containerd checks for the grpc error code to determine
correct recover action upon grpc errors. We need to provide
them properly.
Unfortunately ttrpc doesn't support grpc interceptor so we have
to modify every service function for it.
Fixes: #1527
Signed-off-by: Peng Tao <bergwolf@hyper.sh>
cleanup() actually removes all things under testdir and
causes UT failures.
=== RUN TestCreateMockSandbox
ERRO[0000] Create new sandbox failed error="QEMU path (/tmp/vc-tmp-007004370/hypervisor) does not exist" sandbox=7f49d00d-1995-4156-8c79-5f5ab24ce138 sandboxid=7f49d00d-1995-4156-8c79-5f5ab24ce138 source=virtcontainers subsystem=sandbox
exit status 1
Fixes: #1525
Signed-off-by: Peng Tao <bergwolf@hyper.sh>
prepend a kata specific string to oci cgroup path to
form a different cgroup path, thus cAdvisor couldn't
find kata containers cgroup path on host to prevent it
from grabbing the stats data.
Fixes:#1488
Signed-off-by: lifupan <lifupan@gmail.com>
This commit bumps the golang version to remove the go modules hash
mismatch between 1.11 and 1.12.
Fixes: #1520
Signed-off-by: Sascha Grunert <sgrunert@suse.com>
There is no need to send another SIGKILL signal following
SIGTERM signal, otherwise, sending the SIGKILL signal would
get failed since the container process would has been terminated
by the previous SIGTERM signal.
Fixes:#1493
Signed-off-by: lifupan <lifupan@gmail.com>
This introduces a new storage type: local. Local storage type will
tell the kata-agent to create an empty directory in the sandbox
directory within the VM.
K8s host emptyDirs will then use the local storage type and mount it
inside each container. By doing this, we utilise the storage medium
that the sandbox uses. In most cases this will be 9p.
If the VM is using device mapper for container storage, the containers
will benefit from the better performance of device mapper for
host emptyDir.
Fixes#1472
Signed-off-by: Alex Price <aprice@atlassian.com>
Now, template feature can't work on arm64. When using bypass-shared-memory
cap to saving sandbox as a template, new sandbox cloning from the template
will fail. From initial investigation, it maybe a qemu issue. Further
research should be done.
To enable template on arm64, this patch adds a switch to offer the capability
to open or close the bypass-shared-memory cap.
While closing bypass-shared-memory cap, saving vm will occupy more space
and consume more time. So increase 300M for mount size and bump the time
waiting for migration to 10 seconds.
Fixes: #1336
Signed-off-by: Jianyong Wu <jianyong.wu@arm.com>
Store related in directory /var/lib/vc/sbs and /run/vc/sbs if
vm template is enabled.
The cause is NewVM and NewVMFromGrpc will create vcStore with
VM's ID and set it as store of hypervisor if the factory is enabled.
This commit record the VM's ID to HypervisorConfig.VMid and remove
directories in qemu.cleanupVM to handle the issue.
Fixes: #1452
Signed-off-by: Hui Zhu <teawater@hyper.sh>
This commit adds a new gRPC function Status to CacheService. VMCache
server will reply the status of VMCache server.
Factory destroy will call gRPC Status to get the status of VMCache
server and output it when VMCache is enabled.
Fixes: #1395
Signed-off-by: Hui Zhu <teawater@hyper.sh>
VMCache server just can be stopped by ctrl-c without current commit.
This commit adds a new gRPC function Quit to CacheService. VMCache
server will stop by itself after 1 second when Quit is called.
Factory destroy will call gRPC Quit when VMCache is enabled.
Fixes: #1395
Signed-off-by: Hui Zhu <teawater@hyper.sh>
We don't really require nested nor unrestricted_guest to run. And there
is no point validating host cpu properties in UT.
Fixes: #1508
Signed-off-by: Peng Tao <bergwolf@hyper.sh>
Current approach cannot work for shimv2 as there is no kata-shim thus
sandbox.state.pid is always -1. Let's just simplify things by always
making a container share pidns if it has a pidns path.
Signed-off-by: Peng Tao <bergwolf@hyper.sh>
When used builtin proxy, it's better to config the proxy
debug based on debug setting of runtime in kata configuration.
Fixes:#1495
Signed-off-by: lifupan <lifupan@gmail.com>
Depending of the linux versions some namespaces are supported or not.
To avoid failures running containers and unit tests in old linux kernels,
only the supported namespaces should be used.
Depends-on: github.com/kata-containers/tests#1414
fixes#228
Signed-off-by: Julio Montes <julio.montes@intel.com>
cri-o was moved to a new organization. The new URL
of the project is https://github.com/cri-o/cri-o
Update URL references.
Fixes: #1478.
Depends-on: github.com/kata-containers/tests#1409
Signed-off-by: Salvador Fuentes <salvador.fuentes@intel.com>
We have hit an issue using trusty in travis and go 1.11.7
the issue is fixed using xenial.
Fixes: #1492.
Signed-off-by: Salvador Fuentes <salvador.fuentes@intel.com>
- doc: update architecture.md link
- VMCache: check if vm_cache_endpoint file exists before VMCache server…
- vsock: Pass info about vsock being used or not to the agent.
- qemu: fix qemu leak when failed to start container
- hypervisor: return cpu->threadID mapping
- tests: do cleanUp() always in the end
- cgroups: remove duplicate fields from state
- shimv2: optionally plug rootfs block storage instead of mounting it
- linter: remove deadcode linter check for generic item
- virtcontainers: firecracker: disable ACPI
- config: validate proxy path
- lint: Change go linter from gometalinter to golangci-lint
- Factory: Fix fake return value issue on creating template
- config: Add config flag "experimental"
- Add more build targets
- Update collect script for dax nvdimm images
- Allow data collection to be hidden
- config: Make VMCache can work with vsock
- ci: check curl before use it
- virtcontainers: improve security and mount the rootfs as read-only fs
- refactor: improve readability of `bumpAttachCount`
57b103a vsock: Pass info about vsock being used or not to the agent.
fb64a3e doc: update architecture.md link
b6f382e VMCache: check if vm_cache_endpoint file exists before VMCache server runs
dd6d1e4 fc: return vcpu thread info properly
6fda03e hypervisor: make getThreadIDs return vcpu to threadid mapping
ad697cc vendor: add prometheus/procfs dependency
0e2be42 vendor: fix containerd/cgroups dependency
52c66d2 shimv2: plugin the block backed rootfs directly instead of mount it
628ea46 virtcontainers: change container's rootfs from string to mount alike struct
c0aedeb virtcontainers: firecracker: disable ACPI
096fa04 qemu: fix qemu leak when failed to start container
2e5194e linter: remove deadcode linter check for generic item
dca7a6f config: validate proxy path
dd6e8eb tests: do cleanUp() always in the end
ad7d9b7 cgroups: remove duplicate fields from state
f442876 lint: Update go linter from gometalinter to golangci-lint.
5d761ce scripts: Handle images with a DAX/NVDIMM header
bdf6b2d scripts: Handle missing partitions in collect script
ad228e3 build: Add missing targets to show-usage
e6a7091 build: Allow runtime to be built+installed without shim
206ffc6 build: Don't build the runtime when building shim binary
639e827 config: Make VMCache can work with vsock
aec0d26 ci: check curl before use it
9b73900 katautils: mask systemd-random-seed
6498466 virtcontainers: improve security and mount the rootfs as read-only fs
26a9b72 refactor: improve readability of `bumpAttachCount`
5a271f0 scripts: Allow data collection script output to be hidden
4f34a54 scripts: Refactor collect script
eadf977 Factory: Fix fake return value issue on creating template
da80c70 config: enhance Feature structure
111774c config: add docs for experimental
050f03b config: Add config flag "experimental"
Signed-off-by: Eric Ernst <eric.ernst@intel.com>
We need to change the constraints of kata agent into the memory-hotplug
related commit, to keep track of the revisons in kata agent.
Fixes: #1149
Signed-off-by: Penny Zheng <penny.zheng@arm.com>
we need to notify guest kernel about memory hot-added event via probe interface.
hot-added memory deivce should be sliced into the size of memory section.
Fixes: #1149
Signed-off-by: Penny Zheng <penny.zheng@arm.com>
If kata-runtime supports memory hotplug via probe interface, we need to reconstruct
memoryDevice to store relevant status, which are addr and probe. addr specifies the
physical address of the memory device, and probe determines it is hotplugged via
acpi-driven or probe interface.
Fixes: #1149
Signed-off-by: Penny Zheng <penny.zheng@arm.com>
In order to support memory hotplug via probe interface in kata-runtime,
firstly, we need to verify whether guest kernel is capable of that.
Fixes: #1149
Signed-off-by: Penny Zheng <penny.zheng@arm.com>
