github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2026-07-25 22:49:59 +00:00
Code Issues Projects Releases Wiki Activity

nvidia/runtime-rs: use block-plain emptyDir

Browse Source 
Set the non-confidential NVIDIA runtime-rs emptyDir mode to
block-plain through a dedicated Makefile default.

This prepares the runtime class for configurations where filesystem
sharing is disabled and emptyDir volumes need to be backed by
guest-mounted block devices instead of shared-fs.

Also add the shared configure_nvidia_runtime_rs_shared_fs_dropin()
test helper, which keeps the NVIDIA runtime-rs Docker/nerdctl smoke
tests on virtio-fs while the shared_fs=none + EROFS snapshotter path
is exercised by Kubernetes CI.

Signed-off-by: Manuel Huber <manuelh@nvidia.com>
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: OpenAI Codex <codex@openai.com>
This commit is contained in:
Manuel Huber
2026-07-18 11:29:09 +02:00
committed by Fabiano Fidêncio
parent a2fbc64e27
commit 4747bf4dab
2 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/runtime-rs/Makefile
View File

@@ -204,6 +204,7 @@ DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"kernel_params\", \"kernel_veri
DEFDISABLEGUESTSECCOMP := true
DEFEMPTYDIRMODE := shared-fs
DEFEMPTYDIRMODE_COCO := block-encrypted
DEFEMPTYDIRMODE_NV := block-plain
##VAR DEFAULTEXPFEATURES=[features] Default experimental features enabled
DEFAULTEXPFEATURES := []
DEFDISABLESELINUX := false
@@ -751,6 +752,7 @@ USER_VARS += DEFNETWORKMODEL_QEMU
USER_VARS += DEFNETWORKMODEL_FC
USER_VARS += DEFEMPTYDIRMODE
USER_VARS += DEFEMPTYDIRMODE_COCO
USER_VARS += DEFEMPTYDIRMODE_NV
USER_VARS += DEFDISABLEGUESTSECCOMP
USER_VARS += DEFDISABLESELINUX
USER_VARS += DEFDISABLEGUESTSELINUX

25
tests/common.bash
View File

@@ -807,6 +807,31 @@ function enabling_hypervisor() {
export KATA_CONFIG_PATH="${DEST_KATA_CONFIG}"
}
# Docker and nerdctl smoke tests exercise Kata through the default overlayfs
# snapshotter path. Keep NVIDIA runtime-rs on virtio-fs for those tests; the
# shared_fs=none + EROFS snapshotter path is covered by Kubernetes CI instead.
function configure_nvidia_runtime_rs_shared_fs_dropin() {
case "${KATA_HYPERVISOR:-}" in
qemu-nvidia-cpu-runtime-rs) ;;
*) return 0 ;;
esac
local -r cfg="${KATA_CONFIG_PATH:-}"
[[ -z "${cfg}" || ! -e "${cfg}" ]] && return 0
local -r dropin_dir="$(dirname "${cfg}")/config.d"
local -r dropin_path="${dropin_dir}/99-nvidia-runtime-rs-shared-fs.toml"
info "Configuring NVIDIA runtime-rs shared-fs smoke test via ${dropin_path}"
sudo mkdir -p "${dropin_dir}"
sudo tee "${dropin_path}" >/dev/null <<EOF
[hypervisor.qemu]
shared_fs = "virtio-fs"
[runtime]
emptydir_mode = "shared-fs"
EOF
}
function check_containerd_config_for_kata() {
declare -r containerd_path="/etc/containerd/config.toml"