blob: 02e82eb3210dcfd5f872b8834cb2eec16fa98507 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
|
# Containerd Quick Start
This document describes how to use `containerd-shim-runsc-v1` with the
containerd runtime handler support on `containerd`.
> ⚠️ NOTE: If you are using Kubernetes and set up your cluster using kubeadm you
> may run into issues. See the [FAQ](../FAQ.md#runtime-handler) for details.
## Requirements
- **runsc** and **containerd-shim-runsc-v1**: See the
[installation guide](/docs/user_guide/install/).
- **containerd**: See the [containerd website](https://containerd.io/) for
information on how to install containerd. **Minimal version supported: 1.3.9
or 1.4.3.**
## Configure containerd
Update `/etc/containerd/config.toml`. Make sure `containerd-shim-runsc-v1` is in
`${PATH}` or in the same directory as `containerd` binary.
```shell
cat <<EOF | sudo tee /etc/containerd/config.toml
disabled_plugins = ["restart"]
[plugins.linux]
shim_debug = true
[plugins.cri.containerd.runtimes.runsc]
runtime_type = "io.containerd.runsc.v1"
EOF
```
Restart `containerd`:
```shell
sudo systemctl restart containerd
```
## Usage
You can run containers in gVisor via containerd's CRI.
### Install crictl
Download and install the `crictl` binary:
```shell
{
wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.13.0/crictl-v1.13.0-linux-amd64.tar.gz
tar xf crictl-v1.13.0-linux-amd64.tar.gz
sudo mv crictl /usr/local/bin
}
```
Write the `crictl` configuration file:
```shell
cat <<EOF | sudo tee /etc/crictl.yaml
runtime-endpoint: unix:///run/containerd/containerd.sock
EOF
```
### Create the nginx sandbox in gVisor
Pull the nginx image:
```shell
sudo crictl pull nginx
```
Create the sandbox creation request:
```shell
cat <<EOF | tee sandbox.json
{
"metadata": {
"name": "nginx-sandbox",
"namespace": "default",
"attempt": 1,
"uid": "hdishd83djaidwnduwk28bcsb"
},
"linux": {
},
"log_directory": "/tmp"
}
EOF
```
Create the pod in gVisor:
```shell
SANDBOX_ID=$(sudo crictl runp --runtime runsc sandbox.json)
```
### Run the nginx container in the sandbox
Create the nginx container creation request:
```shell
cat <<EOF | tee container.json
{
"metadata": {
"name": "nginx"
},
"image":{
"image": "nginx"
},
"log_path":"nginx.0.log",
"linux": {
}
}
EOF
```
Create the nginx container:
```shell
CONTAINER_ID=$(sudo crictl create ${SANDBOX_ID} container.json sandbox.json)
```
Start the nginx container:
```shell
sudo crictl start ${CONTAINER_ID}
```
### Validate the container
Inspect the created pod:
```shell
sudo crictl inspectp ${SANDBOX_ID}
```
Inspect the nginx container:
```shell
sudo crictl inspect ${CONTAINER_ID}
```
Verify that nginx is running in gVisor:
```shell
sudo crictl exec ${CONTAINER_ID} dmesg | grep -i gvisor
```
### Set up the Kubernetes RuntimeClass
Install the RuntimeClass for gVisor:
```shell
cat <<EOF | kubectl apply -f -
apiVersion: node.k8s.io/v1beta1
kind: RuntimeClass
metadata:
name: gvisor
handler: runsc
EOF
```
Create a Pod with the gVisor RuntimeClass:
```shell
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
name: nginx-gvisor
spec:
runtimeClassName: gvisor
containers:
- name: nginx
image: nginx
EOF
```
Verify that the Pod is running:
```shell
kubectl get pod nginx-gvisor -o wide
```
|
