diff --git a/.gitignore b/.gitignore index 007129979..7b6eee072 100644 --- a/.gitignore +++ b/.gitignore @@ -1,7 +1,8 @@ *.o *.patch *.swp -/cli/config/configuration.toml +/cli/config/configuration-fc.toml +/cli/config/configuration-qemu.toml /cli/config-generated.go /cli/coverage.html /containerd-shim-kata-v2 diff --git a/Makefile b/Makefile index 999b6a2f7..1c11f748d 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,5 @@ # -# Copyright (c) 2018 Intel Corporation +# Copyright (c) 2018-2019 Intel Corporation # # SPDX-License-Identifier: Apache-2.0 # @@ -80,6 +80,7 @@ endif PREFIXDEPS := $(PREFIX) BINDIR := $(EXEC_PREFIX)/bin QEMUBINDIR := $(PREFIXDEPS)/bin +FCBINDIR := $(PREFIXDEPS)/bin SYSCONFDIR := /etc LOCALSTATEDIR := /var @@ -89,12 +90,6 @@ ifeq (,$(installing)) EXTRA_DEPS = clean endif -ifeq (uncompressed,$(KERNELTYPE)) - KERNEL_NAME = vmlinux.container -else - KERNEL_NAME = vmlinuz.container -endif - LIBEXECDIR := $(PREFIXDEPS)/libexec SHAREDIR := $(PREFIX)/share DEFAULTSDIR := $(SHAREDIR)/defaults @@ -114,13 +109,28 @@ PKGLIBDIR := $(LOCALSTATEDIR)/lib/$(PROJECT_DIR) PKGRUNDIR := $(LOCALSTATEDIR)/run/$(PROJECT_DIR) PKGLIBEXECDIR := $(LIBEXECDIR)/$(PROJECT_DIR) -KERNELPATH := $(PKGDATADIR)/$(KERNEL_NAME) +KERNELDIR := $(PKGDATADIR) + INITRDPATH := $(PKGDATADIR)/$(INITRDNAME) IMAGEPATH := $(PKGDATADIR)/$(IMAGENAME) FIRMWAREPATH := +# Name of default configuration file the runtime will use. +CONFIG_FILE = configuration.toml + +HYPERVISOR_FC = firecracker +HYPERVISOR_QEMU = qemu + +# Determines which hypervisor is specified in $(CONFIG_FILE). +DEFAULT_HYPERVISOR = $(HYPERVISOR_QEMU) + +# List of hypervisors this build system can generate configuration for. +HYPERVISORS := $(HYPERVISOR_FC) $(HYPERVISOR_QEMU) + QEMUPATH := $(QEMUBINDIR)/$(QEMUCMD) +FCPATH = $(FCBINDIR)/$(FCCMD) + SHIMCMD := $(BIN_PREFIX)-shim SHIMPATH := $(PKGLIBEXECDIR)/$(SHIMCMD) @@ -145,16 +155,12 @@ DEFMEMSZ := 2048 DEFMEMSLOTS := 10 #Default number of bridges DEFBRIDGES := 1 -#Default network model -DEFNETWORKMODEL := macvtap - DEFDISABLEGUESTSECCOMP := true #Default entropy source DEFENTROPYSOURCE := /dev/urandom DEFDISABLEBLOCK := false -DEFBLOCKSTORAGEDRIVER := virtio-scsi DEFENABLEIOTHREADS := false DEFENABLEMEMPREALLOC := false DEFENABLEHUGEPAGES := false @@ -176,9 +182,78 @@ VERSION := ${shell cat ./VERSION} COMMIT_NO := $(shell git rev-parse HEAD 2> /dev/null || true) COMMIT := $(if $(shell git status --porcelain --untracked-files=no),${COMMIT_NO}-dirty,${COMMIT_NO}) -CONFIG_FILE = configuration.toml -CONFIG = $(CLI_DIR)/config/$(CONFIG_FILE) -CONFIG_IN = $(CONFIG).in +# List of configuration files to build and install +CONFIGS = +CONFIG_PATHS = +SYSCONFIG_PATHS = + +# List of hypervisors known for the current architecture +KNOWN_HYPERVISORS = + +ifneq (,$(QEMUCMD)) + KNOWN_HYPERVISORS += $(HYPERVISOR_QEMU) + + CONFIG_FILE_QEMU = configuration-qemu.toml + CONFIG_QEMU = $(CLI_DIR)/config/$(CONFIG_FILE_QEMU) + CONFIG_QEMU_IN = $(CONFIG_QEMU).in + + CONFIG_PATH_QEMU = $(abspath $(CONFDIR)/$(CONFIG_FILE_QEMU)) + CONFIG_PATHS += $(CONFIG_PATH_QEMU) + + SYSCONFIG_QEMU = $(abspath $(SYSCONFDIR)/$(CONFIG_FILE_QEMU)) + SYSCONFIG_PATHS += $(SYSCONFIG_QEMU) + + CONFIGS += $(CONFIG_QEMU) + + # qemu-specific options (all should be suffixed by "_QEMU") + DEFBLOCKSTORAGEDRIVER_QEMU := virtio-scsi + DEFNETWORKMODEL_QEMU := macvtap + KERNELNAME_QEMU = $(call MAKE_KERNEL_NAME,$(KERNELTYPE)) + KERNELPATH_QEMU = $(KERNELDIR)/$(KERNELNAME_QEMU) +endif + +ifneq (,$(FCCMD)) + KNOWN_HYPERVISORS += $(HYPERVISOR_FC) + + CONFIG_FILE_FC = configuration-fc.toml + CONFIG_FC = $(CLI_DIR)/config/$(CONFIG_FILE_FC) + CONFIG_FC_IN = $(CONFIG_FC).in + + CONFIG_PATH_FC = $(abspath $(CONFDIR)/$(CONFIG_FILE_FC)) + CONFIG_PATHS += $(CONFIG_PATH_FC) + + SYSCONFIG_FC = $(abspath $(SYSCONFDIR)/$(CONFIG_FILE_FC)) + SYSCONFIG_PATHS += $(SYSCONFIG_FC) + + CONFIGS += $(CONFIG_FC) + + # firecracker-specific options (all should be suffixed by "_FC") + DEFBLOCKSTORAGEDRIVER_FC := virtio-mmio + DEFNETWORKMODEL_FC := tcfilter + KERNELTYPE_FC = uncompressed + KERNEL_NAME_FC = $(call MAKE_KERNEL_NAME,$(KERNELTYPE_FC)) + KERNELPATH_FC = $(KERNELDIR)/$(KERNEL_NAME_FC) +endif + +ifeq (,$(KNOWN_HYPERVISORS)) + $(error "ERROR: No hypervisors known for architecture $(ARCH) (looked for: $(HYPERVISORS))") +endif + +ifeq (,$(findstring $(DEFAULT_HYPERVISOR),$(HYPERVISORS))) + $(error "ERROR: Invalid default hypervisor: '$(DEFAULT_HYPERVISOR)'") +endif + +ifeq (,$(findstring $(DEFAULT_HYPERVISOR),$(KNOWN_HYPERVISORS))) + $(error "ERROR: Default hypervisor '$(DEFAULT_HYPERVISOR)' not known for architecture $(ARCH)") +endif + +ifeq ($(DEFAULT_HYPERVISOR),$(HYPERVISOR_QEMU)) + DEFAULT_HYPERVISOR_CONFIG_PATH = $(CONFIG_PATH_QEMU) +endif + +ifeq ($(DEFAULT_HYPERVISOR),$(HYPERVISOR_FC)) + DEFAULT_HYPERVISOR_CONFIG_PATH = $(CONFIG_PATH_FC) +endif CONFDIR := $(DEFAULTSDIR)/$(PROJECT_DIR) SYSCONFDIR := $(SYSCONFDIR)/$(PROJECT_DIR) @@ -197,14 +272,18 @@ USER_VARS += ARCH USER_VARS += BINDIR USER_VARS += CONFIG_PATH USER_VARS += DESTDIR +USER_VARS += DEFAULT_HYPERVISOR +USER_VARS += FCCMD +USER_VARS += FCPATH USER_VARS += SYSCONFIG USER_VARS += IMAGENAME USER_VARS += IMAGEPATH USER_VARS += INITRDNAME USER_VARS += INITRDPATH USER_VARS += MACHINETYPE -USER_VARS += KERNELPATH +USER_VARS += KERNELDIR USER_VARS += KERNELTYPE +USER_VARS += KERNELTYPE_FC USER_VARS += FIRMWAREPATH USER_VARS += MACHINEACCELERATORS USER_VARS += KERNELPARAMS @@ -231,10 +310,12 @@ USER_VARS += DEFMAXVCPUS USER_VARS += DEFMEMSZ USER_VARS += DEFMEMSLOTS USER_VARS += DEFBRIDGES -USER_VARS += DEFNETWORKMODEL +USER_VARS += DEFNETWORKMODEL_FC +USER_VARS += DEFNETWORKMODEL_QEMU USER_VARS += DEFDISABLEGUESTSECCOMP USER_VARS += DEFDISABLEBLOCK -USER_VARS += DEFBLOCKSTORAGEDRIVER +USER_VARS += DEFBLOCKSTORAGEDRIVER_FC +USER_VARS += DEFBLOCKSTORAGEDRIVER_QEMU USER_VARS += DEFENABLEIOTHREADS USER_VARS += DEFENABLEMEMPREALLOC USER_VARS += DEFENABLEHUGEPAGES @@ -279,7 +360,7 @@ netmon: $(NETMON_TARGET_OUTPUT) $(NETMON_TARGET_OUTPUT): $(SOURCES) $(QUIET_BUILD)(cd $(NETMON_DIR) && go build $(BUILDFLAGS) -o $@ -ldflags "-X main.version=$(VERSION)") -runtime: $(TARGET_OUTPUT) $(CONFIG) +runtime: $(TARGET_OUTPUT) $(CONFIGS) .DEFAULT: default build: default @@ -338,7 +419,21 @@ export GENERATED_CODE # $1 : file to install # $2 : directory path where file will be installed define INSTALL_EXEC - $(QUIET_INST)install -D $1 $(DESTDIR)$2/$(notdir $1); + install -D $1 $(DESTDIR)$2/$(notdir $1); +endef + +# Install a configuration file +# params: +# $1 : file to install +# $2 : directory path where file will be installed +define INSTALL_CONFIG + install --mode 0644 -D $1 $(DESTDIR)$2/$(notdir $1); +endef + +# Returns the name of the kernel file to use based on the provided KERNELTYPE. +# $1 : KERNELTYPE (compressed or uncompressed) +define MAKE_KERNEL_NAME +$(if $(findstring uncompressed,$1),vmlinux.container,vmlinuz.container) endef GENERATED_CONFIG = $(CLI_DIR)/config-generated.go @@ -368,17 +463,20 @@ $(SHIMV2_OUTPUT): $(TARGET_OUTPUT) $(TARGET).coverage: $(SOURCES) $(GENERATED_FILES) Makefile $(QUIET_TEST)go test -o $@ -covermode count -GENERATED_FILES += $(CONFIG) +GENERATED_FILES += $(CONFIGS) $(GENERATED_FILES): %: %.in Makefile VERSION $(QUIET_CONFIG)$(SED) \ -e "s|@COMMIT@|$(COMMIT)|g" \ -e "s|@VERSION@|$(VERSION)|g" \ - -e "s|@CONFIG_IN@|$(CONFIG_IN)|g" \ + -e "s|@CONFIG_QEMU_IN@|$(CONFIG_QEMU_IN)|g" \ + -e "s|@CONFIG_FC_IN@|$(CONFIG_FC_IN)|g" \ -e "s|@CONFIG_PATH@|$(CONFIG_PATH)|g" \ + -e "s|@FCPATH@|$(FCPATH)|g" \ -e "s|@SYSCONFIG@|$(SYSCONFIG)|g" \ -e "s|@IMAGEPATH@|$(IMAGEPATH)|g" \ - -e "s|@KERNELPATH@|$(KERNELPATH)|g" \ + -e "s|@KERNELPATH_FC@|$(KERNELPATH_FC)|g" \ + -e "s|@KERNELPATH_QEMU@|$(KERNELPATH_QEMU)|g" \ -e "s|@INITRDPATH@|$(INITRDPATH)|g" \ -e "s|@FIRMWAREPATH@|$(FIRMWAREPATH)|g" \ -e "s|@MACHINEACCELERATORS@|$(MACHINEACCELERATORS)|g" \ @@ -401,10 +499,12 @@ $(GENERATED_FILES): %: %.in Makefile VERSION -e "s|@DEFMEMSZ@|$(DEFMEMSZ)|g" \ -e "s|@DEFMEMSLOTS@|$(DEFMEMSLOTS)|g" \ -e "s|@DEFBRIDGES@|$(DEFBRIDGES)|g" \ - -e "s|@DEFNETWORKMODEL@|$(DEFNETWORKMODEL)|g" \ + -e "s|@DEFNETWORKMODEL_FC@|$(DEFNETWORKMODEL_FC)|g" \ + -e "s|@DEFNETWORKMODEL_QEMU@|$(DEFNETWORKMODEL_QEMU)|g" \ -e "s|@DEFDISABLEGUESTSECCOMP@|$(DEFDISABLEGUESTSECCOMP)|g" \ -e "s|@DEFDISABLEBLOCK@|$(DEFDISABLEBLOCK)|g" \ - -e "s|@DEFBLOCKSTORAGEDRIVER@|$(DEFBLOCKSTORAGEDRIVER)|g" \ + -e "s|@DEFBLOCKSTORAGEDRIVER_FC@|$(DEFBLOCKSTORAGEDRIVER_FC)|g" \ + -e "s|@DEFBLOCKSTORAGEDRIVER_QEMU@|$(DEFBLOCKSTORAGEDRIVER_QEMU)|g" \ -e "s|@DEFENABLEIOTHREADS@|$(DEFENABLEIOTHREADS)|g" \ -e "s|@DEFENABLEMEMPREALLOC@|$(DEFENABLEMEMPREALLOC)|g" \ -e "s|@DEFENABLEHUGEPAGES@|$(DEFENABLEHUGEPAGES)|g" \ @@ -416,7 +516,7 @@ $(GENERATED_FILES): %: %.in Makefile VERSION -e "s|@DEFENTROPYSOURCE@|$(DEFENTROPYSOURCE)|g" \ $< > $@ -generate-config: $(CONFIG) +generate-config: $(CONFIGS) check: check-go-static @@ -433,28 +533,29 @@ check-go-static: coverage: $(QUIET_TEST).ci/go-test.sh html-coverage -install: default runtime install-scripts install-completions install-config install-bin install-containerd-shim-v2 install-bin-libexec +install: default runtime install-scripts install-completions install-configs install-bin install-containerd-shim-v2 install-bin-libexec install-bin: $(BINLIST) - $(foreach f,$(BINLIST),$(call INSTALL_EXEC,$f,$(BINDIR))) + $(QUIET_INST)$(foreach f,$(BINLIST),$(call INSTALL_EXEC,$f,$(BINDIR))) install-containerd-shim-v2: $(SHIMV2) - $(call INSTALL_EXEC,$<,$(BINDIR)) + $(QUIET_INST)$(call INSTALL_EXEC,$<,$(BINDIR)) install-bin-libexec: $(BINLIBEXECLIST) - $(foreach f,$(BINLIBEXECLIST),$(call INSTALL_EXEC,$f,$(PKGLIBEXECDIR))) + $(QUIET_INST)$(foreach f,$(BINLIBEXECLIST),$(call INSTALL_EXEC,$f,$(PKGLIBEXECDIR))) -install-config: $(CONFIG) - $(QUIET_INST)install --mode 0644 -D $(CONFIG) $(DESTDIR)/$(CONFIG_PATH) +install-configs: $(CONFIGS) + $(QUIET_INST)$(foreach f,$(CONFIGS),$(call INSTALL_CONFIG,$f,$(dir $(CONFIG_PATH)))) + $(QUIET_INST)ln -sf $(DEFAULT_HYPERVISOR_CONFIG_PATH) $(CONFIG_PATH) install-scripts: $(SCRIPTS) - $(foreach f,$(SCRIPTS),$(call INSTALL_EXEC,$f,$(SCRIPTS_DIR))) + $(QUIET_INST)$(foreach f,$(SCRIPTS),$(call INSTALL_EXEC,$f,$(SCRIPTS_DIR))) install-completions: $(QUIET_INST)install --mode 0644 -D $(BASH_COMPLETIONS) $(DESTDIR)/$(BASH_COMPLETIONSDIR)/$(notdir $(BASH_COMPLETIONS)); clean: - $(QUIET_CLEAN)rm -f $(TARGET) $(SHIMV2) $(NETMON_TARGET) $(CONFIG) $(GENERATED_GO_FILES) $(GENERATED_FILES) $(COLLECT_SCRIPT) + $(QUIET_CLEAN)rm -f $(TARGET) $(SHIMV2) $(NETMON_TARGET) $(CONFIGS) $(GENERATED_GO_FILES) $(GENERATED_FILES) $(COLLECT_SCRIPT) show-usage: show-header @printf "• Overview:\n" @@ -514,12 +615,16 @@ else @printf "• GOPATH not set:\n" @printf "\tCan only install prebuilt binaries\n" endif + @printf "\n" + @printf "• hypervisors:\n" + @printf "\tKnown: $(sort $(HYPERVISORS))\n" + @printf "\tAvailable for this architecture: $(sort $(KNOWN_HYPERVISORS))\n" @printf "\n" @printf "• Summary:\n" @printf "\n" - @printf "\tdestination install path (DESTDIR) : %s\n" $(abspath $(DESTDIR)) - @printf "\tbinary installation path (BINDIR) : %s\n" $(abspath $(BINDIR)) - @printf "\tbinaries to install :\n" + @printf "\tdestination install path (DESTDIR) : %s\n" $(abspath $(DESTDIR)) + @printf "\tbinary installation path (BINDIR) : %s\n" $(abspath $(BINDIR)) + @printf "\tbinaries to install :\n" @printf \ "$(foreach b,$(sort $(BINLIST)),$(shell printf "\\t - $(shell readlink -m $(DESTDIR)/$(BINDIR)/$(b))\\\n"))" @printf \ @@ -528,10 +633,24 @@ endif "$(foreach b,$(sort $(BINLIBEXECLIST)),$(shell printf "\\t - $(shell readlink -m $(DESTDIR)/$(PKGLIBEXECDIR)/$(b))\\\n"))" @printf \ "$(foreach s,$(sort $(SCRIPTS)),$(shell printf "\\t - $(shell readlink -m $(DESTDIR)/$(BINDIR)/$(s))\\\n"))" - @printf "\tconfig to install (CONFIG) : %s\n" $(CONFIG) - @printf "\tinstall path (CONFIG_PATH) : %s\n" $(abspath $(CONFIG_PATH)) - @printf "\talternate config path (SYSCONFIG) : %s\n" $(abspath $(SYSCONFIG)) - @printf "\thypervisor path (QEMUPATH) : %s\n" $(abspath $(QEMUPATH)) - @printf "\tassets path (PKGDATADIR) : %s\n" $(abspath $(PKGDATADIR)) - @printf "\tproxy+shim path (PKGLIBEXECDIR) : %s\n" $(abspath $(PKGLIBEXECDIR)) + @printf "\tconfigs to install (CONFIGS) :\n" + @printf \ + "$(foreach c,$(sort $(CONFIGS)),$(shell printf "\\t - $(c)\\\n"))" + @printf "\tinstall paths (CONFIG_PATHS) :\n" + @printf \ + "$(foreach c,$(sort $(CONFIG_PATHS)),$(shell printf "\\t - $(c)\\\n"))" + @printf "\talternate config paths (SYSCONFIG_PATHS) : %s\n" + @printf \ + "$(foreach c,$(sort $(SYSCONFIG_PATHS)),$(shell printf "\\t - $(c)\\\n"))" + + @printf "\tdefault install path for $(DEFAULT_HYPERVISOR) (CONFIG_PATH) : %s\n" $(abspath $(CONFIG_PATH)) + @printf "\tdefault alternate config path (SYSCONFIG) : %s\n" $(abspath $(SYSCONFIG)) +ifneq (,$(findstring $(HYPERVISOR_QEMU),$(KNOWN_HYPERVISORS))) + @printf "\t$(HYPERVISOR_QEMU) hypervisor path (QEMUPATH) : %s\n" $(abspath $(QEMUPATH)) +endif +ifneq (,$(findstring $(HYPERVISOR_FC),$(KNOWN_HYPERVISORS))) + @printf "\t$(HYPERVISOR_FC) hypervisor path (FCPATH) : %s\n" $(abspath $(FCPATH)) +endif + @printf "\tassets path (PKGDATADIR) : %s\n" $(abspath $(PKGDATADIR)) + @printf "\tproxy+shim path (PKGLIBEXECDIR) : %s\n" $(abspath $(PKGLIBEXECDIR)) @printf "\n" diff --git a/arch/amd64-options.mk b/arch/amd64-options.mk index c2eb254c2..fff767fb8 100644 --- a/arch/amd64-options.mk +++ b/arch/amd64-options.mk @@ -1,4 +1,4 @@ -# Copyright (c) 2018 Intel Corporation +# Copyright (c) 2018-2019 Intel Corporation # # SPDX-License-Identifier: Apache-2.0 # @@ -10,3 +10,6 @@ KERNELPARAMS := MACHINEACCELERATORS := QEMUCMD := qemu-lite-system-x86_64 + +# Firecracker binary name +FCCMD := firecracker diff --git a/cli/config/configuration-fc.toml.in b/cli/config/configuration-fc.toml.in new file mode 100644 index 000000000..6894b19c1 --- /dev/null +++ b/cli/config/configuration-fc.toml.in @@ -0,0 +1,291 @@ +# Copyright (c) 2017-2019 Intel Corporation +# +# SPDX-License-Identifier: Apache-2.0 +# + +# XXX: WARNING: this file is auto-generated. +# XXX: +# XXX: Source file: "@CONFIG_FC_IN@" +# XXX: Project: +# XXX: Name: @PROJECT_NAME@ +# XXX: Type: @PROJECT_TYPE@ + +[hypervisor.firecracker] +path = "@FCPATH@" +kernel = "@KERNELPATH_FC@" +image = "@IMAGEPATH@" + +# Optional space-separated list of options to pass to the guest kernel. +# For example, use `kernel_params = "vsyscall=emulate"` if you are having +# trouble running pre-2.15 glibc. +# +# WARNING: - any parameter specified here will take priority over the default +# parameter value of the same name used to start the virtual machine. +# Do not set values here unless you understand the impact of doing so as you +# may stop the virtual machine from booting. +# To see the list of default parameters, enable hypervisor debug, create a +# container and look for 'default-kernel-parameters' log entries. +kernel_params = "@KERNELPARAMS@" + +# Default number of vCPUs per SB/VM: +# unspecified or 0 --> will be set to @DEFVCPUS@ +# < 0 --> will be set to the actual number of physical cores +# > 0 <= number of physical cores --> will be set to the specified number +# > number of physical cores --> will be set to the actual number of physical cores +default_vcpus = 1 + +# Default maximum number of vCPUs per SB/VM: +# unspecified or == 0 --> will be set to the actual number of physical cores or to the maximum number +# of vCPUs supported by KVM if that number is exceeded +# > 0 <= number of physical cores --> will be set to the specified number +# > number of physical cores --> will be set to the actual number of physical cores or to the maximum number +# of vCPUs supported by KVM if that number is exceeded +# WARNING: Depending of the architecture, the maximum number of vCPUs supported by KVM is used when +# the actual number of physical cores is greater than it. +# WARNING: Be aware that this value impacts the virtual machine's memory footprint and CPU +# the hotplug functionality. For example, `default_maxvcpus = 240` specifies that until 240 vCPUs +# can be added to a SB/VM, but the memory footprint will be big. Another example, with +# `default_maxvcpus = 8` the memory footprint will be small, but 8 will be the maximum number of +# vCPUs supported by the SB/VM. In general, we recommend that you do not edit this variable, +# unless you know what are you doing. +default_maxvcpus = @DEFMAXVCPUS@ + +# Bridges can be used to hot plug devices. +# Limitations: +# * Currently only pci bridges are supported +# * Until 30 devices per bridge can be hot plugged. +# * Until 5 PCI bridges can be cold plugged per VM. +# This limitation could be a bug in the kernel +# Default number of bridges per SB/VM: +# unspecified or 0 --> will be set to @DEFBRIDGES@ +# > 1 <= 5 --> will be set to the specified number +# > 5 --> will be set to 5 +default_bridges = @DEFBRIDGES@ + +# Default memory size in MiB for SB/VM. +# If unspecified then it will be set @DEFMEMSZ@ MiB. +default_memory = @DEFMEMSZ@ +# +# Default memory slots per SB/VM. +# If unspecified then it will be set @DEFMEMSLOTS@. +# This is will determine the times that memory will be hotadded to sandbox/VM. +#memory_slots = @DEFMEMSLOTS@ + +# The size in MiB will be plused to max memory of hypervisor. +# It is the memory address space for the NVDIMM devie. +# If set block storage driver (block_device_driver) to "nvdimm", +# should set memory_offset to the size of block device. +# Default 0 +#memory_offset = 0 + +# Disable block device from being used for a container's rootfs. +# In case of a storage driver like devicemapper where a container's +# root file system is backed by a block device, the block device is passed +# directly to the hypervisor for performance reasons. +# This flag prevents the block device from being passed to the hypervisor, +# 9pfs is used instead to pass the rootfs. +disable_block_device_use = @DEFDISABLEBLOCK@ + +# Block storage driver to be used for the hypervisor in case the container +# rootfs is backed by a block device. This is virtio-scsi, virtio-blk +# or nvdimm. +block_device_driver = "@DEFBLOCKSTORAGEDRIVER_FC@" + +# Specifies cache-related options will be set to block devices or not. +# Default false +#block_device_cache_set = true + +# Specifies cache-related options for block devices. +# Denotes whether use of O_DIRECT (bypass the host page cache) is enabled. +# Default false +#block_device_cache_direct = true + +# Specifies cache-related options for block devices. +# Denotes whether flush requests for the device are ignored. +# Default false +#block_device_cache_noflush = true + +# Enable pre allocation of VM RAM, default false +# Enabling this will result in lower container density +# as all of the memory will be allocated and locked +# This is useful when you want to reserve all the memory +# upfront or in the cases where you want memory latencies +# to be very predictable +# Default false +#enable_mem_prealloc = true + +# Enable huge pages for VM RAM, default false +# Enabling this will result in the VM memory +# being allocated using huge pages. +# This is useful when you want to use vhost-user network +# stacks within the container. This will automatically +# result in memory pre allocation +#enable_hugepages = true + +# Enable swap of vm memory. Default false. +# The behaviour is undefined if mem_prealloc is also set to true +#enable_swap = true + +# This option changes the default hypervisor and kernel parameters +# to enable debug output where available. This extra output is added +# to the proxy logs, but only when proxy debug is also enabled. +# +# Default false +#enable_debug = true + +# Disable the customizations done in the runtime when it detects +# that it is running on top a VMM. This will result in the runtime +# behaving as it would when running on bare metal. +# +#disable_nesting_checks = true + +# This is the msize used for 9p shares. It is the number of bytes +# used for 9p packet payload. +#msize_9p = @DEFMSIZE9P@ + +# If true and vsocks are supported, use vsocks to communicate directly +# with the agent (no proxy is started). +# Default true +use_vsock = true + +# VFIO devices are hotplugged on a bridge by default. +# Enable hotplugging on root bus. This may be required for devices with +# a large PCI bar, as this is a current limitation with hotplugging on +# a bridge. This value is valid for "pc" machine type. +# Default false +#hotplug_vfio_on_root_bus = true + +# If host doesn't support vhost_net, set to true. Thus we won't create vhost fds for nics. +# Default false +#disable_vhost_net = true +# +# Default entropy source. +# The path to a host source of entropy (including a real hardware RNG) +# /dev/urandom and /dev/random are two main options. +# Be aware that /dev/random is a blocking source of entropy. If the host +# runs out of entropy, the VMs boot time will increase leading to get startup +# timeouts. +# The source of entropy /dev/urandom is non-blocking and provides a +# generally acceptable source of entropy. It should work well for pretty much +# all practical purposes. +#entropy_source= "@DEFENTROPYSOURCE@" + +# Path to OCI hook binaries in the *guest rootfs*. +# This does not affect host-side hooks which must instead be added to +# the OCI spec passed to the runtime. +# +# You can create a rootfs with hooks by customizing the osbuilder scripts: +# https://github.com/kata-containers/osbuilder +# +# Hooks must be stored in a subdirectory of guest_hook_path according to their +# hook type, i.e. "guest_hook_path/{prestart,postart,poststop}". +# The agent will scan these directories for executable files and add them, in +# lexicographical order, to the lifecycle of the guest container. +# Hooks are executed in the runtime namespace of the guest. See the official documentation: +# https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks +# Warnings will be logged if any error is encountered will scanning for hooks, +# but it will not abort container execution. +#guest_hook_path = "/usr/share/oci/hooks" + +[factory] +# VM templating support. Once enabled, new VMs are created from template +# using vm cloning. They will share the same initial kernel, initramfs and +# agent memory by mapping it readonly. It helps speeding up new container +# creation and saves a lot of memory if there are many kata containers running +# on the same host. +# +# When disabled, new VMs are created from scratch. +# +# Note: Requires "initrd=" to be set ("image=" is not supported). +# +# Default false +#enable_template = true + +[proxy.@PROJECT_TYPE@] + +[shim.@PROJECT_TYPE@] +path = "@SHIMPATH@" + +# If enabled, shim messages will be sent to the system log +# (default: disabled) +#enable_debug = true + +# If enabled, the shim will create opentracing.io traces and spans. +# (See https://www.jaegertracing.io/docs/getting-started). +# +# Note: By default, the shim runs in a separate network namespace. Therefore, +# to allow it to send trace details to the Jaeger agent running on the host, +# it is necessary to set 'disable_new_netns=true' so that it runs in the host +# network namespace. +# +# (default: disabled) +#enable_tracing = true + +[agent.@PROJECT_TYPE@] +# There is no field for this section. The goal is only to be able to +# specify which type of agent the user wants to use. + +[netmon] +# If enabled, the network monitoring process gets started when the +# sandbox is created. This allows for the detection of some additional +# network being added to the existing network namespace, after the +# sandbox has been created. +# (default: disabled) +#enable_netmon = true + +# Specify the path to the netmon binary. +path = "@NETMONPATH@" + +# If enabled, netmon messages will be sent to the system log +# (default: disabled) +#enable_debug = true + +[runtime] +# If enabled, the runtime will log additional debug messages to the +# system log +# (default: disabled) +#enable_debug = true +# +# Internetworking model +# Determines how the VM should be connected to the +# the container network interface +# Options: +# +# - bridged +# Uses a linux bridge to interconnect the container interface to +# the VM. Works for most cases except macvlan and ipvlan. +# +# - macvtap +# Used when the Container network interface can be bridged using +# macvtap. +# +# - none +# Used when customize network. Only creates a tap device. No veth pair. +# +# - tcfilter +# Uses tc filter rules to redirect traffic from the network interface +# provided by plugin to a tap interface connected to the VM. +# +internetworking_model="@DEFNETWORKMODEL_FC@" + +# disable guest seccomp +# Determines whether container seccomp profiles are passed to the virtual +# machine and applied by the kata agent. If set to true, seccomp is not applied +# within the guest +# (default: true) +disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@ + +# If enabled, the runtime will create opentracing.io traces and spans. +# (See https://www.jaegertracing.io/docs/getting-started). +# (default: disabled) +#enable_tracing = true + +# If enabled, the runtime will not create a network namespace for shim and hypervisor processes. +# This option may have some potential impacts to your host. It should only be used when you know what you're doing. +# `disable_new_netns` conflicts with `enable_netmon` +# `disable_new_netns` conflicts with `internetworking_model=bridged` and `internetworking_model=macvtap`. It works only +# with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge +# (like OVS) directly. +# If you are using docker, `disable_new_netns` only works with `docker run --net=none` +# (default: false) +#disable_new_netns = true diff --git a/cli/config/configuration.toml.in b/cli/config/configuration-qemu.toml.in similarity index 98% rename from cli/config/configuration.toml.in rename to cli/config/configuration-qemu.toml.in index 5ecedad3d..4be52f4a9 100644 --- a/cli/config/configuration.toml.in +++ b/cli/config/configuration-qemu.toml.in @@ -1,18 +1,18 @@ -# Copyright (c) 2017-2018 Intel Corporation +# Copyright (c) 2017-2019 Intel Corporation # # SPDX-License-Identifier: Apache-2.0 # # XXX: WARNING: this file is auto-generated. # XXX: -# XXX: Source file: "@CONFIG_IN@" +# XXX: Source file: "@CONFIG_QEMU_IN@" # XXX: Project: # XXX: Name: @PROJECT_NAME@ # XXX: Type: @PROJECT_TYPE@ [hypervisor.qemu] path = "@QEMUPATH@" -kernel = "@KERNELPATH@" +kernel = "@KERNELPATH_QEMU@" initrd = "@INITRDPATH@" image = "@IMAGEPATH@" machine_type = "@MACHINETYPE@" @@ -100,7 +100,7 @@ disable_block_device_use = @DEFDISABLEBLOCK@ # Block storage driver to be used for the hypervisor in case the container # rootfs is backed by a block device. This is virtio-scsi, virtio-blk # or nvdimm. -block_device_driver = "@DEFBLOCKSTORAGEDRIVER@" +block_device_driver = "@DEFBLOCKSTORAGEDRIVER_QEMU@" # Specifies cache-related options will be set to block devices or not. # Default false @@ -289,7 +289,7 @@ path = "@NETMONPATH@" # Uses tc filter rules to redirect traffic from the network interface # provided by plugin to a tap interface connected to the VM. # -internetworking_model="@DEFNETWORKMODEL@" +internetworking_model="@DEFNETWORKMODEL_QEMU@" # disable guest seccomp # Determines whether container seccomp profiles are passed to the virtual