mirror of https://github.com/kata-containers/kata-containers.git synced 2026-07-12 01:44:30 +00:00

Files

Fabiano Fidêncio 48669a894e runtime-rs: Add vCPU thread pinning support

Port the Go runtime's enable_vcpus_pinning feature to runtime-rs.

The Go runtime already lets users pin each vCPU thread to a specific
host CPU when the vCPU count matches the sandbox cpuset size, using
sched_setaffinity. This is useful for latency-sensitive workloads that
benefit from eliminating cross-CPU migration of vCPU threads.

The approach mirrors the Go implementation:

After VM start and on every container add/update/delete, we fetch the
vCPU thread IDs (via QMP query-cpus-fast for QEMU), compute the union of
all containers' OCI cpusets, and if the two counts match, pin vCPU i to
cpuset[i]. If they diverge (hotplug, container removal, etc.) we reset
all threads back to the full cpuset so nothing gets stuck on a single
core.

The pinning check lives in CgroupsResourceInner::update_sandbox_cgroups,
which already runs at exactly the right points in the lifecycle. The
enable_vcpus_pinning flag flows from the TOML config through
CgroupConfig into the cgroup resource layer, and can also be overridden
per-pod via the io.katacontainers.config.runtime.enable_vcpus_pinning
annotation.

The QEMU config templates default to false. The NV GPU configs will get
their own default (true) in a follow-up once those templates are added.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Made-with: Cursor

2026-04-21 12:45:56 +02:00

kata-sys-util

versions: Bump rand crate where possible

2026-04-17 15:58:58 +01:00

kata-types

runtime-rs: Add vCPU thread pinning support

2026-04-21 12:45:56 +02:00

logging

libs: Fix uninlined_format_args

2025-12-22 19:49:45 +00:00

mem-agent

mem-agent: Add package metadata

2026-04-11 08:46:32 +01:00

protocols

agent: add GetDiagnosticData RPC with termination log support

2026-04-17 13:01:13 +02:00

runtime-spec

libs: Remove unused crates

2026-02-26 09:37:46 +00:00

safe-path

docs: Update libs README with complete library documentation

2026-03-29 19:17:03 +02:00

shim-interface

libs: Fix uninlined_format_args

2025-12-22 19:49:45 +00:00

test-utils

libs: Remove unused imports

2026-01-21 08:52:48 +00:00

.gitignore

libs: Ignore Cargo.lock in libs workspace

2025-07-10 09:31:45 +00:00

Makefile

libs: Specify crates explicitly in Makefile

2026-04-06 11:03:38 +02:00

README.md

docs: Update libs README with complete library documentation

2026-03-29 19:17:03 +02:00

README.md

Kata Containers Library Crates

The src/libs directory hosts library crates shared by multiple Kata Containers components. These libraries provide common utilities, data types, and protocol definitions to facilitate development and maintain consistency across the project.

Library Crates

Library	Description
kata-types	Constants, data types, and configuration structures shared by Kata Containers components
kata-sys-util	System utilities: CPU, device, filesystem, hooks, K8s, mount, netns, NUMA, PCI, protection, spec validation
protocols	ttrpc protocol definitions for agent, health, remote, CSI, OCI, confidential data hub
runtime-spec	OCI runtime spec data structures and constants
shim-interface	Shim management interface with RESTful API over Unix domain socket
logging	Slog-based logging with JSON output and systemd journal support
safe-path	Safe path resolution to prevent symlink and TOCTOU attacks
mem-agent	Memory management agent: memcg, compact, PSI monitoring
test-utils	Test macros for root/non-root privileges and KVM accessibility

Details

kata-types

Core types and configurations including:

Annotations for CRI-containerd, CRI-O, dockershim
Hypervisor configurations (QEMU, Cloud Hypervisor, Firecracker, Dragonball)
Agent and runtime configurations
Kubernetes-specific utilities

kata-sys-util

System-level utilities:

cpu: CPU information and affinity
device: Device management
fs: Filesystem operations
hooks: Hook execution
k8s: Kubernetes utilities
mount: Mount operations
netns: Network namespace handling
numa: NUMA topology
pcilibs: PCI device access
protection: Hardware protection features
spec: OCI spec loading
validate: Input validation

protocols

Generated ttrpc protocol bindings:

agent: Kata agent API
health: Health check service
remote: Remote hypervisor API
csi: Container storage interface
oci: OCI specifications
confidential_data_hub: Confidential computing support

Features: async for async ttrpc, with-serde for serde support.

runtime-spec

OCI runtime specification types:

ContainerState: Creating, Created, Running, Stopped, Paused
State: Container state with version, id, status, pid, bundle, annotations
Namespace constants: pid, network, mount, ipc, user, uts, cgroup

shim-interface

Shim management service interface:

RESTful API over Unix domain socket (/run/kata/<sid>/shim-monitor.sock)
MgmtClient for HTTP requests to shim management server
Sandbox ID resolution with prefix matching

logging

Slog-based logging framework:

JSON output to file or stdout
systemd journal support
Runtime log level filtering per component/subsystem
Async drain for thread safety

safe-path

Secure filesystem path handling:

scoped_join(): Safely join paths under a root directory
scoped_resolve(): Resolve paths constrained by root
PinnedPathBuf: TOCTOU-safe path reference
ScopedDirBuilder: Safe directory creation

mem-agent

Memory management for containers:

memcg: Memory cgroup configuration and monitoring
compact: Memory compaction control
psi: Pressure stall information monitoring
Async runtime with configurable policies

test-utils

Testing utilities:

skip_if_root!: Skip test if running as root
skip_if_not_root!: Skip test if not running as root
skip_if_kvm_unaccessable!: Skip test if KVM is unavailable
assert_result!: Assert expected vs actual results

License

All crates are licensed under Apache-2.0.