED_TEST(SlaveRecoveryTest, ReconnectHTTPExecutor)
 
   // Start the slave with a static process ID. This allows the executor to
   // reconnect with the slave upon a process restart.
-  const std::string id("agent");
+  const string id("agent");
 
   Owned<MasterDetector> detector = master.get()->createDetector();
 
@@ -628,7 +628,7 @@ TYPED_TEST(SlaveRecoveryTest, RecoverUnregisteredHTTPExecutor)
 
   // Start the slave with a static process ID. This allows the executor to
   // reconnect with the slave upon a process restart.
-  const std::string id("agent");
+  const string id("agent");
 
   Owned<MasterDetector> detector = master.get()->createDetector();
 
@@ -965,7 +965,7 @@ TYPED_TEST(SlaveRecoveryTest, RecoverTerminatedHTTPExecutor)
 
   // Start the slave with a static process ID. This allows the executor to
   // reconnect with the slave upon a process restart.
-  const std::string id("agent");
+  const string id("agent");
 
   Owned<MasterDetector> detector = master.get()->createDetector();
 
@@ -1427,7 +1427,7 @@ TYPED_TEST(SlaveRecoveryTest, CleanupHTTPExecutor)
 
   // Start the slave with a static process ID. This allows the executor to
   // reconnect with the slave upon a process restart.
-  const std::string id("agent");
+  const string id("agent");
 
   Owned<MasterDetector> detector = master.get()->createDetector();
 
@@ -1830,7 +1830,7 @@ TYPED_TEST(SlaveRecoveryTest, KillTaskWithHTTPExecutor)
 
   // Start the slave with a static process ID. This allows the executor to
   // reconnect with the slave upon a process restart.
-  const std::string id("agent");
+  const string id("agent");
 
   Owned<MasterDetector> detector = master.get()->createDetector();
 
@@ -3225,7 +3225,7 @@ TYPED_TEST(SlaveRecoveryTest, MasterFailover)
   EXPECT_CALL(sched, resourceOffers(_, _))
     .WillOnce(FutureArg<1>(&offers1));
 
-  Future<process::Message> frameworkRegisteredMessage =
+  Future<Message> frameworkRegisteredMessage =
     FUTURE_MESSAGE(Eq(FrameworkRegisteredMessage().GetTypeName()), _, _);
 
   driver.start();