mirror of
https://github.com/aljazceru/kata-containers.git
synced 2025-12-26 18:44:47 +01:00
6fcb76cb37
Improve the build to: - Encapsulate the qemu configuration. - Validate the chosen hypervisor. - Display hypervisor details for `make help`. This lays the groundwork to build configurations for multiple hypervisors. Notes: - Variables that are hypervisor specific have now been suffixed with `_QEMU`. - `make install` now installs `configuration-qemu.toml`. To maintain compatibility with existing installations, a symbolic link to this file called `configuration.toml` is created. Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
315 lines
12 KiB
TOML
315 lines
12 KiB
TOML
# Copyright (c) 2017-2019 Intel Corporation
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
|
|
# XXX: WARNING: this file is auto-generated.
|
|
# XXX:
|
|
# XXX: Source file: "@CONFIG_QEMU_IN@"
|
|
# XXX: Project:
|
|
# XXX: Name: @PROJECT_NAME@
|
|
# XXX: Type: @PROJECT_TYPE@
|
|
|
|
[hypervisor.qemu]
|
|
path = "@QEMUPATH@"
|
|
kernel = "@KERNELPATH_QEMU@"
|
|
initrd = "@INITRDPATH@"
|
|
image = "@IMAGEPATH@"
|
|
machine_type = "@MACHINETYPE@"
|
|
|
|
# Optional space-separated list of options to pass to the guest kernel.
|
|
# For example, use `kernel_params = "vsyscall=emulate"` if you are having
|
|
# trouble running pre-2.15 glibc.
|
|
#
|
|
# WARNING: - any parameter specified here will take priority over the default
|
|
# parameter value of the same name used to start the virtual machine.
|
|
# Do not set values here unless you understand the impact of doing so as you
|
|
# may stop the virtual machine from booting.
|
|
# To see the list of default parameters, enable hypervisor debug, create a
|
|
# container and look for 'default-kernel-parameters' log entries.
|
|
kernel_params = "@KERNELPARAMS@"
|
|
|
|
# Path to the firmware.
|
|
# If you want that qemu uses the default firmware leave this option empty
|
|
firmware = "@FIRMWAREPATH@"
|
|
|
|
# Machine accelerators
|
|
# comma-separated list of machine accelerators to pass to the hypervisor.
|
|
# For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
|
|
machine_accelerators="@MACHINEACCELERATORS@"
|
|
|
|
# Default number of vCPUs per SB/VM:
|
|
# unspecified or 0 --> will be set to @DEFVCPUS@
|
|
# < 0 --> will be set to the actual number of physical cores
|
|
# > 0 <= number of physical cores --> will be set to the specified number
|
|
# > number of physical cores --> will be set to the actual number of physical cores
|
|
default_vcpus = 1
|
|
|
|
# Default maximum number of vCPUs per SB/VM:
|
|
# unspecified or == 0 --> will be set to the actual number of physical cores or to the maximum number
|
|
# of vCPUs supported by KVM if that number is exceeded
|
|
# > 0 <= number of physical cores --> will be set to the specified number
|
|
# > number of physical cores --> will be set to the actual number of physical cores or to the maximum number
|
|
# of vCPUs supported by KVM if that number is exceeded
|
|
# WARNING: Depending of the architecture, the maximum number of vCPUs supported by KVM is used when
|
|
# the actual number of physical cores is greater than it.
|
|
# WARNING: Be aware that this value impacts the virtual machine's memory footprint and CPU
|
|
# the hotplug functionality. For example, `default_maxvcpus = 240` specifies that until 240 vCPUs
|
|
# can be added to a SB/VM, but the memory footprint will be big. Another example, with
|
|
# `default_maxvcpus = 8` the memory footprint will be small, but 8 will be the maximum number of
|
|
# vCPUs supported by the SB/VM. In general, we recommend that you do not edit this variable,
|
|
# unless you know what are you doing.
|
|
default_maxvcpus = @DEFMAXVCPUS@
|
|
|
|
# Bridges can be used to hot plug devices.
|
|
# Limitations:
|
|
# * Currently only pci bridges are supported
|
|
# * Until 30 devices per bridge can be hot plugged.
|
|
# * Until 5 PCI bridges can be cold plugged per VM.
|
|
# This limitation could be a bug in qemu or in the kernel
|
|
# Default number of bridges per SB/VM:
|
|
# unspecified or 0 --> will be set to @DEFBRIDGES@
|
|
# > 1 <= 5 --> will be set to the specified number
|
|
# > 5 --> will be set to 5
|
|
default_bridges = @DEFBRIDGES@
|
|
|
|
# Default memory size in MiB for SB/VM.
|
|
# If unspecified then it will be set @DEFMEMSZ@ MiB.
|
|
default_memory = @DEFMEMSZ@
|
|
#
|
|
# Default memory slots per SB/VM.
|
|
# If unspecified then it will be set @DEFMEMSLOTS@.
|
|
# This is will determine the times that memory will be hotadded to sandbox/VM.
|
|
#memory_slots = @DEFMEMSLOTS@
|
|
|
|
# The size in MiB will be plused to max memory of hypervisor.
|
|
# It is the memory address space for the NVDIMM devie.
|
|
# If set block storage driver (block_device_driver) to "nvdimm",
|
|
# should set memory_offset to the size of block device.
|
|
# Default 0
|
|
#memory_offset = 0
|
|
|
|
# Disable block device from being used for a container's rootfs.
|
|
# In case of a storage driver like devicemapper where a container's
|
|
# root file system is backed by a block device, the block device is passed
|
|
# directly to the hypervisor for performance reasons.
|
|
# This flag prevents the block device from being passed to the hypervisor,
|
|
# 9pfs is used instead to pass the rootfs.
|
|
disable_block_device_use = @DEFDISABLEBLOCK@
|
|
|
|
# Block storage driver to be used for the hypervisor in case the container
|
|
# rootfs is backed by a block device. This is virtio-scsi, virtio-blk
|
|
# or nvdimm.
|
|
block_device_driver = "@DEFBLOCKSTORAGEDRIVER_QEMU@"
|
|
|
|
# Specifies cache-related options will be set to block devices or not.
|
|
# Default false
|
|
#block_device_cache_set = true
|
|
|
|
# Specifies cache-related options for block devices.
|
|
# Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
|
|
# Default false
|
|
#block_device_cache_direct = true
|
|
|
|
# Specifies cache-related options for block devices.
|
|
# Denotes whether flush requests for the device are ignored.
|
|
# Default false
|
|
#block_device_cache_noflush = true
|
|
|
|
# Enable iothreads (data-plane) to be used. This causes IO to be
|
|
# handled in a separate IO thread. This is currently only implemented
|
|
# for SCSI.
|
|
#
|
|
enable_iothreads = @DEFENABLEIOTHREADS@
|
|
|
|
# Enable pre allocation of VM RAM, default false
|
|
# Enabling this will result in lower container density
|
|
# as all of the memory will be allocated and locked
|
|
# This is useful when you want to reserve all the memory
|
|
# upfront or in the cases where you want memory latencies
|
|
# to be very predictable
|
|
# Default false
|
|
#enable_mem_prealloc = true
|
|
|
|
# Enable huge pages for VM RAM, default false
|
|
# Enabling this will result in the VM memory
|
|
# being allocated using huge pages.
|
|
# This is useful when you want to use vhost-user network
|
|
# stacks within the container. This will automatically
|
|
# result in memory pre allocation
|
|
#enable_hugepages = true
|
|
|
|
# Enable swap of vm memory. Default false.
|
|
# The behaviour is undefined if mem_prealloc is also set to true
|
|
#enable_swap = true
|
|
|
|
# This option changes the default hypervisor and kernel parameters
|
|
# to enable debug output where available. This extra output is added
|
|
# to the proxy logs, but only when proxy debug is also enabled.
|
|
#
|
|
# Default false
|
|
#enable_debug = true
|
|
|
|
# Disable the customizations done in the runtime when it detects
|
|
# that it is running on top a VMM. This will result in the runtime
|
|
# behaving as it would when running on bare metal.
|
|
#
|
|
#disable_nesting_checks = true
|
|
|
|
# This is the msize used for 9p shares. It is the number of bytes
|
|
# used for 9p packet payload.
|
|
#msize_9p = @DEFMSIZE9P@
|
|
|
|
# If true and vsocks are supported, use vsocks to communicate directly
|
|
# with the agent and no proxy is started, otherwise use unix
|
|
# sockets and start a proxy to communicate with the agent.
|
|
# Default false
|
|
#use_vsock = true
|
|
|
|
# VFIO devices are hotplugged on a bridge by default.
|
|
# Enable hotplugging on root bus. This may be required for devices with
|
|
# a large PCI bar, as this is a current limitation with hotplugging on
|
|
# a bridge. This value is valid for "pc" machine type.
|
|
# Default false
|
|
#hotplug_vfio_on_root_bus = true
|
|
|
|
# If host doesn't support vhost_net, set to true. Thus we won't create vhost fds for nics.
|
|
# Default false
|
|
#disable_vhost_net = true
|
|
#
|
|
# Default entropy source.
|
|
# The path to a host source of entropy (including a real hardware RNG)
|
|
# /dev/urandom and /dev/random are two main options.
|
|
# Be aware that /dev/random is a blocking source of entropy. If the host
|
|
# runs out of entropy, the VMs boot time will increase leading to get startup
|
|
# timeouts.
|
|
# The source of entropy /dev/urandom is non-blocking and provides a
|
|
# generally acceptable source of entropy. It should work well for pretty much
|
|
# all practical purposes.
|
|
#entropy_source= "@DEFENTROPYSOURCE@"
|
|
|
|
# Path to OCI hook binaries in the *guest rootfs*.
|
|
# This does not affect host-side hooks which must instead be added to
|
|
# the OCI spec passed to the runtime.
|
|
#
|
|
# You can create a rootfs with hooks by customizing the osbuilder scripts:
|
|
# https://github.com/kata-containers/osbuilder
|
|
#
|
|
# Hooks must be stored in a subdirectory of guest_hook_path according to their
|
|
# hook type, i.e. "guest_hook_path/{prestart,postart,poststop}".
|
|
# The agent will scan these directories for executable files and add them, in
|
|
# lexicographical order, to the lifecycle of the guest container.
|
|
# Hooks are executed in the runtime namespace of the guest. See the official documentation:
|
|
# https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
|
|
# Warnings will be logged if any error is encountered will scanning for hooks,
|
|
# but it will not abort container execution.
|
|
#guest_hook_path = "/usr/share/oci/hooks"
|
|
|
|
[factory]
|
|
# VM templating support. Once enabled, new VMs are created from template
|
|
# using vm cloning. They will share the same initial kernel, initramfs and
|
|
# agent memory by mapping it readonly. It helps speeding up new container
|
|
# creation and saves a lot of memory if there are many kata containers running
|
|
# on the same host.
|
|
#
|
|
# When disabled, new VMs are created from scratch.
|
|
#
|
|
# Note: Requires "initrd=" to be set ("image=" is not supported).
|
|
#
|
|
# Default false
|
|
#enable_template = true
|
|
|
|
[proxy.@PROJECT_TYPE@]
|
|
path = "@PROXYPATH@"
|
|
|
|
# If enabled, proxy messages will be sent to the system log
|
|
# (default: disabled)
|
|
#enable_debug = true
|
|
|
|
[shim.@PROJECT_TYPE@]
|
|
path = "@SHIMPATH@"
|
|
|
|
# If enabled, shim messages will be sent to the system log
|
|
# (default: disabled)
|
|
#enable_debug = true
|
|
|
|
# If enabled, the shim will create opentracing.io traces and spans.
|
|
# (See https://www.jaegertracing.io/docs/getting-started).
|
|
#
|
|
# Note: By default, the shim runs in a separate network namespace. Therefore,
|
|
# to allow it to send trace details to the Jaeger agent running on the host,
|
|
# it is necessary to set 'disable_new_netns=true' so that it runs in the host
|
|
# network namespace.
|
|
#
|
|
# (default: disabled)
|
|
#enable_tracing = true
|
|
|
|
[agent.@PROJECT_TYPE@]
|
|
# There is no field for this section. The goal is only to be able to
|
|
# specify which type of agent the user wants to use.
|
|
|
|
[netmon]
|
|
# If enabled, the network monitoring process gets started when the
|
|
# sandbox is created. This allows for the detection of some additional
|
|
# network being added to the existing network namespace, after the
|
|
# sandbox has been created.
|
|
# (default: disabled)
|
|
#enable_netmon = true
|
|
|
|
# Specify the path to the netmon binary.
|
|
path = "@NETMONPATH@"
|
|
|
|
# If enabled, netmon messages will be sent to the system log
|
|
# (default: disabled)
|
|
#enable_debug = true
|
|
|
|
[runtime]
|
|
# If enabled, the runtime will log additional debug messages to the
|
|
# system log
|
|
# (default: disabled)
|
|
#enable_debug = true
|
|
#
|
|
# Internetworking model
|
|
# Determines how the VM should be connected to the
|
|
# the container network interface
|
|
# Options:
|
|
#
|
|
# - bridged
|
|
# Uses a linux bridge to interconnect the container interface to
|
|
# the VM. Works for most cases except macvlan and ipvlan.
|
|
#
|
|
# - macvtap
|
|
# Used when the Container network interface can be bridged using
|
|
# macvtap.
|
|
#
|
|
# - none
|
|
# Used when customize network. Only creates a tap device. No veth pair.
|
|
#
|
|
# - tcfilter
|
|
# Uses tc filter rules to redirect traffic from the network interface
|
|
# provided by plugin to a tap interface connected to the VM.
|
|
#
|
|
internetworking_model="@DEFNETWORKMODEL_QEMU@"
|
|
|
|
# disable guest seccomp
|
|
# Determines whether container seccomp profiles are passed to the virtual
|
|
# machine and applied by the kata agent. If set to true, seccomp is not applied
|
|
# within the guest
|
|
# (default: true)
|
|
disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
|
|
|
|
# If enabled, the runtime will create opentracing.io traces and spans.
|
|
# (See https://www.jaegertracing.io/docs/getting-started).
|
|
# (default: disabled)
|
|
#enable_tracing = true
|
|
|
|
# If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
|
|
# This option may have some potential impacts to your host. It should only be used when you know what you're doing.
|
|
# `disable_new_netns` conflicts with `enable_netmon`
|
|
# `disable_new_netns` conflicts with `internetworking_model=bridged` and `internetworking_model=macvtap`. It works only
|
|
# with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
|
|
# (like OVS) directly.
|
|
# If you are using docker, `disable_new_netns` only works with `docker run --net=none`
|
|
# (default: false)
|
|
#disable_new_netns = true
|