Commit Graph

13214 Commits

Author SHA1 Message Date
Peng Tao
bf1a5ce000 sandbox: cleanup sandbox if creation failed
This includes cleaning up the sandbox on disk resources,
and closing open fds when preparing the hypervisor.

Fixes: #1057

Signed-off-by: Peng Tao <bergwolf@gmail.com>
2018-12-21 13:46:16 +08:00
Eric Ernst
0f6fb5439a
Merge pull request #1043 from sboeuf/fc_config
config: Add firecracker as a supported hypervisor configuration
2018-12-20 21:17:43 -08:00
Sebastien Boeuf
e14071f2bd
Merge pull request #1045 from mcastelino/topic/firecracker-virtio-mmio
Firecracker: virtio mmio support
2018-12-20 19:47:01 -08:00
running
c099be56da container: Use lazy unmount
Unmount recursively to unmount bind-mounted volumes.
Fixes: #965
Signed-off-by: Ning Lu <crossrunning@outlook.com>
2018-12-21 11:11:58 +08:00
Manohar Castelino
0d84d799ea virtio-mmio: Add support for virtio-mmio
Start adding support for virtio-mmio devices starting with block.
The devices show within the vm as vda, vdb,... based on order of
insertion and such within the VM resemble virtio-blk devices.

They need to be explicitly differentiated to ensure that the
agent logic within the VM can discover and mount them appropropriately.
The agent uses PCI location to discover them for virtio-blk.
For virtio-mmio we need to use the predicted device name for now.

Note: Kata used a disk for the VM rootfs in the case of Firecracker.
(Instead of initrd or virtual-nvdimm). The Kata code today does not
handle this case properly.

For now as Firecracker is the only Hypervisor in Kata that
uses virtio-mmio directly offset the drive index to comprehend
this.

Longer term we should track if the rootfs is setup as a block
device explicitly.

Fixes: #1046

Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
Signed-off-by: Manohar Castelino <manohar.r.castelino@intel.com>
2018-12-20 15:08:51 -08:00
Sebastien Boeuf
353564abe0 config: Reorganize the code to fix code complexity
By breaking down updateRuntimeConfig() into smaller functions, this
commit prevents the function to grow a Go complexity higher than 15.

Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
2018-12-20 15:02:55 -08:00
Eric Ernst
d6c1f531a9 config: Add firecracker configuration support
In order to let the user choose firecracker hypervisor instead of
QEMU (from the configuration.toml), let's add it to the list of
supported hypervisors.

Fixes #1042

Depends-on: github.com/kata-containers/runtime#1044

Signed-off-by: Eric Ernst <eric.ernst@intel.com>
2018-12-20 15:02:55 -08:00
Sebastien Boeuf
8764fc1467
Merge pull request #1044 from mcastelino/topic/fc-vendor
Firecracker VMM support
2018-12-20 15:02:06 -08:00
Sebastien Boeuf
b4c3a2ffbd virtcontainers: fc: Stop the VM by killing the process
Because firecracker currently does not support a proper stop from
the caller, and because we don't want the agent to initiate a reboot
to shutdown the VM, the simplest and most efficient solution at the
moement is to signal the VM process with SIGTERM first, followed by
a SIGKILL if the process is still around.

Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
2018-12-20 11:54:59 -08:00
Manohar Castelino
fba23796d6 firecracker: Add support for pseudo hotplug
Use the firecracker rescan logic to update the pre-attached drive.
This allows us to emulate hotplug.

Initially the drive backing stores are set to empty files on the
host. Once the actual block based device or file is available
swap the backing store.

The rescan needs to be issued iff the VM is running.

Signed-off-by: Manohar Castelino <manohar.r.castelino@intel.com>
2018-12-20 11:54:59 -08:00
Manohar Castelino
22ebc09f00 firecracker: Close the vsock vhostfd
Unlike QEMU firecracker cannot accept a fd as part of the REST API.
Close the vsock vhostfd close to the point where we launch the VM.

Note: This is still racy.

Signed-off-by: Manohar Castelino <manohar.r.castelino@intel.com>
2018-12-20 11:54:59 -08:00
Manohar Castelino
e65bafa793 virtcontainers: Add firecracker as a supported hypervisor
Add firecracker as a supported hypervisor. This connects the
newly defined firecracker implementation as a supported
hypervisor.

Move operation definition to the common hypervisor code.

Signed-off-by: Manohar Castelino <manohar.r.castelino@intel.com>
2018-12-20 11:54:59 -08:00
Manohar Castelino
c1d3f1a98b firecracker: VMM API support
Initial Support for the firecracker VMM

Note:
- 9p is unsupported by firecracker
- Enable pseudo hotplug block device hotplug capability

Initially, this will be a pseudo capability for Firecracker hypervisor,
but we will utilize a pool of block devices and block device rescan as a
temporary workaround.

Fixes: #1064

Signed-off-by: Eric Ernst <eric.ernst@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
Signed-off-by: Manohar Castelino <manohar.r.castelino@intel.com>
2018-12-20 11:54:49 -08:00
Penny Zheng
cc530e7e77 qemu: add 'Build a custom qemu-system-aarch64' section
Since aarch64 need custom QEMU binary and doesn't support OBS
packaging for now, we add this section to lead developers to build
required qemu-system-aarch64 binary.

Fixes: #320

Signed-off-by: Penny Zheng <penny.zheng@arm.com>
2018-12-20 17:58:53 +08:00
James O. D. Hunt
10559f0c68
Merge pull request #1036 from lifupan/fixlog
shimv2: discard log before shim init log output
2018-12-20 08:55:30 +00:00
James O. D. Hunt
dcd3bd0476
Merge pull request #290 from marcov/up-obs-distros
Update list of stable release distros
2018-12-20 08:36:35 +00:00
Manohar Castelino
c34b0455e4 firecracker: vendor in all firecracker dependencies
Vendor in all firecracker dependencies. This allows virtcontainers
to pull call the firecracker REST API.

Signed-off-by: Manohar Castelino <manohar.r.castelino@intel.com>
2018-12-19 16:23:41 -08:00
Eric Ernst
f22370cca0
Merge pull request #1063 from sboeuf/fix_fc_cgroups
virtcontainers: cgroups: Don't error if no thread ID
2018-12-19 16:06:22 -08:00
Sebastien Boeuf
a21d1e693f virtcontainers: cgroups: Don't error if no thread ID
In case the hypervisor implementation does not return any thread
ID, this should not issue any error since there is simply nothing
to constrain.

Fixes #1062

Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
2018-12-19 14:19:40 -08:00
Eric Ernst
b51c57e6fe
Merge pull request #1041 from devimc/topic/no9pCopyFiles
Copy files from host to guest
2018-12-19 12:16:34 -08:00
Marco Vedovati
c3c8a3d926 obs-packaging: add openSUSE Leap 15 and Tumbleweed
Add more recent openSUSE distributions.

Signed-off-by: Marco Vedovati <mvedovati@suse.com>
2018-12-19 18:09:34 +01:00
Marco Vedovati
6b375a9573 obs-packaging: remove EOL distros from stable releases
Remove distros that reached EOL (Fedora 26, Fedora 27, Ubuntu 17.10).

Fixes: #279

Signed-off-by: Marco Vedovati <mvedovati@suse.com>
2018-12-19 18:09:03 +01:00
Marco Vedovati
31b04a739b obs-packaging: Add Debian 9 distro
Add Debian 9 distro to the list of stable release distros.

Fixes: #289

Signed-off-by: Marco Vedovati <mvedovati@suse.com>
2018-12-19 18:08:42 +01:00
Julio Montes
378d8157a6 virtcontainers: copy or bind mount shared file
Copy files to contaier's rootfs if hypervisor doesn't supports filesystem
sharing, otherwise bind mount them in the shared directory.

see #1031

Signed-off-by: Julio Montes <julio.montes@intel.com>
2018-12-19 09:58:44 -06:00
Julio Montes
bc31844106 virtcontainers: Check file sharing support
If the hypervisor does not support filesystem sharing (for example, 9p),
files will be copied over gRPC using the copyFile request function.

Signed-off-by: Julio Montes <julio.montes@intel.com>
2018-12-19 09:58:21 -06:00
Julio Montes
62917621c2 virtcontainers: copy files form host to guest
Files are copied over gRPC and there is no limit in size of the files that
can be copied. Small files are copied using just one gRPC call while big files
are copied by parts.

Signed-off-by: Julio Montes <julio.montes@intel.com>
2018-12-19 09:55:25 -06:00
Eric Ernst
dcd48a9ca1 vc: capabilities: add capability flags for filesystem sharing
Not all hypervisors support filesystem sharing. Add capability flags to track
this. Since most hypervisor implementations in Kata *do* support this, the set
semantices are reversed (ie, set the flag if you do not support the feature).

Fixes: #1022

Signed-off-by: Eric Ernst <eric.ernst@intel.com>
Signed-off-by: Julio Montes <julio.montes@intel.com>
2018-12-19 09:54:00 -06:00
Julio Montes
e776380ff8 vendor: update kata agent
Brings support to copy file from host to guest

shortlog:
169d755 protocols/grpc: implement function to copy files
ff87c26 virtio-mmio: Add support for virtio-mmio blk devices
b9c5d5b libcontainer: use /run as root containers path
092f1a0 block: add support of block storage driver "nvdimm"

Signed-off-by: Julio Montes <julio.montes@intel.com>
2018-12-19 09:10:20 -06:00
James O. D. Hunt
0d6a035f95
Merge pull request #1056 from lifupan/fixVsock
katautils: check config factory/template and vsock
2018-12-19 10:39:38 +00:00
Frank Cao
07a0b163f9
Merge pull request #1049 from sameo/topic/ctx-unset
virtcontainers: Add context when creating tests sandboxes
2018-12-19 14:43:16 +08:00
fupan
e4e7c3ae54 katautils: check config template and vsock
Vsock conflicts with factory, when both of them are enabled,
kata will try to create a new vm template which is useless,
thus it's better to return an error directly to let users know
that those two config cannot be enabled at the same time.

Fixes: #1055

Signed-off-by: fupan <lifupan@gmail.com>
2018-12-19 14:12:41 +08:00
Peng Tao
b446179fa4
Merge pull request #1015 from teawater/fix_yq2
make: Add "GOPATH not set"
2018-12-19 13:16:07 +08:00
Peng Tao
ade738f7b7
Merge pull request #1052 from sboeuf/fc_fix_network
virtcontainers: network: Use multiqueue flag only when appropriate
2018-12-19 09:56:42 +08:00
Sebastien Boeuf
0f1fde498d virtcontainers: network: Use multiqueue flag only when appropriate
The multiqueue flag associated with the TUNTAP network device cannot
be used if the number of queues indicates 0. When 0, this means the
multiqueue is not supported, and we cannot use the according flag.

Fixes #1051

Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
2018-12-18 11:06:06 -08:00
Samuel Ortiz
f63a18deea virtcontainers: Add context when creating tests sandboxes
We can use the background context when creating test sandboxes from the
sanbox unit tests. This shuts the "trace called before context set"
erros down.

Fixes: #1048

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2018-12-18 13:22:08 +01:00
Sebastien Boeuf
5d91edd695
Merge pull request #1038 from lifupan/fixvsock
katautils: fix the issue of shimv2 boot failed with vsock enabled
2018-12-17 11:35:25 -08:00
Sebastien Boeuf
9ad35bd6b6 kernel: Add 4.19.10 config for x86
We want to make sure Kata runs on latest stable kernels so that it
benefits from the latest features.

For instance, in case of Kata relying on NEMU hypervisor, the recent
kernel patches reworking the way timer calibration is handled are
solving some boot latency issues.

Fixes #287

Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
2018-12-17 08:53:04 -08:00
Sebastien Boeuf
802bfa26c9 versions: Bump to kernel 4.19.10
We need to bump the kernel version from 4.14.67 to 4.19.10 in order
to follow the recent kernel config bump.

Fixes #1029

Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
2018-12-17 08:16:10 -08:00
Fupan Li
05be5bf1f9 shimv2: discard log before shim init log output
containerd would like to get the shim's socket
address from shimv2's stdout, thus it's better
to discard the log's output before shimv2 init
it's logger and at the same time add a hook to
log into syslog.

Fixes: #1035

Signed-off-by: Fupan Li <lifupan@gmail.com>
2018-12-17 15:39:44 +00:00
James O. D. Hunt
006d375358
Merge pull request #1040 from alicefr/doc_s390
docs: add IBM Z in the README
2018-12-17 15:25:11 +00:00
Alice Frosi
e98dee6a22 docs: drop 's in architecture names for consistency
Drop 's for the other archs to be consistent

Signed-off-by: Alice Frosi <afrosi@de.ibm.com>
2018-12-17 16:18:16 +01:00
Sebastien Boeuf
658bd82490
Merge pull request #1034 from Pennyzct/hvc
qemu-arm64: refactor 'console=hvc0,hvc1' for kata-agent debugging
2018-12-17 06:50:55 -08:00
Julio Montes
bb06a0498a
Merge pull request #221 from alicefr/s390_docu
docs: update compatibility matrix with s390
2018-12-17 07:42:08 -06:00
Alice Frosi
1892102dc3 docs: add IBM Z in the README
Fixes: #1039

Signed-off-by: Alice Frosi <afrosi@de.ibm.com>
2018-12-17 12:56:25 +01:00
Marco Vedovati
3549d5a5e2 obs-packaging: support comparisons of pre-releases versions
Fix version compare when specifying a pre-release version in
versions.txt. This is needed because kata on git uses strict semver,
while kata RPM packages uses ~ in place of - for PATCH version, to
allow RPM version comparison to work properly.

Fixes: #285

Signed-off-by: Marco Vedovati <mvedovati@suse.com>
2018-12-17 12:36:09 +01:00
Alice Frosi
c3d77aea6a docs: add s390 to the compatibility matrix
Fixes: #198

Signed-off-by: Alice Frosi <afrosi@de.ibm.com>
2018-12-17 10:39:09 +01:00
Fupan Li
573b73eb10 katautils: fix the issue of shimv2 boot failed with vsock enabled
shimv2 missed to enable vsock in KataAgentConfig.

Fixes: #1037

Signed-off-by: Fupan Li <lifupan@gmail.com>
2018-12-17 07:13:38 +00:00
Eric Ernst
df6a8ed37a
Merge pull request #272 from mcastelino/topic/firehack
Firecracker support: Add support for virtio-mmio
2018-12-16 21:31:01 -08:00
Eric Ernst
31489976ae
Merge pull request #1028 from sboeuf/multi_queues
network: Don't assume multiple queues support by default
2018-12-16 21:23:10 -08:00
Penny Zheng
c8c564bdd6 qemu-arm64: refactor 'console=hvc0,hvc1' for kata-agent debugging
Since kata-agent is using virtio-console to output debugging info
and the console ports are available in the guest as /dev/hvc0 and
/dev/hvc1, we should swap origin console type 'console=ttyAMA0'
with 'console=hvc0,hvc1'.

Fixes: #1033

Signed-off-by: Penny Zheng <penny.zheng@arm.com>
Signed-off-by: Wei Chen <Wei.Chen@arm.com>
2018-12-17 11:34:11 +08:00