diff options
| author | Nicolas Lacasse <nlacasse@google.com> | 2018-08-14 16:24:46 -0700 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2018-08-14 16:25:58 -0700 |
| commit | e8a4f2e133c3a7fb4a2dceb6675ebc57ea4f7350 (patch) | |
| tree | c95b1a34bbf725905ea6afa5a74e52982abaff28 /pkg | |
| parent | d4939f6dc22e5607cf2ff8d2a9eb1178e47b0a22 (diff) | |
runsc: Change cache policy for root fs and volume mounts.
Previously, gofer filesystems were configured with the default "fscache"
policy, which caches filesystem metadata and contents aggressively. While this
setting is best for performance, it means that changes from inside the sandbox
may not be immediately propagated outside the sandbox, and vice-versa.
This CL changes volumes and the root fs configuration to use a new
"remote-revalidate" cache policy which tries to retain as much caching as
possible while still making fs changes visible across the sandbox boundary.
This cache policy is enabled by default for the root filesystem. The default
value for the "--file-access" flag is still "proxy", but the behavior is
changed to use the new cache policy.
A new value for the "--file-access" flag is added, called "proxy-exclusive",
which turns on the previous aggressive caching behavior. As the name implies,
this flag should be used when the sandbox has "exclusive" access to the
filesystem.
All volume mounts are configured to use the new cache policy, since it is
safest and most likely to be correct. There is not currently a way to change
this behavior, but it's possible to add such a mechanism in the future. The
configurability is a smaller issue for volumes, since most of the expensive
application fs operations (walking + stating files) will likely served by the
root fs.
PiperOrigin-RevId: 208735037
Change-Id: Ife048fab1948205f6665df8563434dbc6ca8cfc9
Diffstat (limited to 'pkg')
| -rw-r--r-- | pkg/sentry/fs/gofer/cache_policy.go | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/pkg/sentry/fs/gofer/cache_policy.go b/pkg/sentry/fs/gofer/cache_policy.go index 52d97b54f..fa8abf51c 100644 --- a/pkg/sentry/fs/gofer/cache_policy.go +++ b/pkg/sentry/fs/gofer/cache_policy.go @@ -35,10 +35,9 @@ const ( // fs agent immediately. cacheAllWritethrough - // Use virtual file system cache for everything, but reload dirents - // from the remote filesystem on each lookup. Thus, if the remote - // filesystem has changed, the returned dirent will have the updated - // state. + // Use the (host) page cache for reads/writes, but don't cache anything + // else. This allows the sandbox filesystem to stay in sync with any + // changes to the remote filesystem. // // This policy should *only* be used with remote filesystems that // donate their host FDs to the sandbox and thus use the host page |