Updated to better clarify this configuration option. Currently in QEMU
pre 1.9 release of Kata, vhost-net is used for the virtio-net backend.
This results in efficient network I/O performance, but does rely on the
backend running in ring0 (host kernel). Update comment to clarify this
trade-off for end-users.
Fixes: #2198
Signed-off-by: Eric Ernst <eric.ernst@intel.com>
Prior to the addition of tcMirroring support kata-runtime had
compatibility issues with some CNI plugins some of which were addressed
by the bridged model. With the addition of tc mode there are no gaps in
networking that can be filled by the bridged mode or enlightened mode
(which was never implemented).
Eliminate both of these options to simplify the setup.
Fixes: #1213
Signed-off-by: Manohar Castelino <manohar.r.castelino@intel.com>
ACRN doesn't support configuring number of guest vcpu option ('-c') anymore.
Number of guest vcpus will be defined in the hypervisor scenario
configuration file instead.
Removed the -c option from the acrn-dm parameters when launching VMs and
also trimmed configuration.toml file accordingly.
fixes#2136
Signed-off-by: Vijay Dhanraj <vijay.dhanraj@intel.com>
Add the ability to check whether kata is running rootlessly or
not. Add the setup of the rootless directory located in the dir
/run/user/<UID> directory.
Fixes: #1874
Signed-off-by: Gabi Beyer <gabrielle.n.beyer@intel.com>
Co-developed-by: Marco Vedovati <mvedovati@suse.com>
Signed-off-by: Marco Vedovati <mvedovati@suse.com>
This patch adds support for getting the kata UUID from
acrn hypervisor and using these UUID to create a VM.
Fixes: #1785
Signed-off-by: Vijay Dhanraj <vijay.dhanraj@intel.com>
This will fix the qemu-virtiofs.toml to use the kernel with virtiofs.
Also removes the initrd image from the toml.
Depends-on: github.com/kata-containers/packaging#731
Fixes#2077
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
instead of using `DEFSHAREDFS_NEMU` in `configuration-qemu-virtiofs.toml`,
use `DEFSHAREDFS_QEMU_VIRTIOFS`.
nemu will be deprecated soon so using `DEFSHAREDFS_NEMU` may
brake the configuration for qemu-virtiofs.
Signed-off-by: Salvador Fuentes <salvador.fuentes@intel.com>
currently virtiofs support is being reworked to use qemu
and kernel from virtio-fs gitlab repo. The current support
that we have for virtio-fs has been disabled as required
patches for the 4.19 kernel were removed in [1].
[1] https://github.com/kata-containers/packaging/pull/703Fixes: #2048.
Signed-off-by: Salvador Fuentes <salvador.fuentes@intel.com>
Enable a new configuration file for QEMU with virtiofs 3.0
Depends-on: github.com/kata-containers/packaging#710
Fixes#2053
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
Fixes: #2023
We can get OCI spec config from bundle instead of annotations, so this
field isn't necessary.
Signed-off-by: Wei Zhang <weizhang555.zw@gmail.com>
Fixes: #2023
CompatOCISpec is used to gurantee backward compatbility for old runtime
specs, after we convert CompatOCISpec to standard specs.Spec, we should
use specs.Spec instead of CompatOCISpec, and CompatOCISpec should be
useless from then.
Spread usage of CompatOCISpec can make code structure confusing and making
the runtime spec usage non-standard. Besides, this can be the very first
step of removing CompatOCISpec from config's Annotations field.
Signed-off-by: Wei Zhang <weizhang555.zw@gmail.com>
add option to eneable only pod cgroup (SandboxCgroupOnly)
Depends-on: github.com/kata-containers/tests#1824
Fixes: #1879
Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
Refactor unit test so that podman can be used to run tests when docker
is not available.
Fixes: #2006
Signed-off-by: Marco Vedovati <mvedovati@suse.com>
Since virtio-fs is under active development, more
options will be added increasingly. To avaoid frequent
change on runtime side to handle option changes, use
one mingled arg to ease testing new option/feature of
virtiofsd.
See `virtiofsd -h` for more option details.
Fixes: #1999
Signed-off-by: Eric Ren <renzhen@linux.alibaba.com>
Update kata-check to print by default only relevant information about
the ability to run / create Kata Containers, and omit the list of checks
performed. Checks can still be printed using the --verbose flag.
Fixes: #1944
Signed-off-by: Marco Vedovati <mvedovati@suse.com>
The list of kernel modules can be passed to the runtime through the
configuration file or using OCI annotations. In both cases, a list paramentes
can be specified for each module.
fixes#1925
Signed-off-by: Julio Montes <julio.montes@intel.com>
When force is true, ignore any guest related errors. This can
be used to stop a sandbox when hypervisor process is dead.
Signed-off-by: Peng Tao <bergwolf@hyper.sh>
When a container is paused and something goes terribly
wrong, we still need to be able to clean thing up. A paused
container should be able to transit to stopped state as well
so that we can delete it properly.
Signed-off-by: Peng Tao <bergwolf@hyper.sh>
Add jailer support to configuration files.
Also enable jailer by default in Kata containers.
Signed-off-by: Manohar Castelino <manohar.r.castelino@intel.com>
ACRN hypervisor is a type-1 hypervisor and this patch
adds support to check and validate if the system is
capable of running kata containers with ACRN hypervisor.
Depends-on: github.com/kata-containers/tests#1793
v3->v4:
Implemented a generic way to identify hypervisor and
test VM creation.
v2->v3:
1. Removed cgo structs and defined go structs.
2. Suppressed lint warnings due to unused createVM struct.
v1->v2:
1. Created an issue #1784 to address TODO item.
2. Fixed formatting of the log message.
3. Currently ACRN is only supported on amd64. So
moved ACRN specific code to kata-check_amd64.go.
Fixes: #1778
Signed-off-by: Vijay Dhanraj <vijay.dhanraj@intel.com>
This patch covers the following aspects,
1. Add ACRN as a supported hypervisor for amd64 architecture.
2. Build and install configuration file for ACRN hypervisor.
v1->v2:
1. Deleted autogenerated configuration-acrn.toml.
2. Trimmed configuration options not used by ACRN.
Fixes: #1778
Signed-off-by: Vijay Dhanraj <vijay.dhanraj@intel.com>
Auger Eric's latest patches about "ARM virt: Initial RAM expansion
and extended memory map"(https://patchwork.kernel.org/cover/10835377/)
paves the way to device memory, which is the foundation for NVDIMM and
memory hotplug.
This new feature on qemu kinds of depends on host kernel's new feature
on dynamic IPA range(https://lwn.net/Articles/750176/).
The availability of this feature is advertised by a new kvm cap
KVM_CAP_ARM_VM_IPA_SIZE. When supported, this capability returns the
maximum IPA shift supported by the host. The supported IPA size on
a host could be different from the system's PARange indicated
by the CPUs (e.g, kernel limit on the PA size).
Fixes: #1796
Signed-off-by: Penny Zheng <penny.zheng@arm.com>
As virtio v1.1 spec states:
The guest_cid configuration field MUST be fetched to determine the current CID when a VIRTIO_VSOCK_EVENT_TRANSPORT_RESET event is received.
Existing connections MUST be shut down when a VIRTIO_VSOCK_EVENT_TRANSPORT_RESET event is received.
Listen connections MUST remain operational with the current CID when a VIRTIO_VSOCK_EVENT_TRANSPORT_RESET event is received.
We should be able to use vm templating together with vsock easily, as
qemu already sends VIRTIO_VSOCK_EVENT_TRANSPORT_RESET event to guest.
Fixes: #1773
Signed-off-by: Peng Tao <bergwolf@hyper.sh>
proxy will never be use with the Firecracker VMM. Keeping this header
will result in runtime failures, since the configuration will be parsed
on the path searched for.
Since vsock will always be used, remove the proxy section.
Fixes: #1761
Signed-off-by: Eric Ernst <eric.ernst@intel.com>
A file based memory backend mapped to the host, fot eg: '/dev/shm' will
be used by virtio-fs for performance reasons. This change is a generic
implementation of that for kata. This will be enabled default for
virtio-fs negating the need to enable hugepages in that scenario. This
option can be used without virtio-fs by setting 'file_mem_backend' to
the location in the configuration file. Default value is an empty
string.
Fixes: #1656
Signed-off-by: Ganesh Maharaj Mahalingam <ganesh.mahalingam@intel.com>
nemu needs to be configured with:
`machine_type = "virt"` by default.
In addition, this commit removes
`machine_accelerators="virt"` which was added instead
of `machine_type` in a previous commit.
Fixes: #1707.
Signed-off-by: Salvador Fuentes <salvador.fuentes@intel.com>
We should refine unit test which involves func SupportsVsocks and newly
reconstructed struct kernelModule.
Fixes: #1512
Signed-off-by: Penny Zheng <penny.zheng@arm.com>
Since we prefer vsock over virtio serial port, we add 'vhost_vsock'
in kernel mosules list.
But vhost_vsock.ko shouldn't be the definitely required kernel modules,
afterall, we could also use virtio serial port.
if kata-env shows SupportsVSocks as false, users could run kata-check
to manually load vhost_vsock.ko and get detailed info(errors)
Fixes: #1512
Signed-off-by: Penny Zheng <penny.zheng@arm.com>
- For initial offering of virtiofsd, hugepages are required
- use the qemu hypervisor type for configuration template
- decrease virtiofs cache size from 8192 to 1024, to better support
running with virtio-fs on smaller machines while hugepages are required.
- For initial experimental release, utilize virtio-serial instead of
vsock
Fixes: #1662
Signed-off-by: Eric Ernst <eric.ernst@intel.com>
NEMU requires a unique runtime configuration. Add support for utilizing
a configuration-nemu.toml
Fixes: #1647
Signed-off-by: Eric Ernst <eric.ernst@intel.com>
It's useful to know whether virtio-9p or virtio-fs is being used. Add
the status to the kata-env output.
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Several cache modes are supported by virtio-fs. They affect the
performance and consistency characteristics of the file system.
For the time being cache="none" is recommended, but the other modes can
be experimented with.
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
