Add containerd and crio versions that support
`privileged_without_host_devices` behaviour.
Fixes#638
Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
This will allow lock operations, needed by programs like
`apt-get upgrade`.
Fixes: #2594
Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
Fix the `build-kernel.sh` script to sort patches correctly. Previously,
it relied on `find(1)` for the ordering. However, `find(1)` does not
guarantee any ordering of files within a directory. Since the ordering
could therefore be "random", it was quite possible for patches to be
applied in the wrong order, resulting in conflicts.
Fixes: #1003.
Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
This PR fixes the opensuse installation guide, it solves the issue of
having an extra empty space at the end of the distro name which is causing
a failure when we want to add the kata containers obs repository as we
are looking for http://download.opensuse.org/repositories/home:/katacontainers:/releases:/x86_64:/master/openSUSE_Leap_15.1%20/
which is non existing and it is giving us an error of Valid metadata not found at specified URL.
This PR replaces the URL for a correct one.
Fixes#635
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
Update golang to 1.13.9 in versions.yaml.
In addition, add same golang version to `.travis.yml` and
delete the call to `.ci/install_go.sh` as it started to
cause problems in travis CI.
Fixes: #2592.
Signed-off-by: Salvador Fuentes <salvador.fuentes@intel.com>
For obs and running the packages testing in Fedora, we need to remove
the performing of doing an update as it is hit by
https://github.com/kata-containers/runtime/issues/2580. This is needed
to unblock the errors in the testing.
Fixes#1001
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
The default k3s containerRuntimeVersion takes the form of:
containerd://1.3.3-k3s2
The awk was stripping away the k3s portion before checking if it was a
k3s containerd.
fixes#996
Signed-off-by: Brandon Wilson <brandon@coil.com>
Since fs sharing is not assumed as supported by default, expose
explicitly that the qemu_ppc64le supports it.
Fixes: #2584
Signed-off-by: Nitesh Konkar <niteshkonkar@in.ibm.com>
We want to launch the KVM launcher tool (qemu?) with an SELinux label, similar
to what we do with libvirt.
Currently when I use kata with Podman, it complains if we specify a label that
kata does not support SELinux labels. What I would like to do is have kata just
use this label to apply to the KVM launcher. Then I will work to generate a new
policy type (container_kvm_t) that will allow the KVM Launcher tool to do its
thing, but prevent breakout.
Fixes: #2501
Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
By default, SPDK's setup.sh will bind PCI devices to
userspace from kernel. This may confuse beginners.
So add PCI_WHITELIST="none" to blacklist all PCI devices.
Fixes: #626
Signed-off-by: Liu Xiaodong <xiaodong.liu@intel.com>
Configure parameter "enable_vhost_user_store" is
added as an indicator to enable vhost-user storage
device assignment.
Also notice user hugepage should be enabled for
SPDK vhost target currently.
Fixes: #626
Signed-off-by: Liu Xiaodong <xiaodong.liu@intel.com>
Sentences for how to do host setup for vhost-user devices
were not clear, so re-edit them.
Fixes: #626
Signed-off-by: Liu Xiaodong <xiaodong.liu@intel.com>
It's better to check whether the sandbox's get_container
result instead of unwrap it directly, otherwise it would
crash the agent if the conainer id is invalid.
Fixes: #178
Signed-off-by: fupan.lfp <fupan.lfp@antfin.com>
When kill a process, if the exec id is empty, then
it means to kill all processes in the container, if
the exec id isn't empty, then it will only kill the
specific exec process.
Signed-off-by: fupan.lfp <fupan.lfp@antfin.com>
Add the container id and exec id to start container's log
which would make it clearly to check the log.
Fixes: #173
Signed-off-by: fupan.lfp <fupan.lfp@antfin.com>
Make explicit that sharedfs is supported.
Other features are not supported today.
Fixes: #2567
Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
All the other caps are inverted (not supported by default).
Make fs sharing not supported by default and let hypervisors
expose if it supports it.
Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
To have a consistent behavior of CPU hotplug with qemu in clh, we should
only report warning instead of errors when the requested vCPUs exceeds
the maximum number of vCPUs allowed.
Fixes: #2551
Signed-off-by: Bo Chen <chen.bo@intel.com>
