summaryrefslogtreecommitdiffhomepage
path: root/pkg/shim
AgeCommit message (Collapse)Author
2021-07-13Use consistent naming for subcontainersFabricio Voznika
It was confusing to find functions relating to root and non-root containers. Replace "non-root" and "subcontainer" and make naming consistent in Sandbox and controller. PiperOrigin-RevId: 384512518
2021-06-29Delete PID files right after they are readFabricio Voznika
The PID files are not used after they are read, so there is no point in keeping them around until the shim is deleted. Updates #6225 PiperOrigin-RevId: 382169916
2021-06-29Redirect all calls from `errdefs.ToGRPC` to `utils.ErrToGRPC`Fabricio Voznika
This is to ensure that Go 1.13 error wrapping is correctly translated to gRPC errors before returning from the shim. Updates #6225 PiperOrigin-RevId: 382120441
2021-06-24Merge pull request #6228 from ↵gVisor bot
puppetlabs:fix-shim-pid-leaking-on-stopped-processes PiperOrigin-RevId: 381341920
2021-06-23Do not attempt to kill stopped exec processesNoah Fontes
While #6204 addressed the stopped state for handling signals in the main process, it did not update exec processes in the same way. This change mirrors that adjustment for exec processes.
2021-06-23Ensure shim propagates errors over gRPC correctlyNoah Fontes
This change wraps containerd's errdefs.ToGRPC function with one that understands Go 1.13-style error wrapping style, which is used pervasively throughout the shim. With this change, errors that have been marked with, e.g., `errdefs.ErrNotFound`, will be correctly propagated back to the containerd server.
2021-06-21Improve stopped container handlingFabricio Voznika
Getting state of a stopped container would fail and could lead containerd to not detecting that the container had actually stopped. Now stopped and deleted containers return `stopped` state. Also makes other messages more consistent when container is stopped. Some where still sending messages to runsc and failing in different ways. Now they go through `initState` state machine like the other messages. There are a few changes to improve debugability with it as well. Fixes #5861 PiperOrigin-RevId: 380698513
2021-05-17Make sandbox join the pod cgroup in K8sFabricio Voznika
cgroups in K8s are setup with the following hierarchy: `.../pod/container`. The sandbox is created with the first container and consequently uses the the pause container cgroup. This change removes the container cgroup from the path to make the sandbox use the pod cgroup instead. Otherwise limits set to the pause container will apply to the entire sandbox. PiperOrigin-RevId: 374273277
2021-05-04Make Mount.Type optional for bind mountsFabricio Voznika
According to the OCI spec Mount.Type is an optional field and it defaults to "bind" when any of "bind" or "rbind" is included in Mount.Options. Also fix the shim to remove bind/rbind from options when mount is converted from bind to tmpfs inside the Sentry. Fixes #2330 Fixes #3274 PiperOrigin-RevId: 371996891
2021-03-03[op] Replace syscall package usage with golang.org/x/sys/unix in pkg/.Ayush Ranjan
The syscall package has been deprecated in favor of golang.org/x/sys. Note that syscall is still used in the following places: - pkg/sentry/socket/hostinet/stack.go: some netlink related functionalities are not yet available in golang.org/x/sys. - syscall.Stat_t is still used in some places because os.FileInfo.Sys() still returns it and not unix.Stat_t. Updates #214 PiperOrigin-RevId: 360701387
2021-01-13Fix code review issuesTravis DePrato
2021-01-13Add support for pause/restore in containerd shimTravis DePrato
2021-01-12Delete shim v1Fabricio Voznika
gvisor-containerd-shim is not compatible with containerd 1.1 or earlier. Starting from containerd 1.2, shim v2 is the preferred interface. PiperOrigin-RevId: 351485556
2021-01-12Fix simple mistakes identified by goreportcard.Adin Scannell
These are primarily simplification and lint mistakes. However, minor fixes are also included and tests added where appropriate. PiperOrigin-RevId: 351425971
2020-12-14Update containerd/cgroupsFabricio Voznika
PiperOrigin-RevId: 347532687
2020-12-11Remove existing nogo exceptions.Adin Scannell
PiperOrigin-RevId: 347047550
2020-12-03Update containerd to 1.3.9Fabricio Voznika
PiperOrigin-RevId: 345564927
2020-11-12Improve shim debug loggingFabricio Voznika
- Add log statements in service entry points. - Propagate `-debug` flag from shim invokation to the service - Load options when shim process is invoked to ensure runsc commands use the correct set of options, e.g. --debug --debug-logs=... - Add debug options to the shim configuration directly, so it doesn't rely on containerd configuration (and restart) to enable shim debug. - Save shim logs to dedicated file, so it's easier to read logs. They would be mixed with containerd logs and hard to distinguish otherwise. PiperOrigin-RevId: 342179868
2020-11-05Return failure when `runsc events` queries a stopped containerFabricio Voznika
This was causing gvisor-containerd-shim to crash because the command suceeded, but there was no stat present. PiperOrigin-RevId: 340964921
2020-10-19Remove legacy bazel configurations.Adin Scannell
Using the newer bazel rules necessitates a transition from proto1 to proto2. In order to resolve the incompatibility between proto2 and gogoproto, the cri runtimeoptions proto must be vendored. Further, some of the semantics of bazel caching changed during the transition. It is now necessary to: - Ensure that :gopath depends only on pure library targets, as the propagation of go_binary build attributes (pure, static) will affected the generated files (though content remains the same, there are conflicts with respect to the gopath). - Update bazel.mk to include the possibility of binaries in the bazel-out directory, as it will now put runsc and others there. This required some refinements to the mechanism of extracting paths, since some the existing regex resulted in false positives. - Change nogo rules to prevent escape generation on binary targets. For some reason, the newer version of bazel attempted to run the nogo analysis on the binary targets, which fails due to the fact that objdump does not work on the final binary. This must be due to a change in the semantics of aspects in bazel3. PiperOrigin-RevId: 337958324
2020-08-19Change runtimeoptions proto handling.Fabricio Voznika
Stolen from cl/327337408 (ascannell is OOO) PiperOrigin-RevId: 327475423
2020-07-13Merge pull request #2672 from amscanne:shim-integratedgVisor bot
PiperOrigin-RevId: 321053634
2020-07-09Update shim to build using bazel.Adin Scannell
The go.mod dependency tree for the shim was somehow contradictory. After resolving these issues (e.g. explicitly imported k8s 1.14, pulling a specific dbus version), and adding all dependencies, the shim can now be build as part of the regular bazel tree. As part of this process, minor cleanup was done in all the source files: headers were standardized (and include "The gVisor Authors" in addition to the "The containerd Authors" if originally derived from containerd sources), and comments were cleaned up to meet coding standards. This change makes the containerd installation dynamic, so that multiple versions can be tested, and drops the static installer for the VM image itself. This change also updates test/root/crictl_test.go and related utilities, so that the containerd tests can be run on any version (and in cases where it applies, they can be run on both v1 and v2 as parameterized tests).
2020-07-09Update canonical paths.Adin Scannell
2020-05-19Restructure shim packages for merging.Adin Scannell
2019-01-29Add containerd shim v2 support. (#13)Lantao Liu
* Update vendors Signed-off-by: Lantao Liu <lantaol@google.com> * Add containerd shim v2 support. Signed-off-by: Lantao Liu <lantaol@google.com> * Add test and doc for containerd-shim-runsc-v1. Signed-off-by: Lantao Liu <lantaol@google.com> * Address comments.
2018-12-04Initial commitIan Lewis
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-26 04:02:54 +0000