From 4e4d55b9436df5a8e284074c5dda5cffca262005 Mon Sep 17 00:00:00 2001 From: Adin Scannell Date: Tue, 5 Nov 2019 17:55:06 -0500 Subject: Re-add apt-based installation instructions. --- content/docs/user_guide/install.md | 64 +++++++++++++++++--------------------- 1 file changed, 29 insertions(+), 35 deletions(-) (limited to 'content/docs/user_guide') diff --git a/content/docs/user_guide/install.md b/content/docs/user_guide/install.md index bc8a60b5b..a76383b06 100644 --- a/content/docs/user_guide/install.md +++ b/content/docs/user_guide/install.md @@ -13,12 +13,21 @@ release channels. You should pick the version you'd like to install. For experimentation, the nightly release is recommended. For production use, the latest release is recommended. - +### HEAD + +Binaries are available for every commit on the `master` branch, and are +available at the following URL: + + `https://storage.googleapis.com/gvisor/releases/master/latest/runsc` + +Checksums for the release binary are at: + + `https://storage.googleapis.com/gvisor/releases/master/latest/runsc.sha512` + +For `apt` installation, use the `master` as the `${DIST}` below. ### Nightly @@ -37,10 +46,7 @@ Specific nightly releases can be found at: Note that a release may not be available for every day. - - - +## Install directly -For example, the latest nightly binary can be downloaded, validated, -and placed in an appropriate location by running: +The binary URLs provided above can be used to install directly. For example, the +latest nightly binary can be downloaded, validated, and placed in an appropriate +location by running: ```bash ( -- cgit v1.2.3 From 350657f6ac98ee00701182d5506bb2906b848b94 Mon Sep 17 00:00:00 2001 From: Tyler Kennedy Date: Thu, 19 Dec 2019 15:11:17 -0500 Subject: FAQ Typo (Docker -> Kubernetes) --- content/docs/user_guide/FAQ.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'content/docs/user_guide') diff --git a/content/docs/user_guide/FAQ.md b/content/docs/user_guide/FAQ.md index 2cee17477..9a6a584cd 100644 --- a/content/docs/user_guide/FAQ.md +++ b/content/docs/user_guide/FAQ.md @@ -29,7 +29,7 @@ Yes. Please see the [Docker Quick Start][docker]. ### Can I run Kubernetes pods using gVisor. -Yes. Please see the [Docker Quick Start][k8s]. +Yes. Please see the [Kubernetes Quick Start][k8s]. ### What's the security model? -- cgit v1.2.3 From afbd4a130b3b49224b8c25a50d2bf1cfadd49ed3 Mon Sep 17 00:00:00 2001 From: Michael Pratt Date: Wed, 8 Jan 2020 16:58:30 -0800 Subject: Use question marks for questions --- content/docs/user_guide/FAQ.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'content/docs/user_guide') diff --git a/content/docs/user_guide/FAQ.md b/content/docs/user_guide/FAQ.md index 9a6a584cd..74acaa125 100644 --- a/content/docs/user_guide/FAQ.md +++ b/content/docs/user_guide/FAQ.md @@ -23,11 +23,11 @@ gVisor supports Linux Binaries run in gVisor should be built for the [AMD64](https://en.wikipedia.org/wiki/X86-64) CPU architecture. -### Can I run Docker images using gVisor. +### Can I run Docker images using gVisor? Yes. Please see the [Docker Quick Start][docker]. -### Can I run Kubernetes pods using gVisor. +### Can I run Kubernetes pods using gVisor? Yes. Please see the [Kubernetes Quick Start][k8s]. -- cgit v1.2.3 From eae7c2f6bd27f7553d77e60842a4bddc09cac5c5 Mon Sep 17 00:00:00 2001 From: Ian Lewis Date: Sat, 21 Dec 2019 02:59:04 -0500 Subject: Add a tutorial on CNI --- content/docs/tutorials/cni.md | 175 +++++++++++++++++++++++++++++ content/docs/tutorials/kubernetes.md | 3 +- content/docs/user_guide/quick_start/oci.md | 2 +- 3 files changed, 178 insertions(+), 2 deletions(-) create mode 100644 content/docs/tutorials/cni.md (limited to 'content/docs/user_guide') diff --git a/content/docs/tutorials/cni.md b/content/docs/tutorials/cni.md new file mode 100644 index 000000000..da0974a69 --- /dev/null +++ b/content/docs/tutorials/cni.md @@ -0,0 +1,175 @@ ++++ +title = "Using CNI" +weight = 1 ++++ + +This tutorial will show you how to set up networking for a gVisor sandbox using +the [Container Networking Interface (CNI)](https://github.com/containernetworking/cni). + +## Install CNI Plugins + +First you will need to install the CNI plugins. CNI plugins are used to set up +a network namespace that `runsc` can use with the sandbox. + +Start by creating the directories for CNI plugin binaries: + +``` +sudo mkdir -p /opt/cni/bin +``` + +Download the CNI plugins: + +``` +wget https://github.com/containernetworking/plugins/releases/download/v0.8.3/cni-plugins-linux-amd64-v0.8.3.tgz +``` + +Next, unpack the plugins into the CNI binary directory: + +``` +sudo tar -xvf cni-plugins-linux-amd64-v0.8.3.tgz -C /opt/cni/bin/ +``` + +## Configure CNI Plugins + +This section will show you how to configure CNI plugins. This tutorial will use +the "bridge" and "loopback" plugins which will create the necessary bridge and +loopback devices in our network namespace. However, you should be able to use +any CNI compatible plugin to set up networking for gVisor sandboxes. + +The bridge plugin configuration specifies the IP address subnet range for IP +addresses that will be assigned to sandboxes as well as the network routing +configuration. This tutorial will assign IP addresses from the `10.22.0.0/16` +range and allow all outbound traffic, however you can modify this configuration +to suit your use case. + +Create the bridge and loopback plugin configurations: + +``` +sudo mkdir -p /etc/cni/net.d + +sudo sh -c 'cat > /etc/cni/net.d/10-bridge.conf << EOF +{ + "cniVersion": "0.4.0", + "name": "mynet", + "type": "bridge", + "bridge": "cni0", + "isGateway": true, + "ipMasq": true, + "ipam": { + "type": "host-local", + "subnet": "10.22.0.0/16", + "routes": [ + { "dst": "0.0.0.0/0" } + ] + } +} +EOF' + +sudo sh -c 'cat > /etc/cni/net.d/99-loopback.conf << EOF +{ + "cniVersion": "0.4.0", + "name": "lo", + "type": "loopback" +} +EOF' +``` + +## Create a Network Namespace + +For each gVisor sandbox you will create a network namespace and configure it +using CNI. First, create a random network namespace name and then create +the namespace. + +The network namespace path will then be `/var/run/netns/${CNI_CONTAINERID}`. + +``` +export CNI_PATH=/opt/cni/bin +export CNI_CONTAINERID=$(printf '%x%x%x%x' $RANDOM $RANDOM $RANDOM $RANDOM) +export CNI_COMMAND=ADD +export CNI_NETNS=/var/run/netns/${CNI_CONTAINERID} + +sudo ip netns add ${CNI_CONTAINERID} +``` + +Next, run the bridge and loopback plugins to apply the configuration that was +created earlier to the namespace. Each plugin outputs some JSON indicating the +results of executing hte plugin. For example, The bridge plugin's response +includes the IP address assigned to the ethernet device created in the network +namespace. Take note of the IP address for use later. + +``` +export CNI_IFNAME="eth0" +sudo -E /opt/cni/bin/bridge < /etc/cni/net.d/10-bridge.conf +export CNI_IFNAME="lo" +sudo -E /opt/cni/bin/loopback < /etc/cni/net.d/99-loopback.conf +``` + +Get the IP address assigned to our sandbox: + +``` +POD_IP=$(sudo ip netns exec ${CNI_CONTAINERID} ip -4 addr show eth0 | grep -oP '(?<=inet\s)\d+(\.\d+){3}') +``` + +## Create the OCI Bundle + +Now that our network namespace is created and configured, we can create the OCI +bundle for our container. As part of the bundle's `config.json` we will specify +that the container use the network namespace that we created. + +The container will run a simple python webserver that we will be able to +connect to via the IP address assigned to it via the bridge CNI plugin. + +Create the bundle and root filesystem directories: + +``` +sudo mkdir -p bundle +cd bundle +sudo mkdir rootfs +sudo docker export $(docker create python) | sudo tar --same-owner -pxf - -C rootfs +sudo mkdir -p rootfs/var/www/html +sudo sh -c 'echo "Hello World!" > rootfs/var/www/html/index.html' +``` + +Next create the `config.json` specifying the network namespace. +``` +sudo /usr/local/bin/runsc spec +sudo sed -i 's;"sh";"python", "-m", "http.server";' config.json +sudo sed -i "s;\"cwd\": \"/\";\"cwd\": \"/var/www/html\";" config.json +sudo sed -i "s;\"type\": \"network\";\"type\": \"network\",\n\t\t\t\t\"path\": \"/var/run/netns/${CNI_CONTAINERID}\";" config.json +``` + +## Run the Container + +Now we can run and connect to the webserver. Run the container in gVisor. Use +the same ID used for the network namespace to be consistent: + +``` +sudo runsc run -detach ${CNI_CONTAINERID} +``` + +Connect to the server via the sandbox's IP address: + +``` +curl http://${POD_IP}:8000/ +``` + +You should see the server returning `Hello World!`. + +## Cleanup + +After you are finished running the container, you can clean up the network +namespace . + +``` +sudo runsc kill ${CNI_CONTAINERID} +sudo runsc delete ${CNI_CONTAINERID} + +export CNI_COMMAND=DEL + +export CNI_IFNAME="lo" +sudo -E /opt/cni/bin/loopback < /etc/cni/net.d/99-loopback.conf +export CNI_IFNAME="eth0" +sudo -E /opt/cni/bin/bridge < /etc/cni/net.d/10-bridge.conf + +sudo ip netns delete ${CNI_CONTAINERID} +``` diff --git a/content/docs/tutorials/kubernetes.md b/content/docs/tutorials/kubernetes.md index 03acac756..5b65ba20f 100644 --- a/content/docs/tutorials/kubernetes.md +++ b/content/docs/tutorials/kubernetes.md @@ -1,5 +1,6 @@ +++ title = "WordPress with Kubernetes" +weight = 11 +++ ## Deploy a WordPress site using GKE Sandbox @@ -235,4 +236,4 @@ a look at the [documentation][gke-sandbox-docs]. [gke-sandbox-docs]: https://cloud.google.com/kubernetes-engine/docs/how-to/sandbox-pods [gke-sandbox]: https://cloud.google.com/kubernetes-engine/sandbox/ [project-selector]: https://console.cloud.google.com/projectselector/kubernetes -[wordpress]: https://wordpress.com/ \ No newline at end of file +[wordpress]: https://wordpress.com/ diff --git a/content/docs/user_guide/quick_start/oci.md b/content/docs/user_guide/quick_start/oci.md index b39be069e..fc39525d0 100644 --- a/content/docs/user_guide/quick_start/oci.md +++ b/content/docs/user_guide/quick_start/oci.md @@ -43,7 +43,7 @@ Finally run the container. sudo runsc run hello ``` -Next try [running gVisor using Docker](../docker/). +Next try [using CNI to set up networking](../../../tutorials/cni/) or [running gVisor using Docker](../docker/). [oci]: https://opencontainers.org/ -- cgit v1.2.3