Skip to content

Commit 35db607

Browse files
Random-LiuRandom-Liu
authored
Add containerd shim v2 support. (google#13)
* Update vendors Signed-off-by: Lantao Liu <lantaol@google.com> * Add containerd shim v2 support. Signed-off-by: Lantao Liu <lantaol@google.com> * Add test and doc for containerd-shim-runsc-v1. Signed-off-by: Lantao Liu <lantaol@google.com> * Address comments.
1 parent f39907a commit 35db607

File tree

127 files changed

+28611
-122
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

127 files changed

+28611
-122
lines changed

‎.travis.yml

+1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ env:
77
- CONTAINERD_VERSION=1.1.5 RUNSC_VERSION=2018-12-07 TEST=untrusted-workload
88
- CONTAINERD_VERSION=1.2.1 RUNSC_VERSION=2018-12-07 TEST=untrusted-workload
99
- CONTAINERD_VERSION=1.2.1 RUNSC_VERSION=2018-12-07 TEST=runtime-handler
10+
- CONTAINERD_VERSION=1.2.1 RUNSC_VERSION=2018-12-07 TEST=runtime-handler-shim-v2
1011

1112

1213
go_import_path: github.com/google/gvisor-containerd-shim

‎Makefile

+6
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,22 @@ SOURCES=$(shell find cmd/ pkg/ vendor/ -name '*.go')
77
DEPLOY_PATH=cri-containerd-staging/gvisor-containerd-shim
88
VERSION=$(shell git rev-parse HEAD)
99

10+
all: bin/gvisor-containerd-shim bin/containerd-shim-runsc-v1
11+
1012
bin/gvisor-containerd-shim: $(SOURCES)
1113
CGO_ENABLED=0 go build ${GO_BUILD_FLAGS} -o bin/gvisor-containerd-shim ${SHIM_GO_LDFLAGS} ${GO_TAGS} ./cmd/gvisor-containerd-shim
1214

15+
bin/containerd-shim-runsc-v1: $(SOURCES)
16+
CGO_ENABLED=0 go build ${GO_BUILD_FLAGS} -o bin/containerd-shim-runsc-v1 ${SHIM_GO_LDFLAGS} ${GO_TAGS} ./cmd/containerd-shim-runsc-v1
1317

1418
install: bin/gvisor-containerd-shim
1519
mkdir -p $(DESTDIR)/bin
1620
install bin/gvisor-containerd-shim $(DESTDIR)/bin
21+
install bin/containerd-shim-runsc-v1 $(DESTDIR)/bin
1722

1823
uninstall:
1924
rm -f $(DESTDIR)/bin/gvisor-containerd-shim
25+
rm -f $(DESTDIR)/bin/containerd-shim-runsc-v1
2026

2127
clean:
2228
rm -rf bin/*

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ gvisor-containerd-shim is a containerd shim for [gVisor](https://github.com/goog
1414

1515
- [Untrusted Workload Quick Start (containerd >=1.1)](docs/untrusted-workload-quickstart.md)
1616
- [Runtime Handler Quick Start (containerd >=1.2)](docs/runtime-handler-quickstart.md)
17+
- [Runtime Handler Quick Start (shim v2) (containerd >=1.2)](docs/runtime-handler-shim-v2-quickstart.md)
1718

1819
# Contributing
1920

‎cmd/containerd-shim-runsc-v1/main.go

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/*
2+
Copyright The containerd Authors.
3+
Licensed under the Apache License, Version 2.0 (the "License");
4+
you may not use this file except in compliance with the License.
5+
You may obtain a copy of the License at
6+
http://www.apache.org/licenses/LICENSE-2.0
7+
Unless required by applicable law or agreed to in writing, software
8+
distributed under the License is distributed on an "AS IS" BASIS,
9+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
10+
See the License for the specific language governing permissions and
11+
limitations under the License.
12+
*/
13+
14+
package main
15+
16+
import (
17+
"github.com/containerd/containerd/runtime/v2/shim"
18+
19+
runsc "github.com/google/gvisor-containerd-shim/pkg/v2"
20+
)
21+
22+
func main() {
23+
shim.Run("io.containerd.runsc.v1", runsc.New)
24+
}

‎cmd/gvisor-containerd-shim/main.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ import (
4848
"golang.org/x/sys/unix"
4949

5050
runsc "github.com/google/gvisor-containerd-shim/pkg/go-runsc"
51-
"github.com/google/gvisor-containerd-shim/pkg/shim"
51+
"github.com/google/gvisor-containerd-shim/pkg/v1/shim"
5252
)
5353

5454
var (

‎docs/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,4 @@ Everything you need to know about gvisor-containerd-shim
44

55
- [Untrusted Workload Quick Start (containerd >=1.1)](untrusted-workload-quickstart.md)
66
- [Runtime Handler Quick Start (containerd >=1.2)](runtime-handler-quickstart.md)
7+
- [Runtime Handler Quick Start (shim v2) (containerd >=1.2)](runtime-handler-shim-v2-quickstart.md)

‎docs/runtime-handler-quickstart.md

+6-14
Original file line numberDiff line numberDiff line change
@@ -16,30 +16,22 @@ later.
1616
1. Download the latest release of the `gvisor-containerd-shim`. See the
1717
[releases page](https://github.com/google/gvisor-containerd-shim/releases)
1818

19-
[embedmd]:# (../test/e2e/shim-install.sh shell /{ # Step 1/ /^}/)
19+
[embedmd]:# (../test/e2e/shim-install.sh shell /{ # Step 1\(release\)/ /^}/)
2020
```shell
21-
{ # Step 1: Download gvisor-containerd-shim
21+
{ # Step 1(release): Install gvisor-containerd-shim
2222
LATEST_RELEASE=$(wget -qO - https://api.github.com/repos/google/gvisor-containerd-shim/releases | grep -oP '(?<="browser_download_url": ")https://[^"]*' | head -1)
2323
wget -O gvisor-containerd-shim
2424
chmod +x gvisor-containerd-shim
25+
sudo mv gvisor-containerd-shim /usr/local/bin/gvisor-containerd-shim
2526
}
2627
```
2728

28-
2. Copy the binary to the desired directory:
29-
30-
[embedmd]:# (../test/e2e/shim-install.sh shell /{ # Step 2/ /^}/)
31-
```shell
32-
{ # Step 2: Copy the binary to the desired directory
33-
sudo mv gvisor-containerd-shim-* /usr/local/bin/gvisor-containerd-shim
34-
}
35-
```
36-
37-
3. Create the configuration for the gvisor shim in
29+
2. Create the configuration for the gvisor shim in
3830
`/etc/containerd/gvisor-containerd-shim.yaml`:
3931

40-
[embedmd]:# (../test/e2e/shim-install.sh shell /{ # Step 3/ /^}/)
32+
[embedmd]:# (../test/e2e/shim-install.sh shell /{ # Step 2/ /^}/)
4133
```shell
42-
{ # Step 3: Create the gvisor-containerd-shim.yaml
34+
{ # Step 2: Create the gvisor-containerd-shim.yaml
4335
cat <<EOF | sudo tee /etc/containerd/gvisor-containerd-shim.yaml
4436
# This is the path to the default runc containerd-shim.
4537
runc_shim = "/usr/local/bin/containerd-shim"

‎docs/runtime-handler-shim-v2-quickstart.md

+187
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
# Runtime Handler Quickstart (Shim V2)
2+
3+
This document describes how to install and run `containerd-shim-runsc-v1` using
4+
the containerd runtime handler support. This requires containerd 1.2 or later.
5+
6+
## Requirements
7+
8+
- **runsc**: See the [gVisor documentation](https://github.com/google/gvisor) for information on how to install runsc.
9+
- **containerd**: See the [containerd website](https://containerd.io/) for information on how to install containerd.
10+
11+
## Install
12+
13+
### Install containerd-shim-runsc-v1
14+
15+
1. Build and install `containerd-shim-runsc-v1`.
16+
17+
<!-- TODO: Use a release once we have one available. -->
18+
[embedmd]:# (../test/e2e/shim-install.sh shell /{ # Step 1\(dev\)/ /^}/)
19+
```shell
20+
{ # Step 1(dev): Build and install gvisor-containerd-shim and containerd-shim-runsc-v1
21+
make
22+
sudo make install
23+
}
24+
```
25+
26+
### Configure containerd
27+
28+
1. Update `/etc/containerd/config.toml`. Make sure `containerd-shim-runsc-v1` is
29+
in `${PATH}`.
30+
31+
[embedmd]:# (../test/e2e/runtime-handler-shim-v2/install.sh shell /{ # Step 1/ /^}/)
32+
```shell
33+
{ # Step 1: Create containerd config.toml
34+
cat <<EOF | sudo tee /etc/containerd/config.toml
35+
disabled_plugins = ["restart"]
36+
[plugins.linux]
37+
shim_debug = true
38+
[plugins.cri.containerd.runtimes.runsc]
39+
runtime_type = "io.containerd.runsc.v1"
40+
EOF
41+
}
42+
```
43+
44+
2. Restart `containerd`
45+
46+
```shell
47+
sudo systemctl restart containerd
48+
```
49+
50+
## Usage
51+
52+
You can run containers in gVisor via containerd's CRI.
53+
54+
### Install crictl
55+
56+
1. Download and install the crictl binary:
57+
58+
[embedmd]:# (../test/e2e/crictl-install.sh shell /{ # Step 1/ /^}/)
59+
```shell
60+
{ # Step 1: Download crictl
61+
wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.13.0/crictl-v1.13.0-linux-amd64.tar.gz
62+
tar xf crictl-v1.13.0-linux-amd64.tar.gz
63+
sudo mv crictl /usr/local/bin
64+
}
65+
```
66+
67+
2. Write the crictl configuration file
68+
69+
[embedmd]:# (../test/e2e/crictl-install.sh shell /{ # Step 2/ /^}/)
70+
```shell
71+
{ # Step 2: Configure crictl
72+
cat <<EOF | sudo tee /etc/crictl.yaml
73+
runtime-endpoint: unix:///run/containerd/containerd.sock
74+
EOF
75+
}
76+
```
77+
78+
### Create the nginx Sandbox in gVisor
79+
80+
1. Pull the nginx image
81+
82+
[embedmd]:# (../test/e2e/runtime-handler/usage.sh shell /{ # Step 1/ /^}/)
83+
```shell
84+
{ # Step 1: Pull the nginx image
85+
sudo crictl pull nginx
86+
}
87+
```
88+
89+
2. Create the sandbox creation request
90+
91+
[embedmd]:# (../test/e2e/runtime-handler/usage.sh shell /{ # Step 2/ /^EOF\n}/)
92+
```shell
93+
{ # Step 2: Create sandbox.json
94+
cat <<EOF | tee sandbox.json
95+
{
96+
"metadata": {
97+
"name": "nginx-sandbox",
98+
"namespace": "default",
99+
"attempt": 1,
100+
"uid": "hdishd83djaidwnduwk28bcsb"
101+
},
102+
"linux": {
103+
},
104+
"log_directory": "/tmp"
105+
}
106+
EOF
107+
}
108+
```
109+
110+
3. Create the pod in gVisor
111+
112+
[embedmd]:# (../test/e2e/runtime-handler/usage.sh shell /{ # Step 3/ /^}/)
113+
```shell
114+
{ # Step 3: Create the sandbox
115+
SANDBOX_ID=$(sudo crictl runp --runtime runsc sandbox.json)
116+
}
117+
```
118+
119+
### Run the nginx Container in the Sandbox
120+
121+
1. Create the nginx container creation request
122+
123+
[embedmd]:# (../test/e2e/run-container.sh shell /{ # Step 1/ /^EOF\n}/)
124+
```shell
125+
{ # Step 1: Create nginx container config
126+
cat <<EOF | tee container.json
127+
{
128+
"metadata": {
129+
"name": "nginx"
130+
},
131+
"image":{
132+
"image": "nginx"
133+
},
134+
"log_path":"nginx.0.log",
135+
"linux": {
136+
}
137+
}
138+
EOF
139+
}
140+
```
141+
142+
2. Create the nginx container
143+
144+
[embedmd]:# (../test/e2e/run-container.sh shell /{ # Step 2/ /^}/)
145+
```shell
146+
{ # Step 2: Create nginx container
147+
CONTAINER_ID=$(sudo crictl create ${SANDBOX_ID} container.json sandbox.json)
148+
}
149+
```
150+
151+
3. Start the nginx container
152+
153+
[embedmd]:# (../test/e2e/run-container.sh shell /{ # Step 3/ /^}/)
154+
```shell
155+
{ # Step 3: Start nginx container
156+
sudo crictl start ${CONTAINER_ID}
157+
}
158+
```
159+
160+
### Validate the container
161+
162+
1. Inspect the created pod
163+
164+
[embedmd]:# (../test/e2e/validate.sh shell /{ # Step 1/ /^}/)
165+
```shell
166+
{ # Step 1: Inspect the pod
167+
sudo crictl inspectp ${SANDBOX_ID}
168+
}
169+
```
170+
171+
2. Inspect the nginx container
172+
173+
[embedmd]:# (../test/e2e/validate.sh shell /{ # Step 2/ /^}/)
174+
```shell
175+
{ # Step 2: Inspect the container
176+
sudo crictl inspect ${CONTAINER_ID}
177+
}
178+
```
179+
180+
3. Verify that nginx is running in gVisor
181+
182+
[embedmd]:# (../test/e2e/validate.sh shell /{ # Step 3/ /^}/)
183+
```shell
184+
{ # Step 3: Check dmesg
185+
sudo crictl exec ${CONTAINER_ID} dmesg | grep -i gvisor
186+
}
187+
```

‎docs/untrusted-workload-quickstart.md

+6-14
Original file line numberDiff line numberDiff line change
@@ -13,36 +13,28 @@ are using containerd 1.2, please consider using runtime handler.*
1313
- **containerd**: See the [containerd website](https://containerd.io/) for information on how to install containerd.
1414

1515
## Install
16-
16+
1717
### Install gvisor-containerd-shim
1818

1919
1. Download the latest release of the `gvisor-containerd-shim`. See the
2020
[releases page](https://github.com/google/gvisor-containerd-shim/releases)
2121

2222
[embedmd]:# (../test/e2e/shim-install.sh shell /{ # Step 1/ /^}/)
2323
```shell
24-
{ # Step 1: Download gvisor-containerd-shim
24+
{ # Step 1(release): Install gvisor-containerd-shim
2525
LATEST_RELEASE=$(wget -qO - https://api.github.com/repos/google/gvisor-containerd-shim/releases | grep -oP '(?<="browser_download_url": ")https://[^"]*' | head -1)
2626
wget -O gvisor-containerd-shim
2727
chmod +x gvisor-containerd-shim
28+
sudo mv gvisor-containerd-shim /usr/local/bin/gvisor-containerd-shim
2829
}
2930
```
3031

31-
2. Copy the binary to the desired directory:
32-
33-
[embedmd]:# (../test/e2e/shim-install.sh shell /{ # Step 2/ /^}/)
34-
```shell
35-
{ # Step 2: Copy the binary to the desired directory
36-
sudo mv gvisor-containerd-shim-* /usr/local/bin/gvisor-containerd-shim
37-
}
38-
```
39-
40-
3. Create the configuration for the gvisor shim in
32+
2. Create the configuration for the gvisor shim in
4133
`/etc/containerd/gvisor-containerd-shim.yaml`:
4234

43-
[embedmd]:# (../test/e2e/shim-install.sh shell /{ # Step 3/ /^}/)
35+
[embedmd]:# (../test/e2e/shim-install.sh shell /{ # Step 2/ /^}/)
4436
```shell
45-
{ # Step 3: Create the gvisor-containerd-shim.yaml
37+
{ # Step 2: Create the gvisor-containerd-shim.yaml
4638
cat <<EOF | sudo tee /etc/containerd/gvisor-containerd-shim.yaml
4739
# This is the path to the default runc containerd-shim.
4840
runc_shim = "/usr/local/bin/containerd-shim"

‎pkg/proc/deleted_state.go ‎pkg/v1/proc/deleted_state.go

File renamed without changes.

‎pkg/proc/exec.go ‎pkg/v1/proc/exec.go

+5-10
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ import (
3030
"github.com/containerd/console"
3131
"github.com/containerd/containerd/errdefs"
3232
"github.com/containerd/containerd/runtime/proc"
33-
"github.com/containerd/containerd/runtime/v1/shim"
3433
"github.com/containerd/fifo"
3534
runc "github.com/containerd/go-runc"
3635
specs "github.com/opencontainers/runtime-spec/specs-go"
@@ -171,19 +170,19 @@ func (e *execProcess) start(ctx context.Context) (err error) {
171170
if socket != nil {
172171
opts.ConsoleSocket = socket
173172
}
174-
eventCh := shim.Default.Subscribe()
173+
eventCh := e.parent.Monitor.Subscribe()
175174
defer func() {
176175
// Unsubscribe if an error is returned.
177176
if err != nil {
178-
shim.Default.Unsubscribe(eventCh)
177+
e.parent.Monitor.Unsubscribe(eventCh)
179178
}
180179
}()
181180
if err := e.parent.runtime.Exec(ctx, e.parent.id, e.spec, opts); err != nil {
182181
close(e.waitBlock)
183182
return e.parent.runtimeError(err, "OCI runtime exec failed")
184183
}
185184
if e.stdio.Stdin != "" {
186-
sc, err := fifo.OpenFifo(ctx, e.stdio.Stdin, syscall.O_WRONLY|syscall.O_NONBLOCK, 0)
185+
sc, err := fifo.OpenFifo(context.Background(), e.stdio.Stdin, syscall.O_WRONLY|syscall.O_NONBLOCK, 0)
187186
if err != nil {
188187
return errors.Wrapf(err, "failed to open stdin fifo %s", e.stdio.Stdin)
189188
}
@@ -192,11 +191,7 @@ func (e *execProcess) start(ctx context.Context) (err error) {
192191
}
193192
var copyWaitGroup sync.WaitGroup
194193
ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
195-
defer func() {
196-
if err != nil {
197-
cancel()
198-
}
199-
}()
194+
defer cancel()
200195
if socket != nil {
201196
console, err := socket.ReceiveMaster()
202197
if err != nil {
@@ -222,7 +217,7 @@ func (e *execProcess) start(ctx context.Context) (err error) {
222217
}
223218
e.internalPid = internalPid
224219
go func() {
225-
defer shim.Default.Unsubscribe(eventCh)
220+
defer e.parent.Monitor.Unsubscribe(eventCh)
226221
for event := range eventCh {
227222
if event.Pid == e.pid {
228223
ExitCh <- Exit{

‎pkg/proc/exec_state.go ‎pkg/v1/proc/exec_state.go

File renamed without changes.

0 commit comments

Comments
 (0)