feat: update sandboxd for cgroup v2

Advance the sandboxd submodule to the merged upstream revision that
detects the local cgroup mode and supports both v1 and v2 transparently.
Update the platform and deployment documentation to remove the former
cgroup v1 restriction.

Set the ACK Terraform default to Kubernetes 1.35.2 now that sandboxd can
run on the unified cgroup v2 hierarchy used by that release.

Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>

Author: tianyuzhou95

AGENTS.md

@@ -151,10 +151,6 @@ make deploy
 make print-env
 ```
 
-AKernel `v0.1.0` node runtime currently requires Linux x86-64 nodes with
-cgroup v1. Do not deploy it to cgroup v2 nodes or assume bootstrap will detect
-an incompatible host before sandboxd starts.
-
 Kata is present in the default AKernel runtime configuration but is an
 optional node capability. It additionally requires `/dev/kvm` to be usable
 from the node container. A node without KVM remains ready and advertises only

README.md

@@ -168,7 +168,7 @@ See the complete [basic usage example](./sdk/python/examples/basic_usage.py), th
 - [ ] Fork-based sandbox launch based on gVisor
 - [ ] Sandbox checkpoint and restore
 - [ ] Support for GKE and AWS
-- [ ] Cgroup v2 node support
+- [x] Cgroup v2 node support
 
 ## License
 

deploy/README.md

@@ -25,11 +25,6 @@ make print-env
 make e2e
 ```
 
-The current node runtime requires Linux x86-64 with cgroup v1. It does not yet
-support cgroup v2, and bootstrap does not reliably detect an incompatible host
-before sandboxd starts. Verify the node operating system and cgroup mode before
-deployment.
-
 Kata Containers is enabled in the default AKernel runtime configuration and adds one host requirement: `/dev/kvm` must be available to the node container. Nodes without a usable KVM device remain ready and advertise only runsc. If no node advertises Kata, `Sandbox(runtime="kata")` fails scheduling with a no-resource error.
 
 `make config` is interactive by default. It writes:

deploy/terraform/aliyun/terraform.tfvars.example

@@ -33,8 +33,7 @@ auto_authorize_oos_lifecycle_role = true
 # kubeconfig_output_path = "/abs/path/to/generated/kubeconfig"
 
 # Kubernetes and network ranges.
-# NOTE: ACK 1.35+ drops cgroup v1 support. Use 1.34 or earlier if sandboxd needs cgroup v1.
-k8s_version   = "1.34.3-aliyun.1"
+k8s_version   = "1.35.2-aliyun.1"
 network_addon = "terway-eniip"
 service_cidr  = "10.20.0.0/20"
 # Optional: override pod vSwitches for terway-eni/terway-eniip (defaults to worker vSwitches).

deploy/terraform/aliyun/variables.tf

@@ -124,8 +124,8 @@ variable "zone_ids" {
 
 variable "k8s_version" {
   type        = string
-  description = "ACK Kubernetes version. NOTE: 1.35+ requires cgroup v2 (no cgroup v1 support). Use 1.34 or earlier if sandboxd needs cgroup v1."
-  default     = "1.34.3-aliyun.1"
+  description = "ACK Kubernetes version."
+  default     = "1.35.2-aliyun.1"
 }
 
 variable "network_addon" {

deploy/terraform/huaweicloud/README.md

@@ -6,8 +6,6 @@ contract as the Aliyun module: one all-in-one AKernel image, a generated IAM
 seed, dual-entrypoint Traefik, optional public Grafana, and local state under
 `.akernel/<env>/`.
 
-AKernel 0.1.0 has been tested on Linux x86-64 nodes using cgroup v1.
-
 ## Prerequisites
 
 - Terraform 1.5 or later