Commit Graph

327 Commits

Author SHA1 Message Date
Nikhil Soni
da2ab865e0 Add documentation for using namespace labels for configuring defaults.
Signed-off-by: Nikhil Soni <krsoninikhil@gmail.com>
2019-02-01 23:14:33 +05:30
Derek McGowan
8706a355dd Merge pull request #2889 from linxiulei/isolated_content
metadata: define content sharing policy
2019-01-14 13:15:38 -08:00
Phil Estes
a79879e9dd Add security audit report to README
Also remove weekly development reports section from README as those are
not being produced regularly at this time.

Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
2019-01-04 09:56:03 -05:00
Akihiro Suda
cd8231ab2a support DisableCgroup, DisableApparmor, RestrictOOMScoreAdj
Add following config for supporting "rootless" mode

* DisableCgroup: disable cgroup
* DisableApparmor: disable Apparmor
* RestrictOOMScoreAdj: restrict the lower bound of OOMScoreAdj

Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
2019-01-03 05:12:04 +09:00
Eric Lin
4247f2684d metadata: define content sharing policy
This changeset modifies the metadata store to allow one to set a
"content sharing policy" that defines how blobs are shared between
namespaces in the content store.

The default mode "shared" will make blobs available in all namespaces
once it is pulled into any namespace.  The blob will be pulled into
the namespace if a writer is opened with the "Expected" digest that
is already present in the backend.

The alternative mode, "isolated" requires that clients prove they have
access to the content by providing all of the content to the ingest
before the blob is added to the namespace.

Both modes share backing data, while "shared" will reduce total
bandwidth across namespaces, at the cost of allowing access to any
blob just by knowing its digest.

Note: Most functional codes and changelog of this commit originate from
Stephen J Day <stephen.day@docker.com>, see
40455aade8

Fixes #1713 Fixes #2865

Signed-off-by: Eric Lin <linxiulei@gmail.com>
2018-12-21 15:02:21 +08:00
Sebastiaan van Stijn
723797d320 docs: remove website leftovers
The website content moved to the github.com/containerd/containerd.io
repository.

Commit da1fba0050 removed all website-
related content, but there were some stray files left behind.

This patch removes those files, and updates the `.editorconfig` file
to only match Markdown files.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2018-12-20 10:01:51 +01:00
Sebastiaan van Stijn
555ea3fb43 Ignore modprobe failures in ExecStartPre (systemd unit)
When running containerd inside LXC, due to systemd being unable to execute
`modprobe overlay` inside the container (module is already loaded in host kernel).

This patch adds a `-` prefix to the `ExecStartPre` command, so that failures
are ignored, and the service can start as usual.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2018-11-10 12:52:06 +01:00
Akihiro Suda
ce6d4c9a9f add docs/rootless.md
Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
2018-11-06 17:39:30 +09:00
Lantao Liu
1442425f92 Support runtime specific configurations.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-10-08 17:17:29 -07:00
Lantao Liu
65283e4253 The indent is wrong.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-09-17 12:11:18 -07:00
Lantao Liu
3de8c8bf19 Update cri-tools to 98eea54af789ae13edce79cba101fb9ac8e7b241.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-09-17 10:54:42 -07:00
Tim Allclair
e7189a25c3 Add RuntimeHandler support
Signed-off-by: Tim Allclair <tallclair@google.com>
2018-09-05 17:27:35 -07:00
JulienBalestra
dffd0dfa0e streaming: tls conf validation to func with tests
Signed-off-by: JulienBalestra <julien.balestra@datadoghq.com>
2018-08-30 15:10:48 +02:00
JulienBalestra
859003a940 stream: struct for x509 key pair, update the docs, error management
Signed-off-by: JulienBalestra <julien.balestra@datadoghq.com>
2018-08-28 17:22:11 +02:00
Phil Estes
da1fba0050 Website no longer managed from this repo
Website content is deployed from containerd/containerd.io now

Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
2018-08-23 14:55:04 -04:00
Aleksa Sarai
7aa132ffc7 docs: man: rename config.toml(5) to be more descriptive
The man page namespace is global, so in order to avoid colliding with
other man pages named "config.toml" rename ours to be more descriptive.
This also helps with discoverability (now tab-completion of 'man
containerd<tab>' will return the config man page), as well as making it
much cleaner from the perspective of distributions that want to package
containerd.

Signed-off-by: Aleksa Sarai <asarai@suse.de>
2018-08-08 18:33:29 +10:00
Michael Crosby
2742238909 Add docs for managed opts dir
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
2018-08-03 11:50:02 -04:00
Lantao Liu
b3d6f16383 Serve streaming on localhost by default to match k8s 1.11 default.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-07-21 01:10:45 +00:00
yanxuean
7065dd81f9 support no_pivot option for runc
Signed-off-by: yanxuean <yan.xuean@zte.com.cn>
2018-07-20 08:46:50 +08:00
Lantao Liu
0f3c83b11b Use --no-overwrite-dir in installation doc.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-07-11 18:04:48 +00:00
Lantao Liu
952e53bf58 Add registry auth config, and use docker resolver in containerd.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-07-09 19:08:48 -07:00
Alban Crequy
6ef65b74e1 Document how to use systemd-run
It is also useful when testing local changes, I just run:

sudo systemd-run -p Delegate=yes -p KillMode=process bin/containerd

Signed-off-by: Alban Crequy <alban@kinvolk.io>
2018-06-27 16:58:30 +02:00
Lantao Liu
fd71c9f065 Fix another link.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-06-26 13:30:32 -07:00
Yu-Ju Hong
e23c0e708a Fix link to GCE getting started guide
Signed-off-by: Yu-Ju Hong <yjhong@google.com>
2018-06-25 12:10:03 -07:00
Lantao Liu
405f57f8e0 Add max_container_log_size
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-06-14 14:24:17 -07:00
Luc Perkins
e5e63539a6 Return Markdown files to /docs directory
Signed-off-by: Luc Perkins <lucperkins@gmail.com>
2018-05-16 11:23:50 -07:00
Luc Perkins
d1503dc9ce Migrate website to Hugo
Signed-off-by: Luc Perkins <lucperkins@gmail.com>
2018-05-15 12:30:26 -07:00
Lantao Liu
e22ebf420f Down containerd binaries from official release.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-04-24 01:23:44 -07:00
Lantao Liu
06f53b4838 Add unix:// prefix for socket addresses used by CRI remote client.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-04-20 17:36:25 -07:00
Lantao Liu
9aa9f85a03 Add release instruction to make the release process written down.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-04-16 06:46:22 +00:00
Lantao Liu
d8a3c5f254 Address comments.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-04-09 18:15:09 +00:00
Lantao Liu
b2099c2061 Add cni config template support.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-04-07 06:34:45 +00:00
Lantao Liu
ad7bffc093 Enable TLS streaming in all the setup.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-04-03 00:17:26 +00:00
Lantao Liu
c4f80aecb7 Merge pull request #711 from tklauser/libapparmor-dep
Drop libapparmor dependency from build docs
2018-04-02 11:55:27 -07:00
Tobias Klauser
d29678a3c4 Drop libapparmor dependency from build docs
As of opencontainers/runc@db093f6 runc no longer depends on libapparmor
thus libapparmor-dev no longer needs to be installed to build it or
anythind that depends on it (like containerd or cri-containerd). Adjust
the documentation accordingly.

containerd/containerd#2238 did the same for containerd.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2018-03-31 18:18:12 +02:00
Tyler Kellen
11189f6e8b fully specify --container-runtime-endpoint flag
Resolves this warning:
"/run/containerd/containerd.sock" as endpoint is deprecated please
consider using full url format "unix:///run/containerd/containerd.sock"

Signed-off-by: Tyler Kellen <tyler@sleekcode.net>
2018-03-28 17:23:43 -04:00
Lantao Liu
f0655ecfe0 Use pause image from new source.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-03-26 07:11:41 +00:00
Lantao Liu
356a41c424 Merge pull request #697 from Random-Liu/fs-layout-change
adds volatile state directory to the fs plan for cntrs/pods/fifo
2018-03-23 19:24:19 -07:00
Mike Brown
94df315de8 adds volatile state directory to the fs plan for cntrs/pods/fifo
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2018-03-24 00:05:52 +00:00
Lantao Liu
205892d935 Merge pull request #696 from Random-Liu/update-document
Update documents.
2018-03-23 14:47:33 -07:00
Lantao Liu
b05744478a Update documents.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-03-23 21:03:46 +00:00
Yanqiang Miao
559581e18a Add a document for cri plugin config
Signed-off-by: Yanqiang Miao <miao.yanqiang@zte.com.cn>
2018-03-23 15:08:58 +08:00
Lantao Liu
65c1cc77bb Merge pull request #682 from Random-Liu/update-doc
Update README.d and graphs.
2018-03-20 19:08:06 -07:00
Lantao Liu
129d060e10 Update README.d and graphs.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-03-20 21:11:23 +00:00
Lantao Liu
904938fa9d Fix for kube-up.sh and update several documments.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-03-20 09:24:15 +00:00
Lantao Liu
47855119ab Merge pull request #667 from mikebrow/doc-updates-cri-move
docs update for cri-containerd to cri move
2018-03-16 16:24:40 -07:00
Mike Brown
0ee7614785 docs update for cri-containerd to cri move
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2018-03-16 15:33:17 -05:00
Lantao Liu
7e67d96b9b Replace ctrcri with ctr cri.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-03-15 23:22:00 +00:00
Yanqiang Miao
4a8060f08b Add document about registry configuration
Signed-off-by: Yanqiang Miao <miao.yanqiang@zte.com.cn>
2018-03-08 11:02:57 +08:00
Mike Brown
ffea684c57 documents load image
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2018-03-05 15:57:44 -06:00