support runsc container-less sandbox mode#13628
Open
copybara-service[bot] wants to merge 1 commit into
Open
Conversation
Add support to `runsc` to boot the Sentry into an idle state without starting a root container (no `/pause` process). It supports the containerd Sandbox API and eliminate the need for a pause container for each sandbox. The change does * Add a `--sandbox` flag to `runsc` config to enable this mode. * For `runsc create`, bypass spec disk read and gofer creation when `--sandbox` is enabled, as there is no rootfs or config.json on disk for an idle sandbox. * In loader (`runsc/boot/loader.go`), skip starting the root container process if running in sandbox mode. * Have `sandboxShutdownCh` in the loader to keep Sentry alive and idle. Sentry will exit only when this channel is closed. * Use `memfd` instead of `os.Pipe` to pass the OCI spec to `runsc boot` during startup. This allows the spec to be read multiple times across `execve` (needed for capability drop phases) without writing it to disk. * Handle empty string in Gofer mount configuration parsing. assisted-by: agy PiperOrigin-RevId: 943546046
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
support runsc container-less sandbox mode
Add support to
runscto boot the Sentry into an idle state without starting aroot container (no
/pauseprocess). It supports the containerd Sandbox APIand eliminate the need for a pause container for each sandbox.
The change does
--sandboxflag torunscconfig to enable this mode.runsc create, bypass spec disk read and gofer creation when--sandboxis enabled, as there is no rootfs or config.json on disk for an idle sandbox.
runsc/boot/loader.go), skip starting the root container processif running in sandbox mode.
sandboxShutdownChin the loader to keep Sentry alive and idle.Sentry will exit only when this channel is closed.
memfdinstead ofos.Pipeto pass the OCI spec torunsc bootduringstartup. This allows the spec to be read multiple times across
execve(needed for capability drop phases) without writing it to disk.
assisted-by: agy