8a1280b2b6
The Collector.Collect will be the field ns'Collect's callback, which be invoked periodically with internal lock. And Collector.Add also runs with ns.Lock in Collector.Lock, which is easy to cause deadlock. Goroutine X: ns.Collect ns.Lock Collector.Collect Collector.RLock Goroutine Y: Collector.Add Collector.Lock ns.Lock We should use ns.Lock without Collector.Lock in Add. Fix: #6772 Signed-off-by: Wei Fu <fuweid89@gmail.com>
299 lines
10 KiB
Ruby
299 lines
10 KiB
Ruby
# -*- mode: ruby -*-
|
|
# vi: set ft=ruby :
|
|
|
|
# Copyright The containerd Authors.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# Vagrantfile for Fedora and EL
|
|
Vagrant.configure("2") do |config|
|
|
config.vm.box = ENV["BOX"] || "fedora/35-cloud-base"
|
|
config.vm.box_version = ENV["BOX_VERSION"]
|
|
memory = 4096
|
|
cpus = 2
|
|
config.vm.provider :virtualbox do |v|
|
|
v.memory = memory
|
|
v.cpus = cpus
|
|
end
|
|
config.vm.provider :libvirt do |v|
|
|
v.memory = memory
|
|
v.cpus = cpus
|
|
end
|
|
|
|
# Disabled by default. To run:
|
|
# vagrant up --provision-with=upgrade-packages
|
|
# To upgrade only specific packages:
|
|
# UPGRADE_PACKAGES=selinux vagrant up --provision-with=upgrade-packages
|
|
#
|
|
config.vm.provision "upgrade-packages", type: "shell", run: "never" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-upgrade-packages"
|
|
sh.env = {
|
|
'UPGRADE_PACKAGES': ENV['UPGRADE_PACKAGES'],
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
set -eux -o pipefail
|
|
dnf -y upgrade ${UPGRADE_PACKAGES}
|
|
SHELL
|
|
end
|
|
|
|
# To re-run, installing CNI from RPM:
|
|
# INSTALL_PACKAGES="containernetworking-plugins" vagrant up --provision-with=install-packages
|
|
#
|
|
config.vm.provision "install-packages", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-packages"
|
|
sh.env = {
|
|
'INSTALL_PACKAGES': ENV['INSTALL_PACKAGES'],
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
set -eux -o pipefail
|
|
dnf -y install \
|
|
container-selinux \
|
|
curl \
|
|
gcc \
|
|
git \
|
|
iptables \
|
|
libseccomp-devel \
|
|
libselinux-devel \
|
|
lsof \
|
|
make \
|
|
${INSTALL_PACKAGES}
|
|
SHELL
|
|
end
|
|
|
|
# EL does not have /usr/local/{bin,sbin} in the PATH by default
|
|
config.vm.provision "setup-etc-environment", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-setup-etc-environment"
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
set -eux -o pipefail
|
|
cat >> /etc/environment <<EOF
|
|
PATH=/usr/local/go/bin:/usr/local/bin:/usr/local/sbin:$PATH
|
|
EOF
|
|
source /etc/environment
|
|
SHELL
|
|
end
|
|
|
|
# To re-run this provisioner, installing a different version of go:
|
|
# GO_VERSION="1.14.6" vagrant up --provision-with=install-golang
|
|
#
|
|
config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-golang"
|
|
sh.env = {
|
|
'GO_VERSION': ENV['GO_VERSION'] || "1.18",
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
set -eux -o pipefail
|
|
curl -fsSL "https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz" | tar Cxz /usr/local
|
|
cat >> /etc/profile.d/sh.local <<EOF
|
|
GOPATH=\\$HOME/go
|
|
PATH=\\$GOPATH/bin:\\$PATH
|
|
export GOPATH PATH
|
|
EOF
|
|
source /etc/profile.d/sh.local
|
|
SHELL
|
|
end
|
|
|
|
config.vm.provision "setup-gopath", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-setup-gopath"
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
mkdir -p ${GOPATH}/src/github.com/containerd
|
|
ln -fnsv /vagrant ${GOPATH}/src/github.com/containerd/containerd
|
|
SHELL
|
|
end
|
|
|
|
config.vm.provision "install-runc", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-runc"
|
|
sh.env = {
|
|
'RUNC_FLAVOR': ENV['RUNC_FLAVOR'] || "runc",
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
${GOPATH}/src/github.com/containerd/containerd/script/setup/install-runc
|
|
type runc
|
|
runc --version
|
|
chcon -v -t container_runtime_exec_t $(type -ap runc)
|
|
SHELL
|
|
end
|
|
|
|
config.vm.provision "install-cni", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-cni"
|
|
sh.env = {
|
|
'CNI_BINARIES': 'bridge dhcp flannel host-device host-local ipvlan loopback macvlan portmap ptp tuning vlan',
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
${GOPATH}/src/github.com/containerd/containerd/script/setup/install-cni
|
|
PATH=/opt/cni/bin:$PATH type ${CNI_BINARIES} || true
|
|
SHELL
|
|
end
|
|
|
|
config.vm.provision "install-cri-tools", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-cri-tools"
|
|
sh.env = {
|
|
'CRI_TOOLS_VERSION': ENV['CRI_TOOLS_VERSION'] || '16911795a3c33833fa0ec83dac1ade3172f6989e',
|
|
'GOBIN': '/usr/local/bin',
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
${GOPATH}/src/github.com/containerd/containerd/script/setup/install-critools
|
|
type crictl critest
|
|
critest --version
|
|
SHELL
|
|
end
|
|
|
|
config.vm.provision "install-containerd", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-containerd"
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
cd ${GOPATH}/src/github.com/containerd/containerd
|
|
make BUILDTAGS="seccomp selinux no_aufs no_btrfs no_devmapper no_zfs" binaries install
|
|
type containerd
|
|
containerd --version
|
|
chcon -v -t container_runtime_exec_t /usr/local/bin/{containerd,containerd-shim*}
|
|
./script/setup/config-containerd
|
|
SHELL
|
|
end
|
|
|
|
config.vm.provision "install-gotestsum", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-gotestsum"
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
${GOPATH}/src/github.com/containerd/containerd/script/setup/install-gotestsum
|
|
sudo cp ${GOPATH}/bin/gotestsum /usr/local/bin/
|
|
SHELL
|
|
end
|
|
|
|
# SELinux is Enforcing by default.
|
|
# To set SELinux as Disabled on a VM that has already been provisioned:
|
|
# SELINUX=Disabled vagrant up --provision-with=selinux
|
|
# To set SELinux as Permissive on a VM that has already been provsioned
|
|
# SELINUX=Permissive vagrant up --provision-with=selinux
|
|
config.vm.provision "selinux", type: "shell", run: "never" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-selinux"
|
|
sh.env = {
|
|
'SELINUX': ENV['SELINUX'] || "Enforcing"
|
|
}
|
|
sh.inline = <<~SHELL
|
|
/vagrant/script/setup/config-selinux
|
|
/vagrant/script/setup/config-containerd
|
|
SHELL
|
|
end
|
|
|
|
# SELinux is permissive by default (via provisioning) in this VM. To re-run with SELinux enforcing:
|
|
# vagrant up --provision-with=selinux-enforcing,test-integration
|
|
#
|
|
config.vm.provision "test-integration", type: "shell", run: "never" do |sh|
|
|
sh.upload_path = "/tmp/test-integration"
|
|
sh.env = {
|
|
'RUNC_FLAVOR': ENV['RUNC_FLAVOR'] || "runc",
|
|
'GOTEST': ENV['GOTEST'] || "go test",
|
|
'GOTESTSUM_JUNITFILE': ENV['GOTESTSUM_JUNITFILE'],
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
rm -rf /var/lib/containerd-test /run/containerd-test
|
|
cd ${GOPATH}/src/github.com/containerd/containerd
|
|
go test -v -count=1 -race ./metrics/cgroups
|
|
make integration EXTRA_TESTFLAGS="-timeout 15m -no-criu -test.v" TEST_RUNTIME=io.containerd.runc.v2 RUNC_FLAVOR=$RUNC_FLAVOR
|
|
SHELL
|
|
end
|
|
|
|
# SELinux is permissive by default (via provisioning) in this VM. To re-run with SELinux enforcing:
|
|
# vagrant up --provision-with=selinux-enforcing,test-cri
|
|
#
|
|
config.vm.provision "test-cri", type: "shell", run: "never" do |sh|
|
|
sh.upload_path = "/tmp/test-cri"
|
|
sh.env = {
|
|
'GOTEST': ENV['GOTEST'] || "go test",
|
|
'REPORT_DIR': ENV['REPORT_DIR'],
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
systemctl disable --now containerd || true
|
|
rm -rf /var/lib/containerd /run/containerd
|
|
function cleanup()
|
|
{
|
|
journalctl -u containerd > /tmp/containerd.log
|
|
systemctl stop containerd
|
|
}
|
|
selinux=$(getenforce)
|
|
if [[ $selinux == Enforcing ]]; then
|
|
setenforce 0
|
|
fi
|
|
systemctl enable --now ${GOPATH}/src/github.com/containerd/containerd/containerd.service
|
|
if [[ $selinux == Enforcing ]]; then
|
|
setenforce 1
|
|
fi
|
|
trap cleanup EXIT
|
|
ctr version
|
|
critest --parallel=$(nproc) --report-dir="${REPORT_DIR}" --ginkgo.skip='HostIpc is true'
|
|
SHELL
|
|
end
|
|
|
|
# Rootless Podman is used for testing CRI-in-UserNS
|
|
# (We could use rootless nerdctl, but we are using Podman here because it is available in dnf)
|
|
config.vm.provision "install-rootless-podman", type: "shell", run: "never" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-rootless-podman"
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
set -eux -o pipefail
|
|
# Delegate cgroup v2 controllers to rootless
|
|
mkdir -p /etc/systemd/system/user@.service.d
|
|
cat > /etc/systemd/system/user@.service.d/delegate.conf << EOF
|
|
[Service]
|
|
Delegate=yes
|
|
EOF
|
|
systemctl daemon-reload
|
|
# Install Podman
|
|
dnf install -y podman
|
|
# Configure Podman to resolve `golang` to `docker.io/library/golang`
|
|
mkdir -p /etc/containers
|
|
cat > /etc/containers/registries.conf <<EOF
|
|
[registries.search]
|
|
registries = ['docker.io']
|
|
EOF
|
|
# Disable SELinux to allow overlayfs
|
|
setenforce 0
|
|
SHELL
|
|
end
|
|
|
|
end
|