mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-12 10:16:48 +00:00
8eb564dfb8
When using virtio-fs with nydusd's passthrough_fs, mkdir operations may return ENOSYS on certain filesystem configurations. This causes mount destination creation to fail unexpectedly. Handle ENOSYS errors gracefully alongside AlreadyExists by verifying the directory exists after the failed mkdir attempt, allowing the mount to proceed if the directory is already present. Signed-off-by: Alex Lyn <alex.lyn@antgroup.com>
Kata Containers Library Crates
The src/libs directory hosts library crates shared by multiple Kata Containers components. These libraries provide common utilities, data types, and protocol definitions to facilitate development and maintain consistency across the project.
Library Crates
| Library | Description |
|---|---|
| kata-types | Constants, data types, and configuration structures shared by Kata Containers components |
| kata-sys-util | System utilities: CPU, device, filesystem, hooks, K8s, mount, netns, NUMA, PCI, protection, spec validation |
| protocols | ttrpc protocol definitions for agent, health, remote, CSI, OCI, confidential data hub |
| runtime-spec | OCI runtime spec data structures and constants |
| shim-interface | Shim management interface with RESTful API over Unix domain socket |
| logging | Slog-based logging with JSON output and systemd journal support |
| safe-path | Safe path resolution to prevent symlink and TOCTOU attacks |
| mem-agent | Memory management agent: memcg, compact, PSI monitoring |
| test-utils | Test macros for root/non-root privileges and KVM accessibility |
Details
kata-types
Core types and configurations including:
- Annotations for CRI-containerd, CRI-O, dockershim
- Hypervisor configurations (QEMU, Cloud Hypervisor, Firecracker, Dragonball)
- Agent and runtime configurations
- Kubernetes-specific utilities
kata-sys-util
System-level utilities:
cpu: CPU information and affinitydevice: Device managementfs: Filesystem operationshooks: Hook executionk8s: Kubernetes utilitiesmount: Mount operationsnetns: Network namespace handlingnuma: NUMA topologypcilibs: PCI device accessprotection: Hardware protection featuresspec: OCI spec loadingvalidate: Input validation
protocols
Generated ttrpc protocol bindings:
agent: Kata agent APIhealth: Health check serviceremote: Remote hypervisor APIcsi: Container storage interfaceoci: OCI specificationsconfidential_data_hub: Confidential computing support
Features: async for async ttrpc, with-serde for serde support.
runtime-spec
OCI runtime specification types:
ContainerState: Creating, Created, Running, Stopped, PausedState: Container state with version, id, status, pid, bundle, annotations- Namespace constants: pid, network, mount, ipc, user, uts, cgroup
shim-interface
Shim management service interface:
- RESTful API over Unix domain socket (
/run/kata/<sid>/shim-monitor.sock) MgmtClientfor HTTP requests to shim management server- Sandbox ID resolution with prefix matching
logging
Slog-based logging framework:
- JSON output to file or stdout
- systemd journal support
- Runtime log level filtering per component/subsystem
- Async drain for thread safety
safe-path
Secure filesystem path handling:
scoped_join(): Safely join paths under a root directoryscoped_resolve(): Resolve paths constrained by rootPinnedPathBuf: TOCTOU-safe path referenceScopedDirBuilder: Safe directory creation
mem-agent
Memory management for containers:
memcg: Memory cgroup configuration and monitoringcompact: Memory compaction controlpsi: Pressure stall information monitoring- Async runtime with configurable policies
test-utils
Testing utilities:
skip_if_root!: Skip test if running as rootskip_if_not_root!: Skip test if not running as rootskip_if_kvm_unaccessable!: Skip test if KVM is unavailableassert_result!: Assert expected vs actual results
License
All crates are licensed under Apache-2.0.