Kir Kolyshkin
daeab40b45
os.Unmount: do not consult mountinfo, drop flags
...
1. Currently, Unmount() call takes a burden to parse the whole nine yards
of /proc/self/mountinfo to figure out whether the given mount point is
mounted or not (and returns an error in case parsing fails somehow).
Instead, let's just call umount() and ignore EINVAL, which results
in the same behavior, but much better performance.
This also introduces a slight change: in case target does not exist,
the appropriate error (ENOENT) is returned -- document that.
2. As Unmount() is always used with MNT_DETACH flag, let's drop the
flags argument. This way, the only reason of EINVAL returned from
umount(2) can only be "target is not mounted".
3. While at it, remove the 'containerdmount' alias from the package.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2018-04-30 12:54:10 -07:00
Lantao Liu
ed20174ce4
Add RunAsGroup support.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-03-30 22:26:07 +00:00
Lantao Liu
f4c9ef2647
Add symlink follow into unmount util.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-03-24 01:25:31 +00:00
Mike Brown
94df315de8
adds volatile state directory to the fs plan for cntrs/pods/fifo
...
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2018-03-24 00:05:52 +00:00
Lantao Liu
ca67f94ee0
Address comments for privileged runtime code.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-03-23 02:17:46 +00:00
Jose Carlos Venegas Munoz
ca16bd601a
runtime: Add trusted runtime option
...
Some CRI compatible runtimes may not support provileged operations.
Specifically hypervisor based runtimes (like kata-containers, cc-runtime
and runv) do not support privileged operations like:
- Provide access to the host namespaces
- Create fully privileged containers with access to host devices
Hypervisor based runtimes create container workloads within virtual machines.
When a running host privileged containers using them,
they wont provide support to requested the privileged opertations.
This commits add the new options to define two runtimes:
Trusted runtime : Used when a privileged container is requested.
Default runtime : for non-privileged workloads.
A container that belongs to a privileged pod will inherent this property
an will be created with the trusted runtime.
- Add options to define trusted runtime
- Add logic to decide if a sanbox is trusted
- Export annotation containers below to a trusted sandbox
Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
2018-03-20 13:56:49 -06:00
Lantao Liu
387da59ee5
Rename all variables to remove "cricontainerd".
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-03-19 21:59:32 +00:00
Lantao Liu
e1fe1abff0
Use github.com/pkg/errors
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-03-17 02:24:38 +00:00
abhi
2bdf428eb7
Removing DAD config and updating plugins to v0.7.0
...
Signed-off-by: abhi <abhi@docker.com>
2018-03-16 14:46:46 -07:00
abhi
003bbd4292
Modifying fake cni plugin
...
Signed-off-by: abhi <abhi@docker.com>
2018-03-15 17:05:33 -07:00
abhi
92110e1d74
Moving to use go-cni library from containerd
...
This fix aims to use the cni library form containerd.
The library avoid usage of nsenter.
Signed-off-by: abhi <abhi@docker.com>
2018-03-14 19:25:54 -07:00
Mike Brown
d4e7154625
move links for cri-containerd to cri
...
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2018-03-13 17:06:26 -05:00
Lantao Liu
f01c6d73a6
Fix cleanup context.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-03-07 07:05:27 +00:00
Lantao Liu
46fc92f65f
Use new namespace mode and support shared pid namespace.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-02-08 03:10:57 +00:00
Lantao Liu
d113c16802
Update ocicni to my fork.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-02-02 19:45:26 +00:00
Lantao Liu
df58d6825d
Avoid containerd access as much as possible.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-01-25 23:36:00 +00:00
Lantao Liu
2b6f084f36
Disable IPv6 dad by default.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-01-22 23:54:16 +00:00
Lantao Liu
3d68005c04
Replace glog with logrus
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-01-17 21:57:31 +00:00
Jose Carlos Venegas Munoz
b383b0261a
Annotations: Provide container metadata for VM based runtimes
...
For hypervisor-based container runtimes (like Kata Containers, Clear Containers
or runv) a pod will be created in a VM and then create containers within the VM.
When a runtime is requested for container commands like create and start, both
the instal "pause" container and next containers need to be added to the pod
namespace (same VM).
A runtime does not know if it needs to create/start a VM or if it needs to add a
container to an already running VM pod.
This patch adds a way to provide this information through container annotations.
When starting a container or a sandbox, 2 annotations are added:
- type (Container or Sandbox)
- sandbox name
This allow to a VM based runtime to decide if they need to create a pod VM or
container within the VM pod.
Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
2018-01-17 09:57:20 -06:00
Lantao Liu
025ffe551f
Rename kubernetes-incubator/cri-containerd to containerd/cri-containerd.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-01-10 22:35:33 +00:00
Lantao Liu
aee7a366f3
Merge pull request #525 from abhi/cniip
...
Caching IP allocated by CNI plugin
2018-01-05 00:27:48 -08:00
abhi
f1dbc0b375
Caching IP allocated by CNI plugin
...
Signed-off-by: abhi <abhi@docker.com>
2018-01-04 20:00:55 -08:00
Lantao Liu
31bc964195
Enable HostSpecific option in runtime-tools generator.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-01-03 19:04:47 +00:00
Mike Brown
31223fd5b1
adds oci image spec to image info placed into imagestore
...
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2017-12-12 15:58:07 -06:00
abhi
43c05efb22
Revert: Setting containerd shim cgroup same as pod cgroup
...
Signed-off-by: abhi <abhi@docker.com>
2017-12-01 16:03:38 -08:00
Lantao Liu
181d7d5076
Move shim cgroup opts to pkg/containerd/opts.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-12-01 19:18:26 +00:00
abhi
0d6774f4af
Setting containerd shim cgroup same as pod cgroup
...
Signed-off-by: abhi <abhi@docker.com>
2017-12-01 08:33:50 -08:00
Mike Brown
4934098e27
Merge pull request #440 from dnephin/use-oci-package
...
Use containerd.oci package
2017-11-28 16:41:26 -06:00
Daniel Nephin
85d3bf0660
Use SpecOpts from new oci package
...
Signed-off-by: Daniel Nephin <dnephin@gmail.com>
2017-11-28 15:30:11 -05:00
Brian Goff
f6fe36d17a
Remove explicit unpack on all container creates
...
This only performs an unpack if there is an error when creating the
container snapshot (and only if it's a "not found' error) since it should
already be unpacked.
Signed-off-by: Brian Goff <brian.goff@docker.com>
2017-11-28 14:28:20 -05:00
yanxuean
50cb8a0571
update containerd for refactor
...
fix #423
Signed-off-by: yanxuean <yan.xuean@zte.com.cn>
2017-11-27 19:24:14 +00:00
abhi
cd5886d647
Adding kube pod and container labels to containerd
...
Currently we have the pod and container labels part of
containerd metadata extensions. However for third party users
like cadvisor that depend on standard kube labels will need
to be aware of the way metadata is stored in containerd to
fetch the labels.
Signed-off-by: abhi <abhi@docker.com>
2017-11-07 22:19:19 -08:00
Lantao Liu
25fdf72692
Add image load.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-10-27 21:51:04 +00:00
Lantao Liu
f10cc58362
Revert "Put containerd-shim into pod cgroup"
...
This reverts commit e9cf1d5909
.
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-10-27 05:33:55 +00:00
Lantao Liu
5e74cba0f0
Add log of generated id for debugging.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-10-27 00:11:16 +00:00
Lantao Liu
6c6b337e87
Merge pull request #358 from Random-Liu/unpack-when-creation
...
Also unpack image during creation.
2017-10-26 22:44:07 +02:00
Lantao Liu
acc3f74d5c
Also unpack image during creation.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-10-26 17:57:53 +00:00
Yanqiang Miao
e9cf1d5909
Put containerd-shim into pod cgroup
...
Signed-off-by: Yanqiang Miao <miao.yanqiang@zte.com.cn>
2017-10-26 10:17:12 +08:00
Lantao Liu
bde8b0517e
Update kubernetes and containerd.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-10-11 06:16:19 +00:00
Mike Brown
d8a3c6b018
adds support for configuring the containerd runtime engine
...
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2017-09-26 20:22:51 -05:00
Lantao Liu
cd57d063c5
Add systemd cgroup support.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-09-26 06:44:30 +00:00
Lantao Liu
4231473df3
Address comments
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-09-25 23:09:44 +00:00
Lantao Liu
21233b22be
Check seccomp enable and add unit test for seccomp/apparmor.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-09-25 23:09:26 +00:00
Mike Brown
78a925f57b
vendor for new seccomp helpers
...
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2017-09-21 17:37:50 -05:00
Mike Brown
c0a2d152d9
adds seccomp support
...
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2017-09-21 17:22:11 -05:00
yanxuean
e1a7a0ea76
Switch to containerd extension
...
fix #251
Signed-off-by: yanxuean <yan.xuean@zte.com.cn>
2017-09-21 00:15:10 +08:00
Lantao Liu
71b0d0a043
Use config in service.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-09-17 06:46:40 +00:00
Lantao Liu
0bfcdd39ab
Remove /run
mount for backward compatibility with docker.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-09-09 07:34:00 +00:00
Lantao Liu
c4846745d6
Use WithNewSnapshot
for sandbox container.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-09-09 03:59:58 +00:00
Lantao Liu
f36ef46b35
Use new ocicni.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-09-07 00:14:12 +00:00
Ian Campbell
0161764ef5
Always use a writeable snapshot as the rootfs.
...
This will be made readonly by runc based on spec.Root.Readonly (which we
already set correctly) but defering until then gives runc the chance to make
any missing mount points as it processes the spec.Mount array.
This is necessary because many container images lack mount points for things
like the /etc/hosts which we want to overbind. This is not noticed with e.g.
Docker because it automatically creates an additional layer containing those.
This is something we may want to do here as well eventually but for now using a
writeable snapshot is both necessary and sufficient.
The same does not apply to the sandbox since we never modify its rootfs or want
to mount anything in it etc, add a comment to clarify.
Fixes #220 .
Signed-off-by: Ian Campbell <ijc@docker.com>
2017-09-06 22:20:14 +01:00
Lantao Liu
c3cb1cfde8
Revert "Setting containerd shim cgroup same as pod cgroup"
...
This reverts commit 59008c608e
.
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-09-02 04:20:55 +00:00
Mike Brown
4f442de959
adds support for AppArmor
...
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2017-09-01 18:08:34 -05:00
Lantao Liu
9c49624174
Merge pull request #157 from miaoyq/apply-selinux-opt
...
Support selinux options/label
2017-08-31 16:30:30 -07:00
Abhinandan Prativadi
59008c608e
Setting containerd shim cgroup same as pod cgroup
...
Signed-off-by: Abhinandan Prativadi <abhi@docker.com>
2017-08-31 15:16:51 -07:00
Yanqiang Miao
0c3304e006
Support selinux options/label
...
Support selinux optios/label
Signed-off-by: Yanqiang Miao <miao.yanqiang@zte.com.cn>
2017-08-31 19:20:12 +08:00
Lantao Liu
ac4f238f48
Cleanup image operations.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-08-31 00:52:09 +00:00
Lantao Liu
c4d95aa2c4
Fix sandbox container snapshotter.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-08-30 18:33:59 +00:00
Lantao Liu
270e09ab26
Use containerd WithUserID.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-08-25 21:11:56 +00:00
Lantao Liu
980e8e8007
Merge pull request #168 from Random-Liu/add-run-as-user
...
Add RunAsUser support
2017-08-25 13:45:47 -07:00
Lantao Liu
60d8430ac1
Do not checkpoint sandbox pid.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-08-25 01:38:05 +00:00
Lantao Liu
a80df151d1
Add RunAsUsername support.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-08-25 00:47:35 +00:00
Lantao Liu
e1f74f00a5
Various security related fixes
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-08-24 21:52:30 +00:00
Lantao Liu
a795927c5a
Get CreatedAt from containerd instead of maintaining it ourselves.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-08-24 18:38:00 +00:00
Lantao Liu
73bb9696e8
Merge pull request #151 from Random-Liu/add-instrumented-service
...
Add instrumented service.
2017-08-24 11:26:39 -07:00
Abhinandan Prativadi
5a119200b8
Creating permanent sandbox namespace
...
This commit contains changes to create/delete permanent namespace
for a sandbox container.
Signed-off-by: Abhinandan Prativadi <abhi@docker.com>
2017-08-24 10:43:42 -07:00
Lantao Liu
45ee2e554a
Add container attach support.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-08-23 23:48:31 +00:00
Lantao Liu
77b703f1e7
Move generateID to util.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-08-23 23:46:55 +00:00
Lantao Liu
dd6e9fb88d
Merge pull request #156 from yanxuean/metalabel
...
Checkpoint and restart recovery
2017-08-23 15:36:19 -07:00
yanxuean
d2757cb8f9
Checkpoint and restart recovery
...
fix part of #120
Signed-off-by: yanxuean <yan.xuean@zte.com.cn>
2017-08-23 17:01:13 +08:00
Lantao Liu
195b52500f
Add instrumented service.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-08-23 07:02:12 +00:00
Lantao Liu
f6d99abcf4
Add hostport support
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-08-23 01:33:02 +00:00
Abhinandan Prativadi
32e0313418
Containerd client integration
...
This commit:
1) Replaces the usage of containerd GRPC APIs with the containerd client for all operations related to containerd.
2) Updated containerd to v1.0alpha4+
3) Updated runc to v1.0.0
Signed-off-by: Abhinandan Prativadi <abhi@docker.com>
2017-08-16 14:43:22 -07:00
Lantao Liu
86a0f6a59b
Merge pull request #126 from miaoyq/change-defaut-spec
...
Replace the original default spec with containerd default spec
2017-08-10 14:25:23 -07:00
Yanqiang Miao
9cc93886ea
Replace the original default spec with containerd default spec
...
The original default spec contain `seccomp` configuration,
but some OS do not support this feature, such as ubuntu14.04,
and `make test-cri` always fail. The containerd default spec dosen't
contain `seccomp`, so I think we could replace the default spec
with containerd default spec.
Signed-off-by: Yanqiang Miao <miao.yanqiang@zte.com.cn>
2017-08-10 20:31:03 +08:00
Mike Brown
8d37d97d01
sets sysctls from pod config annotations
...
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2017-08-09 18:42:04 -05:00
Mike Brown
73748840da
Swicth to 1.0.0-alpha2 containerd api.
...
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2017-08-02 23:21:37 +00:00
Lantao Liu
7b16a35287
Use new metadata store.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-07-28 23:35:31 +00:00
Lantao Liu
4317e6119a
Remove sandbox truncindex.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-07-28 23:35:31 +00:00
Lantao Liu
faf592069b
Remove out-of-date TODOs.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-06-30 01:19:51 +00:00
Lantao Liu
14fd8401a2
Set sandbox container resource limit.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-06-23 01:23:53 +00:00
Lantao Liu
862d00a21c
Update CRI to d779e9c9561b732adf06263c5424889e7564fdbd.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-06-21 01:56:13 +00:00
Lantao Liu
7f9e0262ad
Unmount /dev/shm when stop sandbox.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-06-16 17:18:14 +00:00
Lantao Liu
5b7cbf1bc6
Create/remove sandbox container.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-06-16 16:43:13 +00:00
Lantao Liu
cb9e104cf1
Create/delete containerd containerd
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-06-16 16:43:13 +00:00
Lantao Liu
6ca9c65578
Rename more container
to task
.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-06-16 02:34:43 +00:00
Lantao Liu
bad279e0f6
Finish snapshot support.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-06-16 02:34:43 +00:00
Mike Brown
484a326717
modify code to compile on updated containerd
...
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2017-06-15 23:14:21 +00:00
Lantao Liu
9d5990fe4f
Add sandbox /dev/shm.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-06-11 09:49:46 +00:00
Crazykev
9bf7ffd51a
generate and maintain resolv.conf for sandbox
...
Signed-off-by: Crazykev <crazykev@zju.edu.cn>
2017-06-09 19:36:30 +08:00
Lantao Liu
88f4c252d6
Add sandbox /etc/hosts when using host network
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-06-06 06:43:38 +00:00
Lantao Liu
e657e1eb14
Add container logging support.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-06-02 16:36:02 +00:00
Lantao Liu
95e0fc694f
Cleanup some code.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-06-02 02:15:58 +00:00
Lantao Liu
80c973a550
Ensure container rootfs and apply image config
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-05-31 01:18:22 +00:00
Lantao Liu
eb20601c08
Pull sandbox image and apply image config
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-05-31 00:39:38 +00:00
Crazykev
49e7ef2153
update kubernetes vendor for new CRI change
...
Signed-off-by: Crazykev <crazykev@zju.edu.cn>
2017-05-24 10:25:55 +08:00
Xianglin Gao
4a4414987f
Add unit test
...
Signed-off-by: Xianglin Gao <xlgao@zju.edu.cn>
2017-05-23 18:30:20 +08:00
Xianglin Gao
6d2b9fabca
And setup and teardown
...
Signed-off-by: Xianglin Gao <xlgao@zju.edu.cn>
2017-05-23 15:17:40 +08:00
Random-Liu
6ac71e5862
Add initial container implementation.
...
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-05-22 19:14:09 +00:00
Random-Liu
bf28c7fc75
Add initial sandbox management implementation
...
Signed-off-by: Random-Liu <lantaol@google.com>
2017-05-12 13:14:11 -07:00