mirror of
https://github.com/containerd/containerd.git
synced 2026-11-06 05:17:02 +00:00
Maksym Pavlenko
423f5e745d
An experimental runc shim that implements the Sandbox API itself, so
that a pod needs no pause container and no pause image. It serves the
io.containerd.runc.v2 runtime type from a separate binary; a runtime
handler selects it with runtime_path and pairs it with the shim
sandboxer:
[plugins."io.containerd.cri.v1.runtime".containerd.runtimes.runc]
runtime_type = "io.containerd.runc.v2"
runtime_path = "/usr/local/bin/containerd-shim-sandboxed-runc-v2"
sandboxer = "shim"
disable_pause_image_pull = true
The shim is the sandbox. On CreateSandbox a locked thread enters the
network namespace CRI created, unshares the pod IPC and UTS namespaces,
sets the hostname and the pod sysctls from inside them, bind-mounts its
namespace files under the bundle and moves back out; the pins keep the
namespaces alive the way CRI keeps the network namespace alive. The shim
writes the pod shared files and mounts the shm tmpfs under its bundle and
returns them as mounts of the sandbox spec, together with the namespace
paths. StartSandbox reports pid 0. The containers of the pod run through
the task service of containerd-shim-runc-v2, wrapped only so that the
task Shutdown RPC, which containerd sends after every task deletion, does
not end the shim while the pod is alive. StopSandbox and "shim delete"
detach the pins and the shm and remove the files without relying on any
state; ShutdownSandbox ends the shim. The runtime info is the runc shim's
minus the user namespace, which the shim does not support yet.
Not supported yet: a shared pod PID namespace (the containers of such a
pod get their own PID namespaces, with a warning), user namespaces,
user.* sysctls, SELinux labels, cgroup v1 and rootless containerd. The
shim decodes the CRI PodSandboxConfig it receives as options; a
containerd owned configuration message is left as a TODO. The binary is
built and installed with the other Linux commands.
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
35 lines
1.0 KiB
Makefile
35 lines
1.0 KiB
Makefile
# Copyright The containerd Authors.
|
|
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
|
|
#linux specific settings
|
|
WHALE="+"
|
|
ONI="-"
|
|
COMMANDS += containerd-shim-runc-v2
|
|
COMMANDS += containerd-shim-sandboxed-runc-v2
|
|
|
|
# check GOOS for cross compile builds
|
|
ifeq ($(GOOS),linux)
|
|
ifneq ($(GOARCH),$(filter $(GOARCH),mips mipsle mips64 mips64le ppc64 loong64))
|
|
ifeq ($(STATIC),)
|
|
GO_GCFLAGS += -buildmode=pie
|
|
endif
|
|
endif
|
|
endif
|
|
|
|
# amd64 supports go test -race
|
|
ifeq ($(GOARCH),amd64)
|
|
TESTFLAGS_RACE= -race
|
|
endif
|