aljaz/kata-containers
1
0
Fork 0
mirror of https://github.com/aljazceru/kata-containers.git synced 2025-12-31 21:14:25 +01:00
Code Issues Packages Projects Releases Wiki Activity
9,207 Commits 30 Branches 115 Tags
91cae52fe3d811c9c87341ea8a8e8a7f1423ccf7
Commit Graph

2349 Commits

Author SHA1 Message Date
Megan Wright
7f71cdc290 Fix clippy errors 2022-08-02 10:26:18 +01:00
Megan Wright
c13380ba69 CCv0: Merge main into CCv0 branch 
Merge remote-tracking branch 'upstream/main' into CCv0

Fixes: #4750
Depends-on: github.com/kata-containers/tests#4971
Signed-off-by: Megan Wright megan.wright@ibm.com
 2022-08-01 16:29:50 +01:00
Ryan Savino
9b1940e93e versions: update rust version 
Fixes #4764

versions: update rust version to fix ccv0 attestation-agent build error
static-checks: kata tools, libs, and agent fixes

Signed-Off-By: Ryan Savino <ryan.savino@amd.com>
 2022-07-29 18:41:43 -05:00
Peng Tao
0aefab4d80 Merge pull request #4739 from liubin/fix/4738-trace-rpc-calls 
agent: log RPC calls for debugging
 2022-07-29 14:18:23 +08:00
yaoyinnan
5c3155f7e2 runtime: Support for host cgroup v2 
Support cgroup v2 on the host. Update vendor containerd/cgroups to add cgroup v2.

Fixes: #3073

Signed-off-by: yaoyinnan <yaoyinnan@foxmail.com>
 2022-07-28 10:30:45 +08:00
Bin Liu
557229c39d Merge pull request #4724 from yahaa/fix-docs 
Docs: fix tables format error
 2022-07-27 21:13:29 +08:00
Archana Shinde
1b01ea53d9 Merge pull request #4735 from nubificus/feature-fc-v1.1 
versions: Update Firecracker version to v1.1.0
 2022-07-27 04:50:32 +05:30
Peng Tao
27c82018d1 Merge pull request #4753 from Tim-Zhang/agent-fix-stream-fd-double-close 
agent: Fix stream fd's double close
 2022-07-27 00:54:07 +08:00
Bin Liu
6fddf031df Merge pull request #4664 from lifupan/main 
container: kill all of the processes in a container when it terminated
 2022-07-26 23:12:11 +08:00
Tim Zhang
f5aa6ae467 agent: Fix stream fd's double close problem 
The fd would be closed on Pipestream's dropping and we should
not close it agian.

Fixes: #4752

Signed-off-by: Tim Zhang <tim@hyper.sh>
 2022-07-26 20:05:06 +08:00
yahaa
6e149b43f7 Docs: fix tables format error 
Fixes: #4725

Signed-off-by: yahaa <1477765176@qq.com>
 2022-07-26 19:05:09 +08:00
gntouts
56d49b5073 versions: Update Firecracker version to v1.1.0 
This patch upgrades Firecracker version from v0.23.4 to v1.1.0

* Generate swagger models for v1.1.0 (from firecracker.yaml)
* Replace ht_enabled param to smt (API change)
* Remove NUMA-related jailer param --node 0

Fixes: #4673
Depends-on: github.com/kata-containers/tests#4968

Signed-off-by: George Ntoutsos <gntouts@nubificus.co.uk>
Signed-off-by: Anastassios Nanos <ananos@nubificus.co.uk>
 2022-07-26 07:01:26 +00:00
liubin
0e24f47a43 agent: log RPC calls for debugging 
We can log all RPC calls to the agent for debugging purposes
to check which RPC is called, which can help us to understand
the container lifespan.

Fixes: #4738

Signed-off-by: liubin <liubin0329@gmail.com>
 2022-07-26 10:32:44 +08:00
Tim Zhang
e764a726ab Merge pull request #4715 from Tim-Zhang/fix-ut-test_do_write_stream 
agent: fix fd-double-close problem in ut test_do_write_stream
 2022-07-25 17:34:26 +08:00
Tim Zhang
427b29454a Merge pull request #4709 from liubin/fix/4708-unwrap-error 
rustjail: check result to let it return early
 2022-07-25 15:05:20 +08:00
Wainer Moschetta
0b4a91ec1a Merge pull request #4644 from bookinabox/optimize-get-paths 
cgroups: remove unnecessary get_paths()
 2022-07-22 17:01:01 -03:00
Tim Zhang
912641509e agent: fix fd-double-close problem in ut test_do_write_stream 
The fd will closed on struct Process's dropping, so don't
close it again manually.

Fixes: #4598

Signed-off-by: Tim Zhang <tim@hyper.sh>
 2022-07-21 19:37:15 +08:00
liubin
0d7cb7eb16 agent: delete agent-type property in announce 
Since there is only one type of agent now, the
agent-type is not needed anymore.

Signed-off-by: liubin <liubin0329@gmail.com>
 2022-07-21 14:53:01 +08:00
liubin
eec9ac81ef rustjail: check result to let it return early. 
check the result to let it return early if there are some errors

Fixes: #4708

Signed-off-by: liubin <liubin0329@gmail.com>
 2022-07-21 14:51:30 +08:00
Georgina Kinge
c8d783e5ef CCv0: Merge main into CCv0 branch 
Merge remote-tracking branch 'upstream/main' into CCv0

Fixes: #4696
Signed-off-by: Georgina Kinge <georgina.kinge@ibm.com>
 2022-07-20 09:39:59 +01:00
Fupan Li
d93e4b939d container: kill all of the processes in this container 
When a container terminated, we should make sure there's no processes
left after destroying the container.

Before this commit, kata-agent depended on the kernel's pidns
to destroy all of the process in a container after the 1 process
exit in a container. This is true for those container using a
separated pidns, but for the case of shared pidns within the
sandbox, the container exit wouldn't trigger the pidns terminated,
and there would be some daemon process left in this container, this
wasn't expected.

Fixes: #4663

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
 2022-07-14 16:39:49 +08:00
Bin Liu
575b5eb5f5 Merge pull request #4506 from cyyzero/runk-exec 
runk: Support `exec` sub-command
 2022-07-14 14:22:24 +08:00
Derek Lee
9ae2a45b38 cgroups: remove unnecessary get_paths() 
Change get_mounts to get paths from a borrowed argument rather than
calling get_paths a second time.

Fixes #3768

Signed-off-by: Derek Lee <derlee@redhat.com>
 2022-07-13 09:17:14 -07:00
Megan Wright
f4979a9aa5 CCv0: Merge main into CCv0 branch 
Merge remote-tracking branch 'upstream/main' into CCv0

Fixes: #4651
Signed-off-by: Megan Wright <megan.wright@ibm.com>
 2022-07-13 14:32:08 +01:00
Fabiano Fidêncio
be31207f6e clh: Don't crash if no network device is set by the upper layer 
`ctr` doesn't set a network device when creating the sandbox, which
leads to Cloud Hypervisor's driver crashing, see the log below:
```
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x55641c23b248]
goroutine 32 [running]:
github.com/kata-containers/kata-containers/src/runtime/virtcontainers.glob..func1(0xc000397900)
	/home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/virtcontainers/clh.go:163 +0x128
github.com/kata-containers/kata-containers/src/runtime/virtcontainers.(*cloudHypervisor).vmAddNetPut(...)
	/home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/virtcontainers/clh.go:1348
github.com/kata-containers/kata-containers/src/runtime/virtcontainers.(*cloudHypervisor).bootVM(0xc000397900, {0x55641c76dfc0, 0xc000454ae0})
	/home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/virtcontainers/clh.go:1378 +0x5a2
github.com/kata-containers/kata-containers/src/runtime/virtcontainers.(*cloudHypervisor).StartVM(0xc000397900, {0x55641c76dff8, 0xc00044c240},
0x55641b8016fd)
        /home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/virtcontainers/clh.go:659 +0x7ee
github.com/kata-containers/kata-containers/src/runtime/virtcontainers.(*Sandbox).startVM.func2()
        /home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/virtcontainers/sandbox.go:1219 +0x190
github.com/kata-containers/kata-containers/src/runtime/virtcontainers.(*LinuxNetwork).Run.func1({0xc0004a8910, 0x3b})
        /home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/virtcontainers/network_linux.go:319 +0x1b
github.com/kata-containers/kata-containers/src/runtime/virtcontainers.doNetNS({0xc000048440, 0xc00044c240}, 0xc0005d5b38)
        /home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/virtcontainers/network_linux.go:1045 +0x163
github.com/kata-containers/kata-containers/src/runtime/virtcontainers.(*LinuxNetwork).Run(0xc000150c80, {0x55641c76dff8, 0xc00044c240}, 0xc00014e4e0)
	/home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/virtcontainers/network_linux.go:318 +0x105
github.com/kata-containers/kata-containers/src/runtime/virtcontainers.(*Sandbox).startVM(0xc000107d40, {0x55641c76dff8, 0xc0005529f0})
	/home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/virtcontainers/sandbox.go:1205 +0x65f
github.com/kata-containers/kata-containers/src/runtime/virtcontainers.createSandboxFromConfig({_, _}, {{0x0, 0x0, 0x0}, {0xc000385a00, 0x1, 0x1},
{0x55641d033260, 0x0, ...}, ...}, ...)
        /home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/virtcontainers/api.go:91 +0x346
github.com/kata-containers/kata-containers/src/runtime/virtcontainers.CreateSandbox({_, _}, {{0x0, 0x0, 0x0}, {0xc000385a00, 0x1, 0x1},
{0x55641d033260, 0x0, ...}, ...}, ...)
        /home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/virtcontainers/api.go:51 +0x150
github.com/kata-containers/kata-containers/src/runtime/virtcontainers.(*VCImpl).CreateSandbox(_, {_, _}, {{0x0, 0x0, 0x0}, {0xc000385a00, 0x1, 0x1},
{0x55641d033260, ...}, ...})
        /home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/virtcontainers/implementation.go:35 +0x74
github.com/kata-containers/kata-containers/src/runtime/pkg/katautils.CreateSandbox({_, _}, {_, _}, {{0xc0004806c0, 0x9}, 0xc000140110, 0xc00000f7a0,
{0x0, 0x0}, ...}, ...)
        /home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/pkg/katautils/create.go:175 +0x8b6
github.com/kata-containers/kata-containers/src/runtime/pkg/containerd-shim-v2.create({0x55641c76dff8, 0xc0004129f0}, 0xc00034a000, 0xc00036a000)
        /home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/pkg/containerd-shim-v2/create.go:147 +0xdea
github.com/kata-containers/kata-containers/src/runtime/pkg/containerd-shim-v2.(*service).Create.func2()
        /home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/pkg/containerd-shim-v2/service.go:401 +0x32
created by github.com/kata-containers/kata-containers/src/runtime/pkg/containerd-shim-v2.(*service).Create
        /home/ubuntu/go/src/github.com/kata-containers/kata-containers/src/runtime/pkg/containerd-shim-v2/service.go:400 +0x534
```

This bug has been introduced as part of the
https://github.com/kata-containers/kata-containers/pull/4312 PR, which
changed how we add the network device.

In order to avoid the crash, let's simply check whether we have a device
to be added before iterating the list of network devices.

Fixes: #4618

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
 2022-07-13 10:40:21 +02:00
Fabiano Fidêncio
dc3b6f6592 versions: Update Cloud Hypervisor to v25.0 
Cloud Hypervisor v25.0 has been released on July 7th, 2022, and brings
the following changes:

**ch-remote Improvements**
The ch-remote command has gained support for creating the VM from a JSON
config and support for booting and deleting the VM from the VMM.

**VM "Coredump" Support**
Under the guest_debug feature flag it is now possible to extract the memory
of the guest for use in debugging with e.g. the crash utility.
(https://github.com/cloud-hypervisor/cloud-hypervisor/issues/4012)

**Notable Bug Fixes**
* Always restore console mode on exit
  (https://github.com/cloud-hypervisor/cloud-hypervisor/issues/4249,
   https://github.com/cloud-hypervisor/cloud-hypervisor/issues/4248)
* Restore vCPUs in numerical order which fixes aarch64 snapshot/restore
  (https://github.com/cloud-hypervisor/cloud-hypervisor/issues/4244)
* Don't try and configure IFF_RUNNING on TAP devices
  (https://github.com/cloud-hypervisor/cloud-hypervisor/issues/4279)
* Propagate configured queue size through to vhost-user backend
  (https://github.com/cloud-hypervisor/cloud-hypervisor/issues/4286)
* Always Program vCPU CPUID before running the vCPU to fix running on Linux
  5.16
  (https://github.com/cloud-hypervisor/cloud-hypervisor/issues/4156)
* Enable ACPI MADT "Online Capable" flag for hotpluggable vCPUs to fix newer
  Linux guest

**Removals**
The following functionality has been removed:

* The mergeable option from the virtio-pmem support has been removed
  (https://github.com/cloud-hypervisor/cloud-hypervisor/issues/3968)
* The dax option from the virtio-fs support has been removed
  (https://github.com/cloud-hypervisor/cloud-hypervisor/issues/3889)

Fixes: #4641

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
 2022-07-12 14:47:58 +00:00
Georgina Kinge
9d524b29ad CCv0: Merge main into CCv0 branch 
Merge remote-tracking branch 'upstream/main' into CCv0

Fixes: #4602
Signed-off-by: Georgina Kinge <georgina.kinge@ibm.com>
 2022-07-06 14:27:15 +01:00
Chen Yiyang
f59939a31f runk: Support exec sub-command 
`exec` will execute a command inside a container which exists and is not
frozon or stopped. *Inside* means that the new process share namespaces
and cgroup with the container init process. Command can be specified by
`--process` parameter to read from a file, or from other parameters such
as arg, env, etc. In order to be compatible with `create`/`run`
commands, I refactor libcontainer. `Container` in builder.rs is divided
into `InitContainer` and `ActivatedContainer`. `InitContainer` is used
for `create`/`run` command. It will load spec from given bundle path.
`ActivatedContainer` is used by `exec` command, and will read the
container's status file, which stores the spec and `CreateOpt` for
creating the rustjail::LinuxContainer. Adapt the spec by replacing the
process with given options and updating the namesapces with some paths
to join the container. I also rename the `ContainerContext` as
`ContainerLauncher`, which is only used to spawn process now. It uses
the `LinuxContaier` in rustjail as the runner. For `create`/`run`, the
`launch` method will create a new container and run the first process.
For `exec`, the `launch` method will spawn a process which joins a
container.

Fixes #4363

Signed-off-by: Chen Yiyang <cyyzero@qq.com>
 2022-07-06 21:11:30 +08:00
Manabu Sugimoto
4d89476c91 runtime: Fix DisableSelinux config 
Enable Kata runtime to handle `disable_selinux` flag properly in order
to be able to change the status by the runtime configuration whether the
runtime applies the SELinux label to VMM process.

Fixes: #4599
Signed-off-by: Manabu Sugimoto <Manabu.Sugimoto@sony.com>
 2022-07-06 15:50:28 +09:00
Fabiano Fidêncio
071dd4c790 Merge pull request #4109 from pmores/drop-in-cfg-files-support 
Drop in cfg files support
 2022-07-05 22:21:24 +02:00
Bin Liu
d9e868f44e Merge pull request #4479 from quanweiZhou/enhance-get-handled-signal 
agent: enhance get handled signal
 2022-07-05 15:18:21 +08:00
Bin Liu
b33ad7e57a Merge pull request #4574 from jelipo/fix-serde-serializing 
oci: fix serde skip serializing condition
 2022-07-05 13:51:43 +08:00
Bin Liu
0189738283 Merge pull request #4576 from ManaSugi/fix/oci-poststart-hook 
agent: Run OCI poststart hooks after a container is launched
 2022-07-05 11:08:49 +08:00
Peng Tao
cd2d8c6fe2 Merge pull request #4580 from ManaSugi/fix/replace-libc-with-nix 
agent: Replace some libc functions with nix ones
 2022-07-05 10:53:42 +08:00
Peng Tao
a1de394e51 Merge pull request #4550 from liubin/fix/4548-overwrite-mount-type-for-bind-mount 
runtime: overwrite mount type to bind for bind mounts
 2022-07-04 19:56:26 +08:00
haining.cao
0ddb34a38d oci: fix serde skip serializing condition 
There is an extra space on the serde serialization condition.

Fixes: #4578

Signed-off-by: haining.cao <haining.cao@daocloud.io>
 2022-07-04 16:16:04 +08:00
Manabu Sugimoto
fbb2e9bce9 agent: Replace some libc functions with nix ones 
Replace `libc::setgroups()`, `libc::fchown()`, and `libc::sethostname()`
functions with nix crate ones for safety and maintainability.

Fixes: #4579

Signed-off-by: Manabu Sugimoto <Manabu.Sugimoto@sony.com>
 2022-07-04 14:49:38 +09:00
Manabu Sugimoto
acd3302bef agent: Run OCI poststart hooks after a container is launched 
Run the OCI `poststart` hooks must be called after the
user-specified process is executed but before the `start`
operation returns in accordance with OCI runtime spec.

Fixes: #4575

Signed-off-by: Manabu Sugimoto <Manabu.Sugimoto@sony.com>
 2022-07-03 18:03:51 +09:00
liubin
1f363a386c runtime: overwrite mount type to bind for bind mounts 
Some clients like nerdctl may pass mount type of none for volumes/bind mounts,
this will lead to container start fails.

Referring to runc, it overwrites the mount type to bind and ignores the input value.

Fixes: #4548

Signed-off-by: liubin <liubin0329@gmail.com>
 2022-07-01 12:13:01 +08:00
GabyCT
02a51e75a7 Merge pull request #4554 from liubin/fix/delete-not-used-console-from-container-config 
runtime: delete Console from Cmd type
 2022-06-30 11:40:07 -05:00
Fabiano Fidêncio
d4d178359b runtime: Expose DEFSERVICEOFFLOAD build option 
For the CC build we need to enable such a flag, and the cleaner way to
do so is exposing it in the Makefile and, later on, making sure its
correct value to the build script.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
 2022-06-30 12:21:10 +02:00
Fabiano Fidêncio
aa561b49f5 Merge pull request #4540 from fidencio/topic/default_maxmemory 
Add `default_maxmemory` config option
 2022-06-30 12:08:15 +02:00
quanweiZhou
2a4fbd6d8c agent: enhance get handled signal 
For runC, send the signal to the init process directly.
For kata, we try to send `SIGKILL` instead of `SIGTERM` when the process
has not installed the handler for `SIGTERM`.
The `is_signal_handled` function determine which signal the container
process has been handled. But currently `is_signal_handled` is only
catching (SigCgt). While the container process is ignoring (SigIgn) or
blocking (SigBlk) also should not be converted from the `SIGTERM` to
`SIGKILL`. For example, when using terminationGracePeriodSeconds the k8s
will send SIGTERM first and then send `SIGKILL`, in this case, the
container ignores the `SIGTERM`, so we should send the `SIGTERM` not the
`SIGKILL` to the container.

Fixes: #4478
Signed-off-by: quanweiZhou <quanweiZhou@linux.alibaba.com>
 2022-06-30 14:44:46 +08:00
GabyCT
2a94261df5 Merge pull request #4549 from liubin/fix/4419-set-status-if-wait-process-failed 
shim: set a non-zero return code if the wait process call failed.
 2022-06-29 17:04:53 -05:00
Georgina Kinge
eb9836ff8e runtime: add image import back in 
Putting image import back in after removal during merge conflict

Fixes: #4555
Signed-off-by: Georgina Kinge <georgina.kinge@ibm.com>
 2022-06-29 14:13:18 +01:00
Fabiano Fidêncio
1e12d56512 Merge pull request #4469 from egernst/config-validation-refactor 
Refactor how hypervisor config validation is handled
 2022-06-29 14:42:11 +02:00
Georgina Kinge
bda68b16f1 CCv0: Merge main into CCv0 branch 
Merge remote-tracking branch 'upstream/main' into CCv0

Fixes: #4555
Signed-off-by: Georgina Kinge <georgina.kinge@ibm.com>
 2022-06-29 13:22:22 +01:00
liubin
a5a25ed13d runtime: delete Console from Cmd type 
There is much code related to this property, but it is not used anymore.

Fixes: #4553

Signed-off-by: liubin <liubin0329@gmail.com>
 2022-06-29 17:36:32 +08:00
Pavel Mores
96553e8bd2 runtime: Add documentation of drop-in config file fragments 
Added user manual for the drop-in config file fragments feature.

Signed-off-by: Pavel Mores <pmores@redhat.com>
 2022-06-29 10:56:53 +02:00
Pavel Mores
c656457e90 runtime: Add tests of drop-in config file decoding 
The tests ensure that interactions between drop-ins and the base
configuration.toml and among drop-ins themselves work as intended,
basically that files are evaluated in the correct order (base file
first, then drop-ins in alphabetical order) and the last one to set
a specific key wins.

Signed-off-by: Pavel Mores <pmores@redhat.com>
 2022-06-29 09:54:39 +02:00