Commit Graph

5706 Commits

Author SHA1 Message Date
Snir Sheriber
894fa42a57 rustjail: allow network sysctls
The network ns is shared with the guest skip looking for it
in the spec

Fixes: #1228
Signed-off-by: Snir Sheriber <ssheribe@redhat.com>
2021-01-05 17:12:42 +02:00
Tim Zhang
91c6ba74fa
Merge pull request #1225 from Tim-Zhang/update-cgroup-to-0.2.0
agent: upgrade cgroups to 0.2.0
2021-01-05 19:50:05 +08:00
Peng Tao
7f38c200e0
Merge pull request #1202 from dgibson/bug1201
agent: Simplify .or_else() to .or()
2021-01-05 14:42:53 +08:00
Tim Zhang
d4cd255485 agent: Avoid container stats panic caused by cgroup controller non-exist
Return SingularPtrField::none() instead of panic when getting stats
from cgroup failed caused by cgroup controller missing.

Signed-off-by: Tim Zhang <tim@hyper.sh>
2021-01-05 11:35:41 +08:00
Tim Zhang
157e055fdd agent: upgrade crate cgroups to 0.2.0
Fixes: #1224

35ecd6f (origin/change-name, change-name) Update readme
eb6577e Change package name to cgroups-rs
8f6a7e0 Merge pull request #19 from Tim-Zhang/0.2.0
9baa065 (origin/0.2.0, 0.2.0) release: v0.2.0
e160df0 Make read_i64_from private and merge read_str_from to its caller
e1e05d3 Make new_with_relative_paths=new and load_with_relative_paths=new in v2
a89f4a0 Support set notify_on_release & release_agent
61a0957 Fix set_swappiness in cgroup v2
0592045 Ignore kmem in cgroup v2
c254fff Update readme
438d774 Fix test
42ee1ba Make Cgroup can be stored in struct
b6bb5ae docs: Hide Re-exports
d2882b1 Print cause when println!("{}")
abcb5ed Add more logs for create_dir error in controller.create
1f188be Detect subsystems and get root from /proc/self/mountinfo
fbd7164 Fix warnings in tests
f342254 Remove Box wrap of Cgroup.hire
cd998f3 Do not place cgroup under relative path read from cgroup by default
1ac76b6 Make function find_v1_mount pub
121f78d Expose deletion error
0f76570 Avoid exception caused by cgroup writeback feature
10650e2 Update tests to adapt new type of fields in resource
567cdb4 Use Option as resource fields, remove the update switch: update_values
0c18b08 Support customized attributes for CpuController and MemController
ca610bb add add_task_by_tgid

Signed-off-by: Tim Zhang <tim@hyper.sh>
2021-01-05 11:35:34 +08:00
David Gibson
e3ec1d509e agent: Simplify .or_else() to .or()
get_bool_value() in src/agent/src/config.rs includes a Result::or_else()
call with a trivial closure which can be replaced by a Result::or.  This
removes a clippy warning.

fixes #1201

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-01-05 12:54:21 +11:00
David Gibson
e9e39fd081
Merge pull request #1207 from dgibson/bug1206
Fix error reporting in listInterfaces() and listRoutes()
2021-01-05 12:02:07 +11:00
Peng Tao
0e215ece36
Merge pull request #1215 from jiangliu/liujiang/validator
improve rustjail validator
2020-12-28 15:32:23 +08:00
Liu Jiang
b366af9358 jail: add more test cases for validator
Fixes: #1214

Signed-off-by: Liu Jiang <gerry@linux.alibaba.com>
2020-12-24 20:17:06 +08:00
Liu Jiang
d38a5d3fcf jail/validator: introduce helpers to reduce duplicated code
Fixes: #1214

Signed-off-by: Liu Jiang <gerry@linux.alibaba.com>
2020-12-24 19:02:31 +08:00
Liu Jiang
76ad32136f jail/validator: avoid unwrap() for safety
Explicitly return error codes instead of unwrap().

Fixes: #1214

Signed-off-by: Liu Jiang <gerry@linux.alibaba.com>
2020-12-24 19:02:13 +08:00
Liu Jiang
51fd624f3e rustjail: add more context info for errors
Fixes: #1214

Signed-off-by: Liu Jiang <gerry@linux.alibaba.com>
2020-12-24 17:47:58 +08:00
Peng Tao
f1b3f2e178
Merge pull request #1150 from fidencio/wip/make-install-breaks
Add void "install" targets for both "trace-forwarder" and "agent-ctl"
2020-12-23 18:41:42 +08:00
Peng Tao
d6a6f68fd7
Merge pull request #1177 from devimc/2020-12-07/osbuilder/gentoo
[forwardport] Add support for Gentoo
2020-12-23 18:39:12 +08:00
Peng Tao
109ab54d63
Merge pull request #1212 from jiangliu/typo
oci: fix a typo in "addtionalGids"
2020-12-23 18:03:26 +08:00
Bin Liu
8d6096210e
Merge pull request #1186 from maruthgoyal/2.0-dev
Don't update cpusets if no CPUs changed closes #1172
2020-12-23 10:05:59 +08:00
Liu Jiang
9321e1b21b oci: fix two incompatible issues with OCI spec
The first incompatible issue is caused by a typo, "swapiness" should
be "swappiness". The second incompatible issue is caused by a serde
format. The struct LinuxBlockIODevice is introduced for convenience,
but it also changes serialized data, so "#[serde(flatten)]" should
be used for compatibility with OCI spec.

Fixes: #1211

Signed-off-by: Liu Jiang <gerry@linux.alibaba.com>
2020-12-22 11:16:15 +08:00
Liu Jiang
406a91ffdd agent: consume ttrpc crate from crates.io
The ttrpc v0.3.0 has been published to crates.io, so consume from
crates.io.

Fixes: #1213

Signed-off-by: Liu Jiang <gerry@linux.alibaba.com>
2020-12-22 09:46:41 +08:00
Liu Jiang
6181570ccc oci: fix a typo in "addtionalGids"
There's a typo in "addtionalGids", which should be "additionalGids".

Fixes: #1211

Signed-off-by: Liu Jiang <gerry@linux.alibaba.com>
2020-12-22 00:03:27 +08:00
Maruth Goyal
4af5beda35 agent/sandbox: Don't update cpuset when ncpus = 0
When receiving an OnlineCpuMemory RPC, if the number of CPUs to be
made available is 0, then updating the cpusets is a redundant operation.

Fixes: #1172

Signed-off-by: Maruth Goyal <maruthgoyal@gmail.com>
2020-12-18 18:11:16 +05:30
David Gibson
e004616b02 runtime/network: Fix error reporting in listRoutes()
If the upcast from resultingRoutes to *grpc.IRoutes fails, we return
(nil, err), but previous code ensures that err is nil at that point, so we
return no error.

fixes #1206

Forward port of
0ffaeeb5d8

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-12-18 14:36:09 +11:00
David Gibson
1ae8e81abb runtime/network: Correct error reporting in listInterfaces()
If the upcast from resultingInterfaces to *grpc.Interfaces fails, we
return (nil, err), but previous code ensures that err is nil at that
point, so we return no error.

Forward port of
b86e904c2d

fixes #1206

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-12-18 14:35:50 +11:00
Bin Liu
1b2ccf87f8
Merge pull request #1189 from devimc/2020-12-10/improveDebianImage
rootfs: reduce size of debian image
2020-12-17 22:35:34 +08:00
Bin Liu
caa6965c17
Merge pull request #1183 from wainersm/runtime_destdir
runtime: Allow to overwrite DESTDIR
2020-12-17 14:10:56 +08:00
Bin Liu
7fa3045136
Merge pull request #1175 from devimc/2020-12-07/fixSnapWorkflow
snap: fix snap release channel
2020-12-17 12:51:22 +08:00
Bin Liu
3b87d10d79
Merge pull request #1191 from mxpv/fd
Don't leak fd when reseeding rng
2020-12-17 12:50:55 +08:00
David Gibson
c2da484e23
Merge pull request #1199 from dgibson/proto-regen
Fixes for make generate-protocols
2020-12-17 15:43:49 +11:00
David Gibson
a19263e58d agent/protocols: Remove unneeded import from oci.proto
oci.proto imports "google/protobuf/wrappers.proto", but doesn't appear to
use it, which causes a warning from protoc when we compile it.  Remove the
import to fix the warning.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-12-17 13:06:41 +11:00
David Gibson
a19cf28c26 agent/protocols: Remove some unnecessary include directives from protoc
The generate_go_sources() function in update-generate-proto.sh adds a
number of include directives to the protoc command line.  Some of these
don't appear to be necessary to correctly compile the agent's protocol
files, so remove them.

Amongst other things were directives pointing at the old Kata1 runtime and
agent repositories.  Those ones could be actively harmful by causing odd
dependencies of the Kata2 build on the Kata1 repositories.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-12-16 12:10:27 +11:00
David Gibson
2b4520904c agent/protocols: Remove some unneeded dependencies for protocol generation
src/agent/protocols/hack/update-generated-proto.sh checks for the presence
of protoc-gen-rust and ttrpc_rust_plugin, but it doesn't actually need
them.  Those tools are needed to generate Rust code from the gRPC proto
files, but that's already handled in src/agent/protocols/build.rs using
Cargo for dependency management.

This script is only needed for the Go code, for which the other tools are
sufficient.

fixes #1198

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-12-16 12:10:27 +11:00
Bo Chen
9f317009b0
Merge pull request #1194 from yuchunyu97/patch-1
docs: Fix docs in docs/architecture.md
2020-12-15 07:35:29 -08:00
AIsland
b36c9ea3fa docs: Fix docs in docs/architecture.md
Correct the docs in docs/architecture.md,

use virtio-fs as the default config.

Fixes: #1193

Signed-off-by: AIsland <yuchunyu01@inspur.com>
2020-12-14 09:31:20 +08:00
Maksym Pavlenko
3db1c8059d agent: Don't leak fd when reseeding rng
This PR wraps fd raw descriptor with File, so it'll be properly closed once exited.

Fixes: #1192

Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
2020-12-11 16:18:41 -08:00
Bo Chen
8edfab73c3
Merge pull request #1170 from likebreath/1203/update_virt_docs
docs: Update the Cloud Hypervisor description in virtualization.md
2020-12-10 09:04:20 -08:00
Julio Montes
8ac93f65fd rootfs-builder: add support for gentoo
Generate images based on gentoo

fixes #1178

Signed-off-by: Julio Montes <julio.montes@intel.com>
2020-12-10 09:36:15 -06:00
Julio Montes
9897238f3a rootfs: reduce size of debian image
Improve Kata Containers memory footprint by reducing debian
image size.

Without this change:
Debian image -> 256MB

With this change:
Debian image -> 128MB

Note: this change *will not* impact ubuntu image.

fixes #1188

Signed-off-by: Julio Montes <julio.montes@intel.com>
2020-12-10 09:23:48 -06:00
Bo Chen
d47122e959 docs: Update the Cloud Hypervisor description in virtualization.md
The current description on the Cloud Hypervisor support in Kata
containers were introduced back to kata 1.10 and are out-dated.

Depends-on: github.com/kata-containers/tests#3106

Fixes: #1167

Signed-off-by: Bo Chen <chen.bo@intel.com>
2020-12-10 06:17:53 -08:00
Wainer dos Santos Moschetta
10e9bfc6f7 runtime: Allow to overwrite DESTDIR
On runtime/Makefile the value of DESTDIR is set to "/", unless one
pass that variable as an argument to `make`. This change will
allow its overwrite if DESTDIR is exported in the environment as
well.

Fixes #1182

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2020-12-09 09:04:04 -05:00
Julio Montes
faed2369a0 rootfs-builder: add functions to run before and after the container
Define `before_starting_container` and `after_stopping_container`
functions, these functions run before and after the container that
builds the rootfs respectively.

Signed-off-by: Julio Montes <julio.montes@intel.com>
2020-12-08 10:14:00 -06:00
Peng Tao
e167bf30e3
Merge pull request #1165 from liubin/fix/exec-hang-when-bg-process-running
agent: exit from exec hangs if background process is present
2020-12-08 20:32:23 +08:00
Julio Montes
94b9b812c7
Merge pull request #1173 from devimc/2020-12-07/updateSnapDoc
[forwardport] install: Improve snap documentation
2020-12-07 14:07:25 -06:00
Julio Montes
8e5603e6a8 snap: fix snap release channel
According to the new snap document
`docs/install/snap-installation-guide.md`, Kata Containers 2.x should
be available in the snapcraft `candidate` channel.

fixes #1174

Signed-off-by: Julio Montes <julio.montes@intel.com>
2020-12-07 13:37:57 -06:00
Julio Montes
8f53893535 install: Improve snap documentation
Improve snap documentation, document how to install
kata 1.x and 2.x, how to configure them and their integration
with container engines.

fixes #1138

Signed-off-by: Julio Montes <julio.montes@intel.com>
2020-12-07 08:56:11 -06:00
bin liu
1ca415d87e agent: exit from exec hangs if background process is present
This is the Rust porting of https://github.com/kata-containers/agent/pull/371

`read_stdout`/`read_stderr` is blocking rpc calls, if exec process
exited, these calls is on blocking state for reading on process's
term master fd, and can't get a chance to break the wait.

In this PR, `read_stdout`/`read_stderr` will not read directly from
a term master of a process, instead, it will first have to get
an fd to read from newly added `epoller.poll()`. `epoller.poll()` may returns:

- the term master fd of exec process, if the process is running.
- a fd(piped fd) will return EOF when reading to indicate that th process is exited.

Fixes: #1160

Signed-off-by: bin liu <bin@hyper.sh>
2020-12-07 10:52:44 +08:00
Peng Tao
4bca7312c7
Merge pull request #1158 from liubin/fix/1156-fix-cpuset
handle vcpus properly utilized in the guest
2020-12-04 22:32:15 +08:00
Bin Liu
35e79c97cf
Merge pull request #920 from YchauWang/update-docs-2.0-5
docs: fix the custom agent binary file path for creating initrd image
2020-12-04 21:41:20 +08:00
Ychau Wang
a00f7c3484 docs: fix the custom agent binary file path for creating initrd image
fix the custom agent binary file path for creating an initrd image in
the Developer-Guide.md file.

Fixes: #919

Signed-off-by: Ychau Wang <wangyongchao.bj@inspur.com>
2020-12-04 17:19:23 +08:00
Fabiano Fidêncio
f7383ef835
Merge pull request #1166 from cmaf/fix-ctx-port
shimv2: handle ctx passed by containerd
2020-12-03 19:45:52 +01:00
Bin Liu
4e0a7e31f9
Merge pull request #1103 from likebreath/1111/clh_fix_cleanupVM
runtime: clh: Enforce to call 'cleanupVM' for 'stopSandbox'
2020-12-03 17:34:26 +08:00
Chelsea Mafrica
0155fe1260 shimv2: handle ctx passed by containerd
Sometimes shim process cannot be shutdown because of container list
is not empty. This container list is written in shim service, while
creating container. We find that if containerd cancel its Create
Container Request due to timeout, but runtime didn't handle it properly
and continue creating action, then this container cannot be deleted at
all. So we should make sure the ctx passed to Create Service rpc call
is effective.

Fixes #1088

Signed-off-by: Yves Chan <shanks.cyp@gmail.com>
Signed-off-by: Chelsea Mafrica <chelsea.e.mafrica@intel.com>
2020-12-02 14:28:31 -08:00