[feature] add support of a runc sandboxer #94

abel-von · 2023-09-14T09:32:17Z

A remote runc sandboxer which will run a process in seperate namespaces and this process will serve the Task API by a unix domain socket, and this process will also be the process to carry the common namespaces of containers in the same pod. so that we don't have a pause process, the "shim" process will act as the "pause" process

xiaods · 2023-09-18T03:28:36Z

any update on it?

abel-von · 2023-09-19T08:50:27Z

Maybe we will have a community meeting next week to discuss the design. @xiaods

xiaods · 2023-09-23T02:55:47Z

Maybe we will have a community meeting next week to discuss the design. @xiaods

any update on it?

xiaods · 2023-09-29T09:04:15Z

Maybe we will have a community meeting next week to discuss the design. @xiaods

any update on this community meeting?

Burning1020 · 2023-09-29T13:00:54Z

Maybe we will have a community meeting next week to discuss the design. @xiaods

any update on this community meeting?

Sorry, Abel has been working for the Kubecon China, should we have it after this vocation? @abel-von Do you have time?

xiaods · 2023-09-30T02:29:11Z

Maybe we will have a community meeting next week to discuss the design. @xiaods

any update on this community meeting?

Sorry, Abel has been working for the Kubecon China, should we have it after this vocation? @abel-von Do you have time?

I just want to learn about the latest project progress and it doesn't matter about the time. I also need more time to understand this project, so there is no need to worry about time pressure. Thank you.

abel-von · 2023-10-17T12:24:46Z

We will follow this design to make a runc sandboxer

xiaods · 2023-11-05T07:01:19Z

@abel-von if the runc sandboxer feature is implemented, can I replace the containerd with the kuasar component?

xiaods · 2023-11-17T10:51:46Z

any update?

xiaods · 2023-11-19T09:19:00Z

runc/src/exitsnoop.c

+{
+    struct task_struct *task = (typeof(task)) bpf_get_current_task();
+    struct process_exit_data_t data = {};
+    //data.start_time = PROCESS_START_TIME_NS,


What does this line of code mean? If it's not necessary, it can be removed.

Burning1020 · 2023-11-20T01:40:10Z

any update?

The code is basically complete but still needs some time.

Burning1020

File Header and CI are needed, the other comment could be resolved in follow up.

Burning1020 · 2023-12-06T03:24:36Z

runc/src/exitsnoop.c

@@ -0,0 +1,36 @@
+#include<linux/sched.h>


Need CopyRight file header.

new version removed the eBPF file

Burning1020 · 2023-12-06T03:25:41Z

runc/src/exitsnoop.rs

@@ -0,0 +1,64 @@
+use bcc::{BPF, Tracepoint};


I think we also shoule update CI workflow to test runc package.

new version removed the eBPF file

Burning1020 · 2023-12-06T03:39:48Z

runc/src/main.rs

+mod exitsnoop;
+
+pub const TASK_ADDRESS_SOCK: &str = "/run/kuasar/task.sock";
+const DEFAULT_CONTAINERD_STATE_DIR: &str = "/run/containerd/";


Should BOUDLE_DIR be better? Runc sandboxer does not care about what exactly the container engine is, it only care about the bundle dir of container.

codes removed of the new version

Burning1020 · 2023-12-06T06:13:08Z

runc/src/sandbox.rs

+        }
+        let log_pipe = format!("{}/log", self.base_dir);
+        unsafe {
+            mkfifo(&*log_pipe, Mode::from_bits_unchecked(0700))


nix::unistd::mkfifo

codes removed

Burning1020 · 2023-12-06T06:35:18Z

runc/src/sandbox.rs

+        }
+        let child = cmd
+            .spawn()
+            .map_err(|e| anyhow!("failed to spawn shim {}", e))?;


spawn runc sandbox parent

codes removed

Burning1020 · 2023-12-06T06:45:22Z

runc/task/src/runc.rs

+
+pub async fn copy_io(pio: &ProcessIO, stdio: &Stdio, exit_signal: Arc<ExitSignal>) -> Result<()> {
+    if !pio.copy {
+        return Ok(());


Should open the read end of fifo.

Burning1020 · 2023-12-06T06:50:56Z

We also have to provide a make command for building.

flyflypeng · 2023-12-07T02:32:29Z

We will follow this design to make a runc sandboxer

I think it's necessary to update this architecture diagram corresponding to the runc sandboxer in the README.md and provide additional details about the design."

Signed-off-by: Abel Feng <[email protected]>

flyflypeng · 2023-12-07T09:17:18Z

runc/src/main.rs

+            loop {
+                let buffer = read_count(reqr, 512).unwrap();
+                let id = String::from_utf8_lossy(&buffer[0..64]).to_string();
+                let mut zero_index = 64;


what's the meaning of the 64, a static const maybe suitable

runc/src/main.rs

flyflypeng · 2023-12-07T09:29:24Z

runc/src/main.rs

+            close(reqw).unwrap_or_default();
+            close(respr).unwrap_or_default();
+            prctl::set_child_subreaper(true).unwrap();
+            let comm = format!("[sandbox-parent]");


I find the naming convention for sandbox-parent somewhat ambiguous, conflicting with the naming convention of kernel threads in the Linux system.

I just want to to highlight the process as a special process, do you have any good suggestion?

I think it's sufficient to distinguish using the unique process name directly, there's no need to add square brackets.

flyflypeng · 2023-12-07T09:30:14Z

runc/src/main.rs

+                    exit(0);
+                }
+                ForkResult::Child => {
+                    let comm = format!("[sandbox-{}]", id);


Same as before, naming convention is confused with kernel threads.

Signed-off-by: Abel Feng <[email protected]>

Burning1020

lgtm

abel-von requested a review from a team as a code owner September 14, 2023 09:32

abel-von force-pushed the support-runc-for-shim branch from f04a84c to b9c97a8 Compare September 14, 2023 09:34

xiaods mentioned this pull request Sep 17, 2023

Support for runc container #83

Closed

xiaods reviewed Nov 19, 2023

View reviewed changes

Burning1020 reviewed Dec 6, 2023

View reviewed changes

abel-von force-pushed the support-runc-for-shim branch from b9c97a8 to 353536e Compare December 6, 2023 16:45

abel-von requested review from a team as code owners December 7, 2023 02:47

flyflypeng closed this Dec 7, 2023

flyflypeng reopened this Dec 7, 2023

abel-von added 6 commits December 7, 2023 11:57

runc: support runc sandboxer

e14c165

Signed-off-by: Abel Feng <[email protected]>

runc: support get runc command error from log

f389f6e

Signed-off-by: Abel Feng <[email protected]>

runc: fork a process as the sandbox process

8b0dabe

Signed-off-by: Abel Feng <[email protected]>

runc: use early fork as parent sandbox process

f8da0c4

Signed-off-by: Abel Feng <[email protected]>

runc: use a unique task server to serve all task api

5e7f958

Signed-off-by: Abel Feng <[email protected]>

runc: add restart recovery

c6ff817

Signed-off-by: Abel Feng <[email protected]>

abel-von added 2 commits December 7, 2023 11:59

runc: use double fork to make a seperate pid ns

4e5c919

Signed-off-by: Abel Feng <[email protected]>

runc: keep sandbox process only when share pid

b5b6b54

Signed-off-by: Abel Feng <[email protected]>

abel-von force-pushed the support-runc-for-shim branch from 6dbd861 to 121951d Compare December 7, 2023 04:06

flyflypeng reviewed Dec 7, 2023

View reviewed changes

abel-von force-pushed the support-runc-for-shim branch 2 times, most recently from 4e5874e to 228d3a9 Compare December 7, 2023 11:39

runc: add copyright and CI scripts

d0bd129

Signed-off-by: Abel Feng <[email protected]>

abel-von force-pushed the support-runc-for-shim branch from 228d3a9 to d0bd129 Compare December 7, 2023 11:50

Burning1020 approved these changes Dec 9, 2023

View reviewed changes

Burning1020 merged commit 5b5a02d into kuasar-io:main Dec 10, 2023
15 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[feature] add support of a runc sandboxer #94

[feature] add support of a runc sandboxer #94

abel-von commented Sep 14, 2023

xiaods commented Sep 18, 2023

abel-von commented Sep 19, 2023

xiaods commented Sep 23, 2023

xiaods commented Sep 29, 2023

Burning1020 commented Sep 29, 2023

xiaods commented Sep 30, 2023

abel-von commented Oct 17, 2023

xiaods commented Nov 5, 2023

xiaods commented Nov 17, 2023

xiaods Nov 19, 2023

Burning1020 commented Nov 20, 2023

Burning1020 left a comment

Burning1020 Dec 6, 2023

abel-von Dec 7, 2023

Burning1020 Dec 6, 2023

abel-von Dec 7, 2023

Burning1020 Dec 6, 2023

abel-von Dec 7, 2023

Burning1020 Dec 6, 2023

abel-von Dec 7, 2023

Burning1020 Dec 6, 2023

abel-von Dec 7, 2023

Burning1020 Dec 6, 2023

Burning1020 commented Dec 6, 2023

flyflypeng commented Dec 7, 2023

flyflypeng Dec 7, 2023

flyflypeng Dec 7, 2023

abel-von Dec 7, 2023

flyflypeng Dec 8, 2023

flyflypeng Dec 7, 2023

Burning1020 left a comment

[feature] add support of a runc sandboxer #94

[feature] add support of a runc sandboxer #94

Conversation

abel-von commented Sep 14, 2023

xiaods commented Sep 18, 2023

abel-von commented Sep 19, 2023

xiaods commented Sep 23, 2023

xiaods commented Sep 29, 2023

Burning1020 commented Sep 29, 2023

xiaods commented Sep 30, 2023

abel-von commented Oct 17, 2023

xiaods commented Nov 5, 2023

xiaods commented Nov 17, 2023

Choose a reason for hiding this comment

Burning1020 commented Nov 20, 2023

Burning1020 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Burning1020 commented Dec 6, 2023

flyflypeng commented Dec 7, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Burning1020 left a comment

Choose a reason for hiding this comment