kata agent CreateSandbox & CreateContainer
作者：互联网
虚拟机rootfs
root@25a725e7599e:/# ls bin dev home lost+found mnt proc run srv tmp var boot etc lib media opt root sbin sys usr root@25a725e7599e:/# ls lib/ aarch64-linux-gnu ld-linux-aarch64.so.1 modprobe.d terminfo init lsb systemd udev root@25a725e7599e:/# ls bin dev home lost+found mnt proc run srv tmp var boot etc lib media opt root sbin sys usr root@25a725e7599e:/# ls bin/ps bin/ps root@25a725e7599e:/# ps -elf | grep nginx 4 S root 71 50 0 80 0 - 2069 arm64_ Oct31 ? 00:00:00 nginx: master process nginx -g daemon off; 5 S systemd+ 99 71 0 80 0 - 2164 ep_pol Oct31 ? 00:00:00 nginx: worker process 0 S root 201 57 0 80 0 - 676 pipe_w 04:54 hvc0 00:00:00 grep --color=auto nginx root@25a725e7599e:/# ls run/ kata-containers kata1.txt libcontainer lock mount sandbox-ns systemd root@25a725e7599e:/#
容器 rootfs
root@fa55c7478feb:/# ls bin/ps ls: cannot access 'bin/ps': No such file or directory root@fa55c7478feb:/# ls bin docker-entrypoint.d home mnt root srv usr boot docker-entrypoint.sh lib opt run sys var dev etc media proc sbin tmp root@fa55c7478feb:/# ps -elf | grep nginx bash: ps: command not found root@fa55c7478feb:/# ls run/ lock nginx.pid utmp root@fa55c7478feb:/#
func (a *agentGRPC) CreateSandbox(ctx context.Context, req *pb.CreateSandboxRequest) (*gpb.Empty, error) {
if a.sandbox.running {
return emptyResp, grpcStatus.Error(codes.AlreadyExists, "Sandbox already started, impossible to start again")
}
a.sandbox.hostname = req.Hostname
a.sandbox.containers = make(map[string]*container)
a.sandbox.network.ifaces = make(map[string]*types.Interface)
a.sandbox.network.dns = req.Dns
a.sandbox.running = true
a.sandbox.sandboxPidNs = req.SandboxPidns
a.sandbox.storages = make(map[string]*sandboxStorage)
a.sandbox.guestHooks = &specs.Hooks{}
a.sandbox.guestHooksPresent = false
for _, m := range req.KernelModules {
if err := loadKernelModule(m); err != nil {
return emptyResp, err
}
}
if req.GuestHookPath != "" {
a.sandbox.scanGuestHooks(req.GuestHookPath)
}
if req.SandboxId != "" {
a.sandbox.id = req.SandboxId
agentLog = agentLog.WithField("sandbox", a.sandbox.id)
}
// Set up shared UTS and IPC namespaces
if err := a.sandbox.setupSharedNamespaces(ctx); err != nil {
return emptyResp, err
}
if req.SandboxPidns {
if err := a.sandbox.setupSharedPidNs(); err != nil {
return emptyResp, err
}
}
mountList, err := addStorages(ctx, req.Storages, a.sandbox)
if err != nil {
return emptyResp, err
}
a.sandbox.mounts = mountList
if err := setupDNS(a.sandbox.network.dns); err != nil {
return emptyResp, err
}
return emptyResp, nil
}
func (a *agentGRPC) CreateContainer(ctx context.Context, req *pb.CreateContainerRequest) (resp *gpb.Empty, err error) {
if err := a.createContainerChecks(req); err != nil {
return emptyResp, err
}
// re-scan PCI bus
// looking for hidden devices
if err = rescanPciBus(); err != nil {
agentLog.WithError(err).Warn("Could not rescan PCI bus")
}
// Some devices need some extra processing (the ones invoked with
// --device for instance), and that's what this call is doing. It
// updates the devices listed in the OCI spec, so that they actually
// match real devices inside the VM. This step is necessary since we
// cannot predict everything from the caller.
if err = addDevices(ctx, req.Devices, req.OCI, a.sandbox); err != nil {
return emptyResp, err
}
// Both rootfs and volumes (invoked with --volume for instance) will
// be processed the same way. The idea is to always mount any provided
// storage to the specified MountPoint, so that it will match what's
// inside oci.Mounts.
// After all those storages have been processed, no matter the order
// here, the agent will rely on libcontainer (using the oci.Mounts
// list) to bind mount all of them inside the container.
mountList, err := addStorages(ctx, req.Storages, a.sandbox)
if err != nil {
return emptyResp, err
}
ctr := &container{
id: req.ContainerId,
processes: make(map[string]*process),
mounts: mountList,
useSandboxPidNs: req.SandboxPidns,
agentPidNs: req.AgentPidns,
ctx: ctx,
}
// In case the container creation failed, make sure we cleanup
// properly by rolling back the actions previously performed.
defer func() {
if err != nil {
a.rollbackFailingContainerCreation(ctr)
}
}()
// Add the nvdimm root partition to the device cgroup to prevent access
updateDeviceCgroupForGuestRootfs(req.OCI)
// Convert the spec to an actual OCI specification structure.
ociSpec, err := pb.GRPCtoOCI(req.OCI)
if err != nil {
return emptyResp, err
}
if err := a.handleCPUSet(ociSpec); err != nil {
return emptyResp, err
}
if err := a.applyNetworkSysctls(ociSpec); err != nil {
return emptyResp, err
}
if a.sandbox.guestHooksPresent {
// Add any custom OCI hooks to the spec
a.sandbox.addGuestHooks(ociSpec)
// write the OCI spec to a file so that hooks can read it
err = writeSpecToFile(ociSpec, req.ContainerId)
if err != nil {
return emptyResp, err
}
// Change cwd because libcontainer assumes the bundle path is the cwd:
// https://github.com/opencontainers/runc/blob/v1.0.0-rc5/libcontainer/specconv/spec_linux.go#L157
oldcwd, err := changeToBundlePath(ociSpec, req.ContainerId)
if err != nil {
return emptyResp, err
}
defer os.Chdir(oldcwd)
}
// Convert the OCI specification into a libcontainer configuration.
config, err := specconv.CreateLibcontainerConfig(&specconv.CreateOpts{
CgroupName: req.ContainerId,
NoNewKeyring: true,
Spec: ociSpec,
NoPivotRoot: a.sandbox.noPivotRoot,
})
if err != nil {
return emptyResp, err
}
// apply rlimits
config.Rlimits = posixRlimitsToRlimits(ociSpec.Process.Rlimits)
// Update libcontainer configuration for specific cases not handled
// by the specconv converter.
if err = a.updateContainerConfig(ociSpec, config, ctr); err != nil {
return emptyResp, err
}
return a.finishCreateContainer(ctr, req, config)
}
标签：return,nil,err,root,req,sandbox,CreateContainer,kata,CreateSandbox 来源： https://www.cnblogs.com/dream397/p/13909215.html