From cebb259e5142bc74f48e0ad7e4fb11340e622711 Mon Sep 17 00:00:00 2001 From: "alex.lyn" Date: Sun, 1 Jun 2025 22:45:15 +0800 Subject: [PATCH] runtime-rs: Introduce force guest pulling image Container image integrity protection is a critical practice involving a multi-layered defense mechanism. While container images inherently offer basic integrity verification through Content-Addressable Storage (CAS) (ensuring pulled content matches stored hashes), a combination of other measures is crucial for production environments. These layers include: Encrypted Transport (HTTPS/TLS) to prevent tampering during transfer; Image Signing to confirm the image originates from a trusted source; Vulnerability Scanning to ensure the image content is "healthy"; and Trusted Registries with stringent access controls. In certain scenarios, such as when container image confidentiality requirements are not stringent, and integrity is already ensured via the aforementioned mechanisms (especially CAS and HTTPS/TLS), adopting "force guest pull" can be a viable option. This implies that even when pulling images from a container registry, their integrity remains guaranteed through content hashes and other built-in mechanisms, without relying on additional host-side verification or specialized transfer methods. Since this feature is already available in runtime-go and offers synergistic benefits with guest pull, we have chosen to support force guest pull. Fixes #10690 Signed-off-by: alex.lyn --- src/libs/kata-types/src/mount.rs | 2 ++ .../crates/resource/src/manager_inner.rs | 17 +++++++++++++++-- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/src/libs/kata-types/src/mount.rs b/src/libs/kata-types/src/mount.rs index 629a1ee3b5..eac2afbffb 100644 --- a/src/libs/kata-types/src/mount.rs +++ b/src/libs/kata-types/src/mount.rs @@ -63,6 +63,8 @@ pub const KATA_VIRTUAL_VOLUME_IMAGE_NYDUS_FS: &str = "image_nydus_fs"; pub const KATA_VIRTUAL_VOLUME_LAYER_NYDUS_FS: &str = "layer_nydus_fs"; /// Download and extra container image inside guest vm. pub const KATA_VIRTUAL_VOLUME_IMAGE_GUEST_PULL: &str = "image_guest_pull"; +/// In CoCo scenario, we support force_guest_pull to enforce container image guest pull without remote snapshotter. +pub const KATA_IMAGE_FORCE_GUEST_PULL: &str = "force_guest_pull"; /// Manager to manage registered storage device handlers. pub type StorageHandlerManager = HandlerManager; diff --git a/src/runtime-rs/crates/resource/src/manager_inner.rs b/src/runtime-rs/crates/resource/src/manager_inner.rs index f8d40cff72..2f419c4100 100644 --- a/src/runtime-rs/crates/resource/src/manager_inner.rs +++ b/src/runtime-rs/crates/resource/src/manager_inner.rs @@ -17,8 +17,11 @@ use hypervisor::{ }, BlockConfig, Hypervisor, VfioConfig, }; -use kata_types::config::{hypervisor::TopologyConfigInfo, TomlConfig}; use kata_types::mount::Mount; +use kata_types::{ + config::{hypervisor::TopologyConfigInfo, TomlConfig}, + mount::{adjust_rootfs_mounts, KATA_IMAGE_FORCE_GUEST_PULL}, +}; use oci::{Linux, LinuxCpu, LinuxResources}; use oci_spec::runtime::{self as oci, LinuxDeviceType}; use persist::sandbox_persist::Persist; @@ -322,6 +325,16 @@ impl ResourceManagerInner { rootfs_mounts: &[Mount], annotations: &HashMap, ) -> Result> { + let adjust_rootfs_mounts = if !self + .config() + .runtime + .is_experiment_enabled(KATA_IMAGE_FORCE_GUEST_PULL) + { + rootfs_mounts.to_vec() + } else { + adjust_rootfs_mounts()? + }; + self.rootfs_resource .handler_rootfs( &self.share_fs, @@ -331,7 +344,7 @@ impl ResourceManagerInner { cid, root, bundle_path, - rootfs_mounts, + &adjust_rootfs_mounts, annotations, ) .await