mirror of
https://github.com/containerd/containerd.git
synced 2026-11-06 05:17:02 +00:00
Maksym Pavlenko
423f5e745d
An experimental runc shim that implements the Sandbox API itself, so
that a pod needs no pause container and no pause image. It serves the
io.containerd.runc.v2 runtime type from a separate binary; a runtime
handler selects it with runtime_path and pairs it with the shim
sandboxer:
[plugins."io.containerd.cri.v1.runtime".containerd.runtimes.runc]
runtime_type = "io.containerd.runc.v2"
runtime_path = "/usr/local/bin/containerd-shim-sandboxed-runc-v2"
sandboxer = "shim"
disable_pause_image_pull = true
The shim is the sandbox. On CreateSandbox a locked thread enters the
network namespace CRI created, unshares the pod IPC and UTS namespaces,
sets the hostname and the pod sysctls from inside them, bind-mounts its
namespace files under the bundle and moves back out; the pins keep the
namespaces alive the way CRI keeps the network namespace alive. The shim
writes the pod shared files and mounts the shm tmpfs under its bundle and
returns them as mounts of the sandbox spec, together with the namespace
paths. StartSandbox reports pid 0. The containers of the pod run through
the task service of containerd-shim-runc-v2, wrapped only so that the
task Shutdown RPC, which containerd sends after every task deletion, does
not end the shim while the pod is alive. StopSandbox and "shim delete"
detach the pins and the shm and remove the files without relying on any
state; ShutdownSandbox ends the shim. The runtime info is the runc shim's
minus the user namespace, which the shim does not support yet.
Not supported yet: a shared pod PID namespace (the containers of such a
pod get their own PID namespaces, with a warning), user namespaces,
user.* sysctls, SELinux labels, cgroup v1 and rootless containerd. The
shim decodes the CRI PodSandboxConfig it receives as options; a
containerd owned configuration message is left as a TODO. The binary is
built and installed with the other Linux commands.
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>