This makes fixing errors easier. Before this commit, errors looked
like [1]:
$ make gofmt
!!! 'gofmt -s' needs to be run on the following files:
./lib/config.go
make: *** [gofmt] Error 1
But that's not very helpful when your local gofmt thinks the file is
fine. With this commit, errors will look like:
$ make gofmt
find . -name '*.go' ! -path './vendor/*' -exec gofmt -s -w {} \+
git diff --exit-code
diff --git a/lib/config.go b/lib/config.go
index 1acca8c7..6a63b2b0 100644
--- a/lib/config.go
+++ b/lib/config.go
@@ -2,7 +2,7 @@ package lib
import (
"bytes"
-"io/ioutil"
+ "io/ioutil"
"github.com/BurntSushi/toml"
"github.com/kubernetes-incubator/cri-o/oci"
make: *** [Makefile:68: gofmt] Error 1
(or whatever, I just stuffed in a formatting error for demonstration
purposes).
Also remove the helper script in favor of direct Makefile calls,
because with Git handling difference reporting and exit status, this
becomes a simpler check. find's -exec, !, and -path arguments are
specified in POSIX [2].
[1]: https://travis-ci.org/kubernetes-incubator/cri-o/jobs/331949394#L1075
[2]: http://pubs.opengroup.org/onlinepubs/9699919799/utilities/find.html
Signed-off-by: W. Trevor King <wking@tremily.us>
The last consumer was removed in 1bf6d203 (Remove kpod code after
repository move, 2017-11-02, #1111).
Signed-off-by: W. Trevor King <wking@tremily.us>
Having a separate function holding the details of this makes reading
createSandboxContainer easier.
While I was moving the code, I've also cleaned up two things:
* The nil capabilities check is now earlier, where before it had been
between the ALL handling and the non-ALL handling.
* I've added a capPrefixed variable to avoid having multiple
toCAPPrefixed calls per capability.
Signed-off-by: W. Trevor King <wking@tremily.us>
Avoid crashing 'make' with:
No package 'devmapper' found
by disabling the devmapper driver when the library it requires is not
installed. Also give the libdm_no_deferred_remove script a more
specific name to avoid confusion.
Signed-off-by: W. Trevor King <wking@tremily.us>
Catching up with the Dockerfile change from f51b0a10 (Dockerfile: move
to containernetworking/plugins, 2017-05-25, #536). The new plugins
commit from f51b0a10 is still the current Dockerfile entry.
This commit also replaces the previous 'go get' call with a git clone
to match the Dockerfile's approach. I've added an additional 'cd'
call so I don't have to repeat $GOPATH/... more than once, but other
than that, the example matches the current Dockerfile entry.
I've also removed some line-continuation slashes we've been dragging
around since the section landed 07ccda33 (tests: Install CNI
configuration files by default, 2017-04-06, #434). I'm guessing they
were a copy/paste bug from the Dockerfile, but this example has new
prompts for each command (so it doesn't need continuation) while the
Dockerfile is using && chaining (so it does).
Signed-off-by: W. Trevor King <wking@tremily.us>
The cri-o entries are stale vs. the content currently installed by the
Makefile. This commit drops them and just references the make call
before starting the table, which lets us stay DRY.
runc is not built from the cri-o repository. The docs have claimed it
was since 983aec63 (doc: Add instruction to run cri-o with kubernetes,
2017-01-31, #353), but it's independent like the CNI plugins.
The CNI plugins were moved to containernetworking/plugins in
containernetworking/cni@bc0d09e (plugins: moved to
containernetworking/plugins, 2017-05-17, containernetworking/cni#457).
I've added a link to the in-repo policy.json example. We probably
also want to link to the docs (for the version we vendor?) [1], but
I've left that alone for now.
The CNI config examples were removed from the project README in
9088a12c (contrib: cni: provide example CNI configurations,
2016-12-24, #295). I've adjusted the reference to point to the new
location, although again, I'd rather replace this with links to
upstream docs.
[1]: 3d0304a021/docs/policy.json.md
Signed-off-by: W. Trevor King <wking@tremily.us>
'make install' hasn't installed crio.conf since 8b632729 (Install to
/usr/local to avoid conflicts with vendor binaries, 2017-01-04, #304).
And Make output is usually not particularly interesting.
Signed-off-by: W. Trevor King <wking@tremily.us>
install.config has also installed rio-umount.conf since 51b225474
(Tell oci-umount where to remove mountpoints inside container, #937,
2017-09-21). And Make output is usually not particularly interesting.
Signed-off-by: W. Trevor King <wking@tremily.us>
Where the same user had multiple entries, I mostly went with whichever
entry had the most-recent non-merge commits.
The order is alphabetical according to Emacs' sort-lines.
Signed-off-by: W. Trevor King <wking@tremily.us>
And changed the name of their binary. This commit catches the docs up
with intel/cc-oci-runtime#1065 (merged 2017-09-25).
Signed-off-by: W. Trevor King <wking@tremily.us>
If a packager wants to be able to support addititional arguments on his
hook this will allow them to setup the configuration with these arguments.
For example this would allow a hook developer to add support for a --debug
flag to change the level of debugging in his hook.
In order to complete this task, I had to vendor in the latest
github.com://opencontainers/runtime-tools, which caused me to have to fix a
Mount and Capability interface calls
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Instead of compiling all of the *.go files each time, the
-i flag will cause them to be only compiled if they changed.
This will make developers much happier.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Build image for integration test on arm64 will fail for lack of
hexdump. Add bsdmainutils tool to eliminate that failure and let
build image succussfully
Signed-off-by: Jianyong Wu <jianyong.wu@arm.com>
Should fix a possible deadlock in, at least, ListPodSandbox.
There seems to be no reason to hold stateLock when doing operations on
the memory_store for containers and sandboxes.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Install atomic-registries to get a /etc/containers/registries.conf file,
so that we can resolve image names that don't include domain portions.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
We can pass the "listImage should get exactly 2 repoTags in the result
image" test now, so we no longer need to skip it.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Add python-rhsm-certificates to the list of packages that we require, so
that the required certificates are available for the
pull-image-with-signature tests.
Add per-distribution package install tasks so that we install either
python2-boto or python-boto, depending on whether we're running on
Fedora or RHEL/CentOS, respectively.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Replace instances of "ansible_eth0.ipv4.address" with
"ansible_default_ipv4.address" in the integration test playbook, so that
we can run tests without depending on the name of the primary network
interface being "eth0".
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
If server/Server.createSandboxContainer() fails after calling
server/Server.StorageRuntimeServer().CreateContainer(), cleanup logic in
server/Server.CreateContainer() won't try to clean it up, but we still
need to clean up the on-disk container and its layer.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Have ResolveNames() check if the value that it's been given is a
truncated version of the ID of a locally-available image, and if it is,
return the value as it was given.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Add an UntagImage() method to pkg/storage/ImageServer, which will check
if the passed-in NameOrID is a name. If so, it merely removes that name
from the image, removing the image only if it was the last name that the
image had. If the NameOrID is an image ID, the image is removed, as
RemoveImage() does.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
The image's canonical reference is a name with a digest of the image's
manifest, so in imageService.ImageStatus() and
imageService.ListImages(), divide the image's name list into tagged and
digested values, and if we have names, add canonical versions.
In Server.ContainerStatus(), return the image name as it was given to us
as the image, and the image digested reference as the image reference.
In Server.ListImages(), be sure to only return tagged names in the
RepoTags field. In Server.ImageStatus(), also return canonical
references in the RepoDigests field.
In Server.PullImage(), be sure that we consistently return the same
image reference for an image, whether we ended up pulling it or not.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
github.com/containers/image/types.ImageReference.NewImage() can take a
*github.com/containers/image/types.SystemContext now, so pass it one if
pkg/storage/imageService.CanPull() has one to give it.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Bump containers/image to 3d0304a02154dddc8f97cc833aa0861cea5e9ade, and
containers/storage to 0d32dfce498e06c132c60dac945081bf44c22464.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Some oci runtimes may used stderr for logging. Cri-o should not try to
parse this output as json when calling the "state" command.
Signed-off-by: Nicolas Lacasse <nlacasse@google.com>
Under some slow environment (nested VMs) or with some
not as fast runtimes (Clear Containers), asking for a
status right away is racy.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
I don't believe the files in this dir are actually used anymore. Remove
them so content can be added to this directory in the future w/o
clashing.
Signed-off-by: Chris Evich <cevich@redhat.com>
This allows us to cache a k8s branch for cri-o 1.0 branch
while allowing overriding of k8s branch in master and other
newer cri-o branches.
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
The tests are trying to read an write configuration files and check that the
fields are being set or saved properly.
A folder fixtures/ was created on server/ as well adding an example crio.conf
file to it.
Note: some extra paths about Vagrant and VSCode were added to gitignore.
Signed-off-by: Álex González <agonzalezro@gmail.com>
Update vendor/github.com/vbatts/tar-split to v0.10.2, to fix
CVE-2017-14992, per https://github.com/vbatts/tar-split/pull/42.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Depending on the state of upstream repositories, it's possible the
kubernetes repo could change between the ``setup`` and ``run`` phase.
Alternatively, something during ``setup`` itself could mangle the repo.
Add an option to force clone the kubernetes repo. This gives support
for testing on multiple CRI-O branches, realizing some benefit from
caching, yet also allows hauling in brand-new-kubernetes for the e2e
tests.
Signed-off-by: Chris Evich <cevich@redhat.com>
kpod removal actually removed all man1 docs but the Makefile was still
referencing man1 stuff. CRI-O doesn't have man1 so let's drop that
altogether now.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
* Skip some tests if the bridge-custom plugin is
unavailable. This CNI plugin is not distributed in
any RPM, it is only available by compiling from a
side branch in runcom's private github. We can't
use it in a real integration-test setting.
* Don't use `run()` inside cleanup handlers. It will
override $status, which is a double whammy:
- successful cleanup will mask a test failure
- when a test is `skip()`ed, crictl may fail,
and $status will indicate failure.
* seccomp test: use existing $SECCOMP_PROFILE instead of
assuming a path under $CRIO_ROOT
Signed-off-by: Ed Santiago <santiago@redhat.com>
Tests for kpod create and run were failing because the conmon
binary was being hardcoded. We added a --conmon global optioni
for kpod so we could pass in the conmon path from the helpers
file during tests
Signed-off-by: baude <bbaude@redhat.com>
Add the ability to run create a container with kpod. Also, be able to run
(create and start) a container. If the user asks for -it, be able to
attach a terminal to the container.
Signed-off-by: baude <bbaude@redhat.com>
Add kpod-run/kpod-create man page and command completions
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This patch implements the ability to create and run containers
using kpod
Signed-off-by: Matthew Heon <mheon@redhat.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Add an UntagImage() method to pkg/storage/ImageServer, which will check
if the passed-in NameOrID is a name. If so, it merely removes that name
from the image, removing the image only if it was the last name that the
image had. If the NameOrID is an image ID, the image is removed, as
RemoveImage() does.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
The image's canonical reference is a name with a digest of the image's
manifest, so compute and return that value as the image's reference in
ImageStatus() and in ContainerStatus().
We don't auto-store a name based on the image digest when we pull one by
tag, but then CRI doesn't need us to do that.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Since we've got stable image IDs now, pushing an image from local
storage to local storage ends up attaching the both names to a single
image, so we need to update the test's expectations.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
The updated containers/image and containers/storage don't require as
many workarounds to be able to push images.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Update to proposed changes in containers/image, and bump
containers/storage to 04ad0b827097209ca65e59b5fd768511f3b1ae91, which is
currently the tip of the master branch.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
This will avoid the goroutines leak we've been seeing during
performance tests. Goroutines count returns to normal after containers
cleanup.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
This will release the MCS Label to be used again. Only do this if we
don't have another sandbox using the same label.
Also vendor in the latest selinux go bindings, which fixes a leak and
properly reserves the SELinux label we are going to use.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Rename our $STORAGE_OPTS variable to $STORAGE_OPTIONS, so that the
storage library doesn't try to use its contents as default driver
options.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Remove the directory named by "$MOUNT_PATH", not "MOUNT_PATH".
Run "cat /proc/mounts" instead of "mount" in the test container.
Run "grep" using the "run" helper when we want to capture its output.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
When initializing a Runtime, set the default Store for the
containers-storage transport in the image library to the same one that
we're using, so that the calling process sees the same set of images
in the Runtime that it sees when going through the image library.
Update the kpod_push test so that it no longer has to specify a location
in the destination image reference, since the default should already be
passed to kpod as global options.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
In the config file (/etc/crio/crio.conf) installed by `make install.config` , runc runtime path is specified "/usr/bin/runc"
Signed-off-by: Masatoshi Hayashi <literalice@monochromeroad.com>
This patch fixes exec to use the original (start-time) process exec
configuration. Otherwise, we were creating a brand new spec process w/o
additional groups for instance.
Spotted while integrating CRI-O with cri-test...The test was failing
with:
```
• Failure [10.640 seconds]
[k8s.io] Security Context
/home/amurdaca/go/src/github.com/kubernetes-incubator/cri-tools/pkg/framework/framework.go:72
bucket
/home/amurdaca/go/src/github.com/kubernetes-incubator/cri-tools/pkg/validate/security_context.go:407
runtime should support SupplementalGroups [It]
/home/amurdaca/go/src/github.com/kubernetes-incubator/cri-tools/pkg/validate/security_context.go:272
Expected
<[]string | len:1, cap:1>: ["0"]
to contain element matching
<string>: 1234
```
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Determine if selinux is available before building cri-o with support.
Don't add ostree support to crio or any tools other then kpod.
cri-o does not use ostree.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
If the playbook is run multiple times or a host already has
swap configured, re-adding swap over the existing file
will cause untold problems. Also, it will not persist across
reboots unless added to fstab.
Avoid this by checking if any swap is active. If not
create a unique swapfile and format it. Then enable
it to persist across reboots.
Signed-off-by: Chris Evich <cevich@redhat.com>
Tested on a REHL box and found out that the mounts were not showing up
Had a logic flaw, where if the mount was "host:container"
Was setting the mount source to "host" and destination to "ctrRunDir/container"
When instead, the mount source should be "ctrRunDir/container" and destination "container"
with the data copied from "host" to "ctrRunDir/container"
Signed-off-by: umohnani8 <umohnani@redhat.com>
New network test makes improper assumptions about conmon path.
Use predefined CONMON_BINARY variable instead.
Signed-off-by: Ed Santiago <santiago@redhat.com>
Update our vendored copy of golang.org/x/sys to version
9aade4d3a3b7e6d876cd3823ad20ec45fc035402 to get the new Major() and
Minor() helpers.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
We should not error when we try to find a pod ID in a filtered
list of sandboxes; instead we should return an empty struct
and log it.
This fixes another cri-test failure.
Signed-off-by: baude <bbaude@redhat.com>
Container/storage has been enhanced to speed up the compiling and loading
of json files. This should make make cri-o a little bit faster.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
We now can pass 37/55 tests with this PR. Remaining tests include may be fixed
with 1.8.
[Fail] [k8s.io] Security Context bucket [It] runtime should support RunAsUserName
[Fail] [k8s.io] Security Context NamespaceOption [It] runtime should support HostPID
[Fail] [k8s.io] PodSandbox runtime should support sysctls [It] should support unsafe sysctls
[Fail] [k8s.io] PodSandbox runtime should support basic operations on PodSandbox [It] runtime should support removing PodSandbox [Conformance]
[Fail] [k8s.io] Streaming runtime should support streaming interfaces [It] runtime should support portforward [Conformance]
[Fail] [k8s.io] Security Context SeccompProfilePath [It] runtime should not support a custom seccomp profile without using localhost/ as a prefix
[Fail] [k8s.io] Image Manager [It] listImage should get exactly 2 repoTags in the result image [Conformance]
[Fail] [k8s.io] PodSandbox runtime should support sysctls [It] should support safe sysctls
[Fail] [k8s.io] Security Context NoNewPrivs [It] should not allow privilege escalation when true
[Fail] [k8s.io] Security Context SeccompProfilePath [It] runtime should support an seccomp profile that blocks setting hostname with SYS_ADMIN
[Fail] [k8s.io] Container runtime should support mount propagation [It] mount with 'rslave' should support propagation from host to container
[Fail] [k8s.io] Container runtime should support mount propagation [It] mount with 'rshared' should support propagation from host to container and vice versa
[Fail] [k8s.io] Networking runtime should support networking [It] runtime should support port mapping with host port and container port [Conformance]
[Fail] [k8s.io] Security Context SeccompProfilePath [It] should support seccomp localhost/profile on the container
[Fail] [k8s.io] Container runtime should support log [It] runtime should support starting container with log [Conformance]
[Fail] [k8s.io] Security Context bucket [It] runtime should support RunAsUser
[Fail] [k8s.io] Security Context bucket [It] runtime should support SupplementalGroups
[Fail] [k8s.io] Security Context SeccompProfilePath docker/default [It] should support seccomp docker/default on the container
Signed-off-by: baude <bbaude@redhat.com>
It always fails because conmon is still there.
But more importantly it adds a 2 seconds delay to the container
creation as we're trying to delete a cgroup but we can't.
With this patch a container creation is down to typically less than
150ms instead of 2+ seconds.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
The bats "run" helper function sets "$status", so there's no point to
checking the value of "$status" when we haven't used the "run" helper to
run a command, and we almost always want to be checking the value after
we have used the helper.
There's no need to run commands like 'sleep' or 'rm -f' with the helper,
since they're not expected to fail, and if they do, it's probably
indicative of a larger problem that we want to allow to cause tests to
fail.
Helper functions like start_crio already check "$status" when they call
"run", so we don't need to check it again after they return.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
In the kpod-stop-by-name test, use 'kpod inspect' to look up the name of
the container, rather than predicting the name that crio will assign.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Allows the user to define secret paths in /etc/containers/mounts.conf
These are then volume mounted into the container
Signed-off-by: umohnani8 <umohnani@redhat.com>
For commands that ask for JSON results, if the input to the Go JSON
marshaller is empty, it will return a byte array with a literal
"null" in it. If that is the case, we should output [] instead
as at least that is valid JSON and will not break consumers of the
data.
Signed-off-by: baude <bbaude@redhat.com>
This package is used in authenticating a user for kpod login
and can be used for authentication in kpod push, pull etc.
Signed-off-by: umohnani8 <umohnani@redhat.com>
When running the test suite interactively, "Connect to pod
hostport from the host" test hangs because nc thinks it's
got a bidirectional connection. Running with </dev/null
closes the connection after receiving the expected data,
letting the tests proceed.
This is just a suggestion for n00b-friendliness. Running
interactively is rare, but it's exactly where a n00b
will begin, and the hang costs a little time and energy
to track down.
Signed-off-by: Ed Santiago <santiago@redhat.com>
The change in flag from debug to log-level was causing cri-o to fail when started
There was a reference to the debug flag in kpod/main.go that had not been changed
Signed-off-by: umohnani8 <umohnani@redhat.com>
Refactored rmi, images, diff, and history.
Made fixes to kpod images in the way it was handing the templates as well as printing the image names
Signed-off-by: umohnani8 <umohnani@redhat.com>
Add a man page on how to achieve the same user experience as using
kpod attach by using either the kpod logs or kpod exec commands.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
We have to call hack/local-up-cluster from kubernetes directory
as it makes relative calls to cluster/kubectl.sh. The failure
of these calls led to kube-dns not coming up.
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
Running crio with -debug is very verbose. Having more granularity
on the log level can be useful when e.g. only looking for errors.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Under very heavy loads (e.g. 100 pods created at the same time), VM
based runtimes can take more than 10 seconds to create a pod.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
When cri-o assumes the container creation failed, we need to let the
runtime know that we're bailing out so that it cancels all ongoing
operation.
In container creation timeout situations for example, failing to
explictly request the runtime for container deletion can lead to large
resource leaks as kubelet re-creates a failing container, while the
runtime finishes creating the previous one(s).
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Set the exitsdir for kpod back to /var/run/crio... so kpod can benefit
from the container exit file.
Because 0 is the int32 blank value, kpod needs its own container state
struct with the omitempty removed so it can actually display 0 in
its default json output.
Signed-off-by: baude <bbaude@redhat.com>
When a user enters a CLI with a StringFlags or StringSliceFlags and does not add
a value the CLI mistakently takes the next option and uses it as a value.
This usually ends up with an error like not enough options or others. Some times
it could also succeed, with weird results. This patch looks for any values that
begin with a "-" and return an error.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Remove duplicate definitions of storage-related flags for kpod, since
we set them in helpers.bash now, and the other locations that were
also setting it were doing so after loading the definitions in
helpers.
* Set kpod storage flags after checking if we need to force use of the
"vfs" storage driver for cri-o, to make sure kpod also ends up with
the same override if we're using one.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Move kpod tests from kpod.bats to kpod_[commandname].bats
Also make sure all status checks have a echo $output before them.
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: umohnani8 <umohnani@redhat.com>
Packages are no longer available to build on RHEL and CentOS and
btrfs is not longer supported, so we should not build with it.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
When running cri-tests with cri-o, I found out that cri-o panicked
immediately with the following message. Fix it by accessing to the
labels map only if it's non-nil.
```
panic: assignment to entry in nil map
goroutine 57 [running]:
.../cri-o/server.(*Server).RunPodSandbox(0xc42048e000, 0x7efcad4cd400,
0xc42066ec90, 0xc4201703d0, 0x0, 0x0, 0x0)
.../cri-o/server/sandbox_run.go:225 +0xda5
.../cri-o/vendor/k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime
._RuntimeService_RunPodSandbox_Handler(0x21793e0, 0xc42048e000,
0x7efcad4cd400, 0xc42066ec90, 0xc4204fe780, 0x0, 0x0, 0x0, 0x0, 0x0)
.../cri-o/vendor/k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime/api.pb.go:3645 +0x279
.../cri-o/vendor/google.golang.org/grpc.(*Server).processUnaryRPC(0xc420
09e3c0, 0x33e79c0, 0xc4203d1950, 0xc42080a000, 0xc4202bb980, 0x33b1d58,
0xc42066ec60, 0x0, 0x0)
.../cri-o/vendor/google.golang.org/grpc/server.go:638 +0x99c
```
Signed-off-by: Dongsu Park <dongsu@kinvolk.io>
Previously the wrapper changed to $WORKSPACE prior to executing
the ansible-playbook command. This has the unintended consequence of
preventing use of relative paths. Fix this by using absolute paths in
wrapper script instead of changing directories.
Signed-off-by: Chris Evich <cevich@redhat.com>
It's unsightly and hard to maintain collections of references and long
lists across multiple playbooks/include files. Centralize them all
in ``vars.yml``, then include that in all plays.
Minor: Update all files with a newline at the start and end.
Signed-off-by: Chris Evich <cevich@redhat.com>
Add a playbook to pull down the integration and e2e testing
logs/xml. By default they will appear in a 'artifacts' subdirectory
of wherever the ``results.yml`` playbook lives. If the ``$WORKSPACE``
env. var is set and non-empty, the subdirectory will be created
there instead.
Inside the ``artifacts`` directory, further sub-directories are created,
one for each subject's Ansible inventory name. Within those
sub-directories are all the collected logs from that host. In this way,
automation may simply archive the entire 'artifacts' directory to
capture the important log files.
(Depends on PR #935)
Signed-off-by: Chris Evich <cevich@redhat.com>
Processing node-e2e.log into jUnit format is insane, it's chock-full of
terminal escape codes. They would either need to be scraped/removed or
disabled somehow. Instead, take advantage of ``e2e.go --report-dir=``
option. This will cause it to store native jUnit results in the
specified directory for later collection. The jUnit results are also
needed for the google test grid.
Signed-off-by: Chris Evich <cevich@redhat.com>
When run by hand, it's much easier to spot things going wrong when
they're colored in red. Add an ansible.cfg to make that happen. This
also sets a default output log file (``$ARTIFACTS/main.log``) - that
doesn't contain color-codes.
When executing against multple hosts, the output can sometimes become
difficult to read, esp. with lots of async. tasks. The callback_plugin
script reorganizes how the console and log is organized, making it
clearer which host did what and when.
Signed-off-by: Chris Evich <cevich@redhat.com>
Allow overriding CRIO_CNI_PLUGIN (default: /opt/cni/bin) and
make sure it gets written to our crio.conf file. This is
intended for running cri-o tests with containernetworking-cni
rpm which installs into /usr/libexec/cni
Signed-off-by: Ed Santiago <santiago@redhat.com>
There are no tasks that we need to run after the suite has finished,
like we do with the integration suite, so it does not make sense to
ignore the errors coming out of the e2e suite.
Signed-off-by: Steve Kuznetsov <skuznets@redhat.com>
runc has a `--no-pivot` flag, that uses MS_MOVE instead.
This patch set bubbles up a runtime config to enable using no-pivot
globally.
Signed-off-by: Vincent Batts <vbatts@hashbangbash.com>
Where `make install` still has the same behaviour, but you could instead
only `make install.bin` if you don't need the man pages.
Signed-off-by: Vincent Batts <vbatts@hashbangbash.com>
Implement the ability to pause and unpause running containers.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
This patch set add crio-umount.conf file which tells oci-umount plugin
to look for leaked mount points in /var/lib/containers/storage/* and
/var/run/containers/*
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Both the base and extras repos are required. Rather than try to fuss
around with subscription manager, require two variables be defined
pointing to the baseurl's to use. Assert that these variables are set
and non-empty.
Signed-off-by: Chris Evich <cevich@redhat.com>
Depending on circumstances out of our control, the 'integration tests'
may take longer than an hour (3600 seconds). Since the maximum time
is referenced in several places, define a variable with a larger value
then reference it from the affected tasks.
Signed-off-by: Chris Evich <cevich@redhat.com>
Previously, an internal playbook installed many extra
necessary/unnecessary packages before this playbook even started. Since
this is a terrible design, move all dependencies here so that nothing is
unwritten. This includes installing some deps. for ansible itself
(which must be done as a raw command).
Signed-off-by: Chris Evich <cevich@redhat.com>
If running a playbook more than once, there's no need to re-bootstrap
the virtual environment. Assume if the verified crio directory already
exists, it should be used (after re-asserting hashes of requirements).
Signed-off-by: Chris Evich <cevich@redhat.com>
server: fix selinux labels for pod and containers
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
sandbox: set selinux labels from request, not defaults
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
container_create: use sandbox's selinux if container's nil
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
sandbox: correctly init selinux labels
First, we weren't correctly initializing selinux labels. If any of
(level, user, role, type) was missing from kube selinux options, we
were erroring out. This is wrong as kube sends just `level=s0`
sometimes and docker itself allows `--security-opt label=level:s0`.
This patch directly initializes selinux labels, correctly, and adds a
test to verify it.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
test: testdata: use container_runtime_t selinux type
RHEL SELinux policy doesn't have `container_t` type but we're using it
in our fixtures. That means Fedora integration tests pass because
`container_t` is in Fedora's container policy but RHEL is broken.
Fix it by using `container_runtime_t` which is aliased in Fedora policy
to `container_t`.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
The inspect endpoint is used mainly in the CRI-O cAdvisor handler.
Let's make sure we don't break it by adding some trivial unit tests.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
There is cleanup code that will never get run.
This code will print out all errors and then return the last error.
This should allow for proper cleanup.
Also cleanup help to switch usage and description.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
If the user provides kpod pull a short name like 'debian', we
still want the pull to be sucessful. As such, when a short
name is provided, we get the list of searchable registries via
the systemregistries code in containers-storage. We then
append a tag of 'latest' (if not provided) and we formulate
a list of possible fully-qualified image names to try.
Vendor update for containers-storage to bring in the system_registries
code.
Also includes a patch from Nalin to fix compilation errors.
Signed-off-by: baude <bbaude@redhat.com>
Stop one or more containers. Specific a timeout value
that if the stop operation exceeds, will forcibly stop
the container.
Signed-off-by: baude <bbaude@redhat.com>
The JSON output was being modified to type string, fixed that
to be of the same type as the source
This is better for further processing of the JSON output if needed
Restructured kpod history a bit as well
Signed-off-by: umohnani8 <umohnani@redhat.com>
QE noticed that kpod ps --last 0 was returning the running containers
Fixed that problem so that it returns nothing
Signed-off-by: umohnani8 <umohnani@redhat.com>
Our CI tests on RHEL and Fedora and we want to test the systemd cgroup
driver. However, kubelet needs to run in tests with systemd cgroup
driver as well, or tests fail. This patch fixes broken CI because of
not matching cgroup driver between CRI-O and the kubelet.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Kubelet can send cap add/drop ALL. Handle that in CRI-O as well.
Also, this PR is re-vendoring runtime-tools to fix capabilities add to
add caps to _all_ caps set **and** fix a shared memory issue (caps set
were initialized with the same slice, if one modifies one slice, it's
reflected on the other slices, the vendoring fixes this as well)
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
We want to drop brute force mechainism for handling image
movement, this patch experiments with moving kpod pull
to use new libpod interfaces.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Because we need a working CNI plugin to setup a correct netns so
sandbox_run can grab a working IP address.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
When performing a tag, if a shortname was provided, tag.go would
preprend docker.io to the shortname through the ParseNormalized
function. Here we work around that such that is a short name
and tag are provided, the resulting tag will be shortname:tag. If
a shortname is provided without a tag, we append "latest" as the
tag.
Added specific tag tests too
Signed-off-by: baude <bbaude@redhat.com>
This patch will check to see if SELinux is enabled and then pass
the -Z flag to the install command, which causes install to label
all created content with the system default labels.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Kpod rm removes a container from the system
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: umohnani8 <umohnani@redhat.com>
Add new directory /etc/crio/hooks.d, where packagers can drop a json config
file to specify a hook.
The json must specify a valid executable to run.
The json must also specify which stage(s) to run the hook:
prestart, poststart, poststop
The json must specify under which criteria the hook should be launched
If the container HasBindMounts
If the container cmd matches a list of regular expressions
If the containers annotations matches a list of regular expressions.
If any of these match the the hook will be launched.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
kpod must parse the crio configuration file or the storage
is not set up correctly. By default it is not. We now read
/etc/crio/crio.conf in as the configuration file unless it is
overriden by the user and the global -c|--config switch.
Signed-off-by: baude <bbaude@redhat.com>
The environment executing the test playbooks matters. Establish a
script to bootstrap a known-good and fixed-version python virtual
environment. Spell out precise execution requirements in a standard
pip 'requirements.txt' file, including version numbers and hashes.
Upon executing the ``venv-ansible-playbook.sh`` wrapper, a virtual
environment is setup and contained within a fixed (or temporary)
directory, with full logs from setup. If this is to be preserved
across executions, the ``$WORKSPACE`` environment variable must be
set and exported beforehand.
Example execution command-line provided in script file
Signed-off-by: Chris Evich <cevich@redhat.com>
Without any swap space enabled, it's possible some intensive operation
can chew up all the memory on the test VM. Enabling swap space will
prevent this for minor cases, but could lead to disk-thrashing if the
memory demand is excessive.
Since the test system never reboots, using a file-backed swap should
suffice. Though not ideal, it's easy to setup and doesn't require any
interactions with the cloud that owns the VM or the job that created it.
Signed-off-by: Chris Evich <cevich@redhat.com>
The getCommand func strips out unwanted characters around the
command of the container. The JSON output should use this func
like the regular ps output for both consistency and because
Python does a literal interpretation of the bracket [] characters
when consuming as JSON.
Signed-off-by: baude <bbaude@redhat.com>
Some kpod commands were listed twice in main.go. Removed these
duplicates and alphabetized the remaining commands to prevent this
from happening in the future
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
Consumers of the json output, like the atomic cli, need the ID of the
image for the container as well as the name. Specifically, it is used
to tract "used" and "vulnerable" images.
Signed-off-by: baude <bbaude@redhat.com>
Have the "kpod info" command also package up the driver-level status
information that the github.com/containers/storage.Store's Status()
method returns.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Found out that during OpenShift testing, node was trying to remove
containers (probably in a bad state) and was failing the removal with
this kind of error:
E0828 13:19:46.082710 1235 kuberuntime_gc.go:127] Failed to remove
container
"e907f0f46b969e0dc83ca82c03ae7dd072cfe4155341e4521223d9fe3dec5afb": rpc
error: code = 2 desc = failed to remove container exit file
e907f0f46b969e0dc83ca82c03ae7dd072cfe4155341e4521223d9fe3dec5afb: remove
/var/run/crio/exits/e907f0f46b969e0dc83ca82c03ae7dd072cfe4155341e4521223d9fe3dec5afb:
no such file or directory
I believe it's ok to ignore this error as it may happen conmon will
fail early before exit file is written.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
No reason to carry this temporary variable for documentation purposes.
If in the future we find that it is necessary to add a CLI option, we
can add the variable then.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Changed the JSON output to hold the actual type of the data.
For example the creation time of a container will be of form time.Time.
The human readable output modifies all the fields to type string, which
is not helpful when the JSON output wants to be used for further processing.
Signed-off-by: umohnani8 <umohnani@redhat.com>
ln -s errors out with file exists if you run make install.systemd twice
or more. This patch installs the alias directly w/o using a symlink so
it can be run multiple times w/o errors.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
SetMaxThreads from runtime/debug in Golang is called to set max threads
value to 90% of /proc/sys/kernel/threads-max
Should really help performance.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Correct some syntax errors in kpod.bats, ensure that it always checks
the exit status of "kpod rmi" commands, correct the order of options
when calling "kpod inspect", and test for string equality correctly.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Before exiting, have kpod shut down the storage library if it can. This
should keep us from leaving mountpoints for the root (for non-vfs cases)
and run directory (with newer containers/storage) busy when testing kpod.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Add missing commands to transfer page and add
links for demos to README.md page.
Fixup bash completions for new commands.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
We want all kpod subcommands to use the formats code to output
formats like json. Altering kpod diff --json to kpod diff --format json
like the kpod images command.
Signed-off-by: baude <bbaude@redhat.com>
Also, we distinguish between container and a pod infra
container in the exit monitor as pod infra containers
aren't stored in the main container index.
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
We add a ContainerVolume struct and store a list of volumes
in the Container object for quick retrieval.
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
We calculate these values at container creation time and store
them in the container object as they are requested during container
status. This avoids re-calculation and speeds up container status.
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
We get notified of container exits by inotify so we already
have updated status of the container in memory state.
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
vndr was previously removing .go files in runc/libcontainer since they weren't used anywhere
in cri-o, but kpod stats will use them
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
Add functions to go templates such as truncating a field. Also add
the table keyword, which, if placed at the beginning of a format string,
adds headers to the output
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
Containers running in kubernetes currently do not specify options
for mount propagation and whether to bind or rbind the mount point.
Since docker defaults to bind and rbind, we should match their
behavious, since this is what admins expect
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
When an image is saved using the digest, the repotag saved is null causing load to break
Using the hex form of the image digest to save the image when the repotag is null
This saves the image in containers-storage without a name or tag as "<none>"
Signed-off-by: umohnani8 <umohnani@redhat.com>
This allows the container list API to return updated status
for exited container without having to call container status first.
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
For kpod images, we need to output in JSON format so that consumers
(programatic) have structured input to work with.
kpod images --format json
Signed-off-by: baude <bbaude@redhat.com>
Also set default level of logging to errors, we should not see
info messages in the kpod command line.
While adding this patch, I found missing options in kpod command line
and bash completions, so I added them in.
Also fixed some sorting issues in the way commands are displayer in help or in
bash completions.
Finally fixed the error message to be output on failure using logrus.Errorf, so
we don't get the stack any longer.
Also updated README.md with missing kpod commands.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
kpod diff reports on differences between two layers, specified as
layer IDs, containers, or images. In the case of containers or
images, kpod diff produces a diff for the top layer
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
We add two flags --enable-metrics and --metrics-port
to enable metrics endpoint and allow specifying the
port which defaults to 9090.
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
This command will allow users to manipulate and examine the container
images from outside of the container.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
He is a key contributor to the CRI-O project, he has contributed a lot to cri-o
and the projects/libraries
He is an expert in containers/storage and really solid on containers/image
key components of the cri-o project. We need to get his advise and appoval
on lots of pull requests interacting with the storage and image layers.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Need to mv to latest released and supported version of logrus
switch github.com/Sirupsen/logrus github.com/sirupsen/logrus
Also vendor in latest containers/storage and containers/image
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Some features cri-o is now using are not supported by golang 1.6.
All Distros that use CRI-O are now using golang 1.7 or better,
so no reason to test with this older version.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
The storage library uses github.com/pkg/errors to wrap errors that it
returns from many of its functions, so when passing them to
os.IsNotExist() or comparing them to specific errors defined in the
storage library, unwrap them using errors.Cause().
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Miloslav informs me that the docker transport talking to an OpenShift
registry will handle signatures properly, so no need for the atomic transport
any longer. We want to stop documenting it.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Remove the non-OCI version of the configuration structure, and the
parent image ID, from the ImageData that libkpod returns.
At runtime, cri-o is only ever going to use the OCI configuration
(possibly converted from another format by the image library) when
setting up a container, so it can be confusing to display settings in
"kpod inspect" that might be discarded when we try to run a container.
Remove the non-OCI version of the configuration structure, and the
hard-coded Type field, from the ContainerData that libkpod returns.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
We already parse every image if there's a label filter so that we can
check against the filter, so when we do that, go ahead and read the
OCI-format configuration and inspection data as well, and use an image's
creation date as recorded in inspection data everywhere.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Make getStore() take a config struct from which it pulls the store
options, then update the kpod commands so that they call getConfig()
and pass the config into getStore()
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
This update allows the creation of docker-archive files when the
destination does not exists or is empty. kpod save needs this functionality.
Signed-off-by: Dan Walsh <dwalsh@redhat.com>
Avoid parsing metadata that the image library keeps in order to find an
image's top layer and creation date; instead, use the values which the
storage library now makes available, which will be correct once we merge
PR #654 or something like it.
Instead of assuming the last blob which was added for the image was the
manifest, read it directly and compute its digest ourselves.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
github.com/containers/image.FromUnparsedImage() "takes ownership" of the
UnparsedImage that we pass to it, so we shouldn't also Close() the
UnparsedImage ourselves after we've wrapped it up in an Image object.
Since creating an Image is the only thing we do with the UnparsedImage
after creating it from a SourceImage, just use the FromSource() function
to handle both steps at once.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Don't bother trying to find and parse the image's configuration blob
after we've already done it; just reuse the value. This frees us from
making the assumption that the last blob which was committed to local
storage was the image's configuration blob.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Parse the set of image names as tagged references, canonical references,
or repository names to which we add the default tag, and return them in
libkpod.ImageData reports.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Switch from using the lower-level storage APIs (accessing LayerStore,
ImageStore, and ContainerStore types directly) in favor of the
higher-level ones that take care of synchronization and locking for us.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Add notes to README.md about needing to install ostree-devel, or
libostree-dev, or building ostree from source.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Bump containers/image (pulling in its new dependency on ostree-go),
containers/storage, and updated image-spec.
This pulls in the OCI v1.0 specifications and code that allows us to
support 1.0 images.
Signed-off-by: Dan Walsh <dwalsh@redhat.com>
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
update libkpod's New() function to use a config struct, and update
server.New() to call into libkpod.New()
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
During my testing in OpenShift I've noticed that conmon leaves some
zombies processes. The reason is that we are using
PR_SET_CHILD_SUBREAPER in conmon and runC forks a new process (runc
init) each time we start a container. Using g_child_watch_add only on
the main runc process and on the container process is not enough as we
do not cleanup any other zombie process.
Since glib doesn't allow to catch SIGCHLD and to better integrate in the
existing code, catch it with signal(2) then raise a SIGUSR1 that glib
handles.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
bin2img/checkseccomp/copyimg are file targets and should not be .PHONY.
This prevents to build them if not necessary.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Build all of our binaries with the same build tags and the same LDFLAGS.
This means we add $(LDFLAGS) to bin2img, copyimg, and cri-o,
$(BUILDTAGS) to kpod, and both to crioctl and checkseccomp.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
If sandbox is in the same package as server, there will be a circular dependency when
kpod create is implemented
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
When the integration test image is run on a system with apparmor
enabled, it needs binaries from the 'apparmor' package, so ensure that
it's always there.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Basically none of the clever storage drivers will work when we're on top
of AUFS, so if we find ourselves in that situation when running tests,
default to storage options of "--storage-driver vfs".
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Move container state data to libkpod, separate from the sandbox
data in server. However, the move was structured such that sandbox
data could easily be moved over into libkpod in the future
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
go list {{.Imports}} outputs imports as an array, and the leading
and trailing square brackets can get caught in the name of a package.
Add a pipe in the dependency command to remove the brackets
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
Move non-kubernetes-dependent portions of server struct to libkpod.
So far, only the struct fields have been moved and not their dependent
functions
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
Use unix.Prctl() instead of manually reimplementing it using
unix.RawSyscall. Also use unix.SECCOMP_MODE_FILTER instead of locally
defining it.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Update golang.org/x/sys to get newly added functions and constants which
will be used in successive commits.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Design: The output of the `info` subcommand ought to be directly
consumable in a format like JSON or yaml.
The structure being a map of sorts.
Each subsection of information being an individual cluster under the
top-level, like platform info, debug, storage, etc.
Even if there are errors under the top level key, the value will be a
map with the key of "error" and the value as the message of the
`err.Error()`. In this way, the command always returns usable output.
Ideally there will be a means for anything that can register info to do
so independently from it being in the single info.go, so this approach
is having a typed signature for the function that gives info, but i'm
sure it could be better.
Current iteration of this outputs the following as a limited user:
```yaml
host:
MemFree: 711307264
MemTotal: 2096222208
SwapFree: 2147479552
SwapTotal: 2147479552
arch: amd64
cpus: 1
os: linux
store:
error: 'mkdir /var/run/containers/storage: permission denied'
```
and as root (`sudo kpod info -D`):
```yaml
debug:
compiler: gc
go version: go1.7.6
goroutines: 3
host:
MemFree: 717795328
MemTotal: 2096222208
SwapFree: 2147479552
SwapTotal: 2147479552
arch: amd64
cpus: 1
os: linux
store:
ContainerStore:
number: 1
GraphDriverName: overlay2
GraphRoot: /var/lib/containers/storage
ImageStore:
number: 1
```
And with the `--json --debug` flag:
```json
{
"debug": {
"compiler": "gc",
"go version": "go1.7.6",
"goroutines": 3
},
"host": {
"MemFree": 709402624,
"MemTotal": 2096222208,
"SwapFree": 2147479552,
"SwapTotal": 2147479552,
"arch": "amd64",
"cpus": 1,
"os": "linux"
},
"store": {
"ContainerStore": {
"number": 1
},
"GraphDriverName": "overlay2",
"GraphRoot": "/var/lib/containers/storage",
"ImageStore": {
"number": 1
}
}
}
```
Signed-off-by: Vincent Batts <vbatts@hashbangbash.com>
We now have actual kpod code, so no reason to have a not implemented feature.
Especially when we don't intend to create kpod launch.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Update the vendored commit for containers/image, because the previous
version did not include the function ListNames() in transports
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
The syscall package is locked down and the comment in [1] advises to
switch code to use the corresponding package from golang.org/x/sys. Do
so and replace usage of package syscall where possible (leave
syscall.SysProcAttr and syscall.Stat_t).
[1] https://github.com/golang/go/blob/master/src/syscall/syscall.go#L21-L24
This will also allow to get updates and fixes just by re-vendoring
golang.org/x/sys/unix instead of having to update to a new go version.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
'kpod images' lists all images on a system. 'kpod rmi' removes
one or more images from a system. The images will not be removed
if they are associated with a running container, unless the -f
option is used
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
Instead of waiting until stderr/out is closed and then waiting for
the container to exit we wait for the container to exit in the
gmainloop, in addition to everything else, exiting only when
the child dies.
We then drain any output in stderr/out after the child has exited.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
Remove the Prctl wrapper function which has been unused since commit
d2f6a4c0e2. If a prctl wrapper would be needed in the future,
golang.org/x/sys provides unix.Prctl which could be used instead.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
The test "ctr execsync std{out,err}" from ctr.bats works with runc,
but the semantics behind is wrong.
We should not be able to execute a new process on a container which
has not been previously started. That's why this patch adds a call
to start the container.
Moreover, we don't want to be able to execute a new process on a
container that has already returned because its workload is done.
For that reason, we need to force the container workload to be a
"sleep 10" to ensure it is still running when the call to "exec"
is issued.
Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
This matches the current kube behavior. This will probably
be provided over the CRI at which point we won't have to
define a constant in cri-o code.
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
We build paths using g_build_filename and g_strdup_printf() instead
which means we don't have any arbitrary pathname lenght issue, and
the code becomes cleaner.
We also convert asprintf to g_strdup_printf so that we can use
the glib OOM checker instead of open coding it everywhere.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
This moves the timeout handling from the go code to conmon, whic
removes some of the complexity from criod, and additionally it will
makes it possible to do the double-fork in the exec case too.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
We need to do this, because otherwise we will continue and exit the
pid before systemd has a chance to look at it.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
This patch also hides the profile under the debug flag as there's
runtime cost to enable the profiler.
This removes the old way of profiling (CPU) as that's not really
needed.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
This patch isn't adding a test for /etc/hosts as that requires host
network and we don't want to play with host's /etc/hosts when running
make localintegration on our laptops. That may change in the future
moving to some sort of in-container testing.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Currently, when creating containers we never call Wait on the
conmon exec.Command, which means that the child hangs around
forever as a zombie after it dies.
However, instead of doing this waitpid() in the parent we instead
do a double-fork in conmon, to daemonize it. That makes a lot of
sense, as conmon really is not tied to the launcher, but needs
to outlive it if e.g. the cri-o daemon restarts.
However, this makes even more obvious a race condition which we
already have. When crio-d puts the conmon pid in a cgroup there
is a race where conmon could already have spawned a child, and
it would then not be part of the cgroup. In order to fix this
we add another synchronization pipe to conmon, which we block
on before we create any children. The parent then makes sure the
pid is in the cgroup before letting it continue.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
If we get a kubelet annotation about the sandbox trust level, we use it
to toggle our sandbox trust flag.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Container runtimes provide different levels of isolation, from kernel
namespaces to hardware virtualization. When starting a specific
container, one may want to decide which level of isolation to use
depending on how much we trust the container workload. Fully verified
and signed containers may not need the hardware isolation layer but e.g.
CI jobs pulling packages from many untrusted sources should probably not
run only on a kernel namespace isolation layer.
Here we allow CRI-O users to define a container runtime for trusted
containers and another one for untrusted containers, and also to define
a general, default trust level. This anticipates future kubelet
implementations that would be able to tag containers as trusted or
untrusted. When missing a kubelet hint, containers are trusted by
default.
A container becomes untrusted if we get a hint in that direction from
kubelet or if the default trust level is set to "untrusted" and the
container is not privileged. In both cases CRI-O will try to use the
untrusted container runtime. For any other cases, it will switch to the
trusted one.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
We use a SOCK_SEQPACKET socket for the attach unix domain socket, which
means the kernel will ensure that the reading side only ever get the
data from one write operation. We use this for frameing, where the
first byte is the pipe that the next bytes are for. We have to make sure
that all reads from the socket are using at least the same size of buffer
as the write side, because otherwise the extra data in the message
will be dropped.
This also adds a stdin pipe for the container, similar to the ones we
use for stdout/err, because we need a way for an attached client
to write to stdin, even if not using a tty.
This fixes https://github.com/kubernetes-incubator/cri-o/issues/569
Signed-off-by: Alexander Larsson <alexl@redhat.com>
we were blindly applying RO mount options but net addons like calico
modify those files.
This patch sets RO only when container's rootfs is RO, same behavior as
docker.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
tmpfs'es can override whatever there's on the container rootfs. We just
mkdir the volume as we're confident kube manages volumes in container.
We don't need any tmpfs nor any complex volume handling for now.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Vendor and use docker/pkg/pools.
pools are used to lower the number of memory allocations and reuse buffers when
processing large streams operations..
The use of pools.Copy avoids io.Copy's internal buffer allocation.
This commit replaces io.Copy with pools.Copy to avoid the allocation of
buffers in io.Copy.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
This was cluttering the logs on my clusters. The log should be just in
debug mode as we do for every request/response flow.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
By only handling create events, we are breaking plugins that don't
create and write atomically, like weave for example.
The Weave plugin creates the file first and later write to it. We are
missing the second part and never see the final CNI config file.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
We don't want to block on accepting the terminal fd, because then
we can't detect if runc died before calling out to pass the terminal
fd. To handle this we spin the glib mainloop listening to both the
terminal accept fd and a child pid watch.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
This is an optimization of our image pull code path. It's basically
how docker handles pulls as well. Let's be smart and check the image in
pull code path as well.
This also matches docker behavior which first checks whether we're
allowed to actually pull an image before looking into local storage.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
This patch fixes the following command:
kubectl run -i --tty centos --image=centos -- sh
The command above use to fail with:
/usr/bin/sh: /usr/bin/sh: cannot execute binary file
That's because we were wrongly assembling the OCI processArgs.
Thanks @alexlarsson for spotting this.
This patch basically replicates what docker does when merging container
config and image config. It also replicates how docker sets processArgs
for the OCI runtime.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
A goroutine is started to forward terminal resize requests
from the resize channel. Also, data is copied back/forth
between stdin, stdout, stderr streams and the attach socket
for the container.
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
The bug is silly if you have a master/node cluster where node is on a
different machine than the master.
The current behavior is to give our addresses like "0.0.0.0:10101". If
you run "kubectl exec ..." from another host, that's not going to work
since on a different host 0.0.0.0 resolves to localhost and kubectl
exec fails with:
error: unable to upgrade connection: 404 page not found
This patch fixes the above by giving our correct addresses for reaching
from outside.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
conmon.c fails to build on Ubuntu:
cc -std=c99 -Os -Wall -Wextra -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -c -o conmon.o conmon.c
In file included from /usr/include/fcntl.h:289:0,
from conmon.c:4:
In function ‘open’,
inlined from ‘main’ at conmon.c:519:10:
/usr/include/x86_64-linux-gnu/bits/fcntl2.h:50:4: error: call to ‘__open_missing_mode’ declared with attribute error: open with O_CREAT or O_TMPFILE in second argument needs 3 arguments
__open_missing_mode ();
^
<builtin>: recipe for target 'conmon.o' failed
make[1]: *** [conmon.o] Error 1
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
This is not actually read uninitialized, its just that the compiler
can't detect this, but we initilize it anyway to silence the compiler.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
This is what the other C code uses, and its nice to have as adding
any optimization flags enables a bunch of more warnings.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
json-glib is a fine library for parsing json. However, all we need
to do is generate some trivial json output, so it is not needed.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
We want to avoid inheriting these into the child. Doing so is both
confusing for the child, and a potential security issue if the
container has access to FDs that are from the outside of the
container.
Some of these are created after we fork for the child, so they
are not technically necessary. However, its best to do this as
we may change the code in the future and forget about this.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
This means we don't have to spawn via a shell, but it also
means we do the right thing for any input that would have
needed to be escaped. For instance if the container name had
a $ in i, or even worse, a back-quote!
Signed-off-by: Alexander Larsson <alexl@redhat.com>
The buffer is used to read from the stderr/stdout stream, which
can easily be larger than 256 bytes. With a larger buffer we will
do fewer, larger reads, which is more efficient. And 8k more stack
size use is not really a problem.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
The code as is doesn't handle merged controllers.
For instance, I have this in my /proc/self/cgrous:
4:cpu,cpuacct:/user.slice/user-0.slice/session-4.scope
The current code fails to match "cpuacct" wit this line, and
additionally it just does a prefix match so if you were looking
for say "cpu", it would match this:
2:cpuset:/
I also removed some ninfo spew that didn't seem very useful.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
Rather than writing the logs with one write per line, use writev()
to write multiple lines in one call. Additionally, this avoids
using dprintf() when writing to the log, which is nice because that
doesn't correctly handle partial writes or ENOINTR.
This also changes set_k8s_timestamp to add the pipe to the reused
buffer so that we don't have to append it on each line.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
Any write could be interupted by EINTR if we get some kind of signal,
which means we could be either reporting a EINTR error or a partial
write (if some data was written). Its also generally good to handle
partial writes correctly, as they can happen e.g. when writing to
full pipes.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
Some runtimes like Clear Containers need to interpret the CRI-O
annotations, to distinguish the infra container from the regular one.
Here we export those annotations and use a more standard dotted
namespace for them.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
node-e2e tests were failing in RHEL because, if running a privileged
container, we get all capability in the spec. The spec generator wasn't
filtering caps based on actual host caps, it was just adding _everything_.
This patch makes spec generator host specific.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
`containerdID` is overridden in `s.ctrIDIndex.Get()`, if the ctr is not
found it's overridden by an empty string making the error return
totally unusable.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
During "Port forwarding" e2e tests, the following panic happened:
```
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x64981d]
goroutine 52788 [running]:
panic(0x1830ee0, 0xc4200100c0)
/usr/lib/golang/src/runtime/panic.go:500 +0x1a1
github.com/kubernetes-incubator/cri-o/oci.(*Runtime).UpdateStatus(0xc4202afc00,
0x0, 0x0, 0x0)
/home/amurdaca/go/src/github.com/kubernetes-incubator/cri-o/oci/oci.go:549
+0x7d
github.com/kubernetes-incubator/cri-o/server.streamService.PortForward(0xc42026e000,
0x0, 0x0, 0x0, 0x0, 0xc420d9af40, 0x40, 0xc400000050, 0x7fe660659a28,
0xc4201cd0e0, ...)
```
The issue is `streamService.PortForward` assumed the first argument to
be the sandbox's infra container ID, thus trying to get it from memory
store using `.state.containers.Get`. Since that ID is of the sandbox
itself, it fails to get the container object from memory and panics in
`UpdateStatus`.
Fix it by looking for the sandbox's infra container ID starting from a
sandbox ID.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
conmon has many flags that are parsed when it's executed, one of them
is "-c". During PR #510 where we vendor latest kube master code,
upstream has changed a test to call a "ctr execsync" with a command of
"sh -c commmand ...".
Turns out:
a) conmon has a "-c" flag which refers to the container name/id
b) the exec command has a "-c" flags but it's for "sh"
That leads to conmon parsing the second "-c" flags from the exec
command causing an error. The executed command looks like:
conmon -c [..other flags..] CONTAINERID -e sh -c echo hello world
This patch rewrites the exec sync code to not pass down to conmon the
exec command via command line. Rather, we're now creating an OCI runtime
process spec in a temp file, pass _the path_ down to conmon, and have
runc exec the command using "runc exec --process
/path/to/process-spec.json CONTAINERID". This is far better in which we
don't need to bother anymore about conflicts with flags in conmon.
Added and fixed some tests also.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
If we create a container using the image ID like
771cd5947d5ea4bf8e8f4900dd357dbb67e7b16486c270f8274087d182d457c6, then
a call to container_status will return that same ID for the "Image"
field in ContainerStatusResponse.
This patch matches dockershim behavior and return the first tagged name
if available from the image store.
This is also needed to fix a failure in k8s e2d tests.
Reference:
https://github.com/kubernetes/kubernetes/pull/39298/files#diff-c7dd39479fd733354254e70845075db5R369
Reference:
67a5bf8454/test/e2e/framework/util.go (L1941)
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
if you run `make localintegration` from a branch, switch to another and
re-run the command again, `ocid` won't get built again causing tests to
run with binaries from the old branch you switched from.
This patch makes sure we cleanup binaries and rebuild before running
tests.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
The ocid project was renamed to CRI-O, months ago, it is time that we moved
all of the code to the new name. We want to elminate the name ocid from use.
Move fully to crio.
Also cric is being renamed to crioctl for the time being.
Signed-off-by: Dan Walsh <dwalsh@redhat.com>
Two issues:
1) pod Namespace was always set to "", which prevents plugins from figuring out
what the actual pod is, and from getting more info about that pod from the
runtime via out-of-band mechanisms
2) the pod Name and ID arguments were switched, further preventing #1
Signed-off-by: Dan Williams <dcbw@redhat.com>
In build environments such as koji, there is no access to download
and install go packages so we should look for go-md2man in system
path first.
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
for d in $(find . -type d -not -iwholename '*.git*' -a -not -iname '.tool' -a -not -iwholename '*vendor*' -a -not -iwholename '*.artifacts*' -a -not -iwholename '*contrib*' -a -not -iwholename '*test*' -a -not -iwholename '*logo*' -a -not -iwholename '*conmon*' -a -not -iwholename '*completions*' -a -not -iwholename '*docs*' -a -not -iwholename '*pause*'); do
${GOPATH}/bin/gometalinter \
--exclude='error return value not checked.*(Close|Log|Print|RemoveAll).*\(errcheck\)$' \
--exclude='.*_test\.go:.*error return value not checked.*\(errcheck\)$' \
--exclude='duplicate of.*_test.go.*\(dupl\)$' \
--exclude='cmd\/client\/.*\.go.*\(dupl\)$' \
--exclude='vendor\/.*' \
--exclude='server\/seccomp\/.*\.go.*$' \
--disable=aligncheck \
--disable=gotype \
--disable=gas \
--cyclo-over=80 \
--dupl-threshold=100 \
--tests \
--deadline=120s "${d}"
done
# Create the linter path for use later
LINTER=${GOPATH}/bin/gometalinter
# Make sure gometalinter is installed
if [ ! -f ${LINTER} ]; then
echo >&2 "gometalinter must be installed. Please run 'make install.tools' and try again"
exit 1
fi
PKGS=$(find . -type d -not -path . -a -not -iwholename '*.git*' -a -not -iname '.tool' -a -not -iwholename '*vendor*' -a -not -iname 'hack' -a -not -iwholename '*.artifacts*' -a -not -iwholename '*contrib*' -a -not -iwholename '*test*' -a -not -iwholename '*logo*' -a -not -iwholename '*conmon*' -a -not -iwholename '*completions*' -a -not -iwholename '*docs*' -a -not -iwholename '*pause*')
# Execute the linter
${LINTER} \
--concurrency=4\
--enable-gc\
--vendored-linters\
--deadline=600s --disable-all\
--enable=deadcode\
--enable=errcheck\
--enable=goconst\
--enable=gofmt\
--enable=golint\
--enable=ineffassign\
--enable=interfacer\
--enable=megacheck\
--enable=misspell\
--enable=structcheck\
--enable=varcheck\
--enable=vet\
--enable=vetshadow\
--exclude='error return value not checked.*\(errcheck\)$'\
* `✓` Changes in main Kubernetes repo about CRI are actively implemented in CRI-O
* `=` Maintenance is manual, only bugs will be patched.
## What is the scope of this project?
cri-o is meant to provide an integration path between OCI conformant runtimes and the kubelet.
Specifically, it implements the Kubelet Container Runtime Interface (CRI) using OCI conformant runtimes.
The scope of cri-o is tied to the scope of the CRI.
CRI-O is meant to provide an integration path between OCI conformant runtimes and the kubelet.
Specifically, it implements the Kubelet [Container Runtime Interface (CRI)](https://github.com/kubernetes/community/blob/master/contributors/devel/container-runtime-interface.md) using OCI conformant runtimes.
The scope of CRI-O is tied to the scope of the CRI.
At a high level, we expect the scope of cri-o to be restricted to the following functionalities:
At a high level, we expect the scope of CRI-O to be restricted to the following functionalities:
* Support multiple image formats including the existing Docker image format
* Support for multiple means to download images including trust & image verification
@ -24,7 +38,7 @@ At a high level, we expect the scope of cri-o to be restricted to the following
## What is not in scope for this project?
* Building, signing and pushing images to various image storages
* A CLI utility for interacting with cri-o. Any CLIs built as part of this project are only meant for testing this project and there will be no guarantees on the backwards compatibility with it.
* A CLI utility for interacting with CRI-O. Any CLIs built as part of this project are only meant for testing this project and there will be no guarantees on the backward compatibility with it.
This is an implementation of the Kubernetes Container Runtime Interface (CRI) that will allow Kubernetes to directly launch and manage Open Container Initiative (OCI) containers.
@ -36,13 +50,44 @@ The plan is to use OCI projects and best of breed libraries for different aspect
It is currently in active development in the Kubernetes community through the [design proposal](https://github.com/kubernetes/kubernetes/pull/26788). Questions and issues should be raised in the Kubernetes [sig-node Slack channel](https://kubernetes.slack.com/archives/sig-node).
Note that kpod and its container management and debugging commands have moved to a separate repository, located [here](https://github.com/projectatomic/libpod).
[CRI-O configures OCI Hooks to run when launching a container](./hooks.md)
## CRI-O Usage Transfer
[Useful information for ops and dev transfer as it relates to infrastructure that utilizes CRI-O](/transfer.md)
## Communication
For async communication and long running discussions please use issues and pull requests on the github repo. This will be the best place to discuss design and implementation.
For sync communication we have an IRC channel #CRI-O, on chat.freenode.net, that everyone is welcome to join and chat about development.
## Getting started
### Prerequisites
### Runtime dependencies
`runc` version 1.0.0.rc1 or greater is expected to be installed on the system. It is picked up as the default runtime by ocid.
- runc, Clear Containers runtime, or any other OCI compatible runtime
- socat
- iproute
- iptables
### Build Dependencies
Latest version of `runc` is expected to be installed on the system. It is picked up as the default runtime by CRI-O.
### Build and Run Dependencies
**Required**
@ -52,23 +97,30 @@ Fedora, CentOS, RHEL, and related distributions:
yum install -y \
btrfs-progs-devel \
device-mapper-devel \
git \
glib2-devel \
glibc-devel \
glibc-static \
go \
golang-github-cpuguy83-go-md2man \
gpgme-devel \
libassuan-devel \
libgpg-error-devel \
libseccomp-devel \
libselinux-devel \
ostree-devel \
pkgconfig \
runc
runc \
skopeo-containers
```
Debian, Ubuntu, and related distributions:
```bash
apt install -y \
apt-get install -y \
btrfs-tools \
git \
golang-go \
libassuan-dev \
libdevmapper-dev \
libglib2.0-dev \
@ -78,10 +130,18 @@ apt install -y \
libseccomp-dev \
libselinux1-dev \
pkg-config \
runc
go-md2man \
runc \
skopeo-containers
```
If using an older release or a long-term support release, be careful to double-check that the version of `runc` is new enough, or else build your own.
Debian, Ubuntu, and related distributions will also need a copy of the development libraries for `ostree`, either in the form of the `libostree-dev` package from the [flatpak](https://launchpad.net/~alexlarsson/+archive/ubuntu/flatpak) PPA, or built [from source](https://github.com/ostreedev/ostree) (more on that [here](https://ostree.readthedocs.io/en/latest/#building)).
If using an older release or a long-term support release, be careful to double-check that the version of `runc` is new enough (running `runc --version` should produce `spec: 1.0.0`), or else build your own.
**NOTE**
Be careful to double-check that the version of golang is new enough, version 1.8.x or higher is required. If needed, golang kits are avaliable at https://golang.org/dl/
**Optional**
@ -92,13 +152,13 @@ Fedora, CentOS, RHEL, and related distributions:
Debian, Ubuntu, and related distributions:
```bash
apt install -y \
apt-get install -y \
libapparmor-dev
```
### Get Source Code
As with other Go projects, cri-o must be cloned into a directory structure like:
As with other Go projects, CRI-O must be cloned into a directory structure like:
```
GOPATH
@ -132,7 +192,7 @@ make
sudo make install
```
Otherwise, if you do not want to build `cri-o` with seccomp support you can add `BUILDTAGS=""` when running make.
Otherwise, if you do not want to build `CRI-O` with seccomp support you can add `BUILDTAGS=""` when running make.
```bash
make BUILDTAGS=""
@ -141,7 +201,7 @@ sudo make install
#### Build Tags
`cri-o` supports optional build tags for compiling support of various features.
`CRI-O` supports optional build tags for compiling support of various features.
To add build tags to the make option the `BUILDTAGS` variable must be set.
```bash
@ -167,19 +227,26 @@ your system.
### Running with kubernetes
You can run a local version of kubernetes with cri-o using `local-up-cluster.sh`:
You can run a local version of kubernetes with CRI-O using `local-up-cluster.sh`:
1. Clone the [kubernetes repository](https://github.com/kubernetes/kubernetes)
1. Start the cri-o daemon (`ocid`)
1. From the kubernetes project directory, run: `CONTAINER_RUNTIME=remote CONTAINER_RUNTIME_ENDPOINT='/var/run/ocid.sock --runtime-request-timeout=15m' ./hack/local-up-cluster.sh`
io.k8s.description="CRI-O is an implementation of the Kubernetes CRI. It is a lightweight, OCI-compliant runtime that is native to kubernetes. CRI-O supports OCI container images and can pull from any container registry." \
maintainer="Jhon Honce <jhonce@redhat.com>" \
name="openshift3/cri-o" \
License="GPLv2+" \
io.k8s.display-name="CRI-O" \
summary="OCI-based implementation of Kubernetes Container Runtime Interface" \
cri-o - OCI-based implementation of Kubernetes Container Runtime Interface
# DESCRIPTION
CRI-O is an implementation of the Kubernetes CRI. It is a lightweight, OCI-compliant runtime that is native to kubernetes. CRI-O supports OCI container images and can pull from any container registry.
You can find more information on the CRI-O project at <https://github.com/kubernetes-incubator/cri-o/>
# USAGE
Pull from local docker and install system container:
OCI-based implementation of Kubernetes Container Runtime Interface Daemon
crio is meant to provide an integration path between OCI conformant runtimes and the kubelet. Specifically, it implements the Kubelet Container Runtime Interface (CRI) using OCI conformant runtimes. The scope of crio is tied to the scope of the CRI.
1. Support multiple image formats including the existing Docker image format.
2. Support for multiple means to download images including trust & image verification.
1. List of insecure registries can contain an element with CIDR notation to specify a whole subnet.
2. Insecure registries accept HTTP or accept HTTPS with certificates from unknown CAs.
3. Enabling `--insecure-registry` is useful when running a local registry. However, because its use creates security vulnerabilities, **it should ONLY be enabled for testing purposes**. For increased security, users should add their CA to their system's list of trusted CAs instead of using `--insecure-registry`.
**--image-volumes**="": Image volume handling ('mkdir', 'bind' or 'ignore') (default: "mkdir")
1. mkdir: A directory is created inside the container root filesystem for the volumes.
2. bind: A directory is created inside container state directory and bind mounted into the container for the volumes.
3. ignore: All volumes are just ignored and no action is taken.
**--listen**="": Path to CRI-O socket (default: "/var/run/crio/crio.sock")
**--log**="": Set the log file path where internal debug information is written
**--log-format**="": Set the format used by logs ('text' (default), or 'json') (default: "text")
**--log-level**="": log crio messages above specified level: debug, info (default), warn, error, fatal or panic
**--log-size-max**="": Maximum log size in bytes for a container (default: -1 (no limit)). If it is positive, it must be >= 8192 (to match/exceed conmon read buffer).
**--pause-command**="": Path to the pause executable in the pause image (default: "/pause")
**--pause-image**="": Image which contains the pause executable (default: "kubernetes/pause")
**--pids-limit**="": Maximum number of processes allowed in a container (default: 1024)
**--enable-shared-pid-namespace**="": Enable using a shared PID namespace for containers in a pod (default: false)
**--root**="": The crio root dir (default: "/var/lib/containers/storage")
**--registry**="": Registry host which will be prepended to unqualified images, can be specified multiple times
**--runroot**="": The crio state dir (default: "/var/run/containers/storage")
Maximum size of a container image. Default is 10GB. The size flag sets quota on the size of container images.
storage_option=[ "overlay.size=1G", ]
Note: Not all drivers support all options.
Note: In order to use the **size** option for quota on *overlay* storage you must use the *xfs* file system. The mount point that the *overlay* file system must be setup with the *pquota* flag at mount time. If you are setting up / to be used with quota, you have to modify the linux boot line in /etc/grubq2.conf and add the rootflags=pquota flag.
OCI-based implementation of Kubernetes Container Runtime Interface Daemon
ocid is meant to provide an integration path between OCI conformant runtimes and the kubelet. Specifically, it implements the Kubelet Container Runtime Interface (CRI) using OCI conformant runtimes. The scope of ocid is tied to the scope of the CRI.
* Support multiple image formats including the existing Docker image format
* Support for multiple means to download images including trust & image verification
