Documentation
¶
Overview ¶
Package cdiinject applies CDI container edits to an actor's OCI bundle.
This is the gVisor shape and does not generalize: it writes a bundle on disk, and it resolves device numbers by stat'ing the host, which only means anything for a sandbox on the host kernel. A micro-VM ships its OCI spec to the guest agent and needs the device passed through by VFIO first, so it would read the same spec (see internal/cdi) and apply it its own way.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IntoBundle ¶
IntoBundle merges a CDI spec into the OCI config.json in bundleDir: device nodes with their numbers resolved from the host, mounts, env, and the allowlisted hooks.
Injecting twice would double every entry, so a bundle that already carries injected device nodes is left alone.
func StageSonameSymlinks ¶
StageSonameSymlinks writes each driver library's SONAME symlink (e.g. libcuda.so.1 -> libcuda.so.580.65.06) into rootfs, so programs that link against the SONAME resolve it. For each CDI library mount it reads the library's ELF DT_SONAME and, when that differs from the mounted filename, writes a relative symlink alongside the mount destination; the real library file arrives at runtime via the CDI bind-mount into the same directory.
A library whose SONAME cannot be read is skipped rather than failing the actor, so one odd file cannot cost us the whole GPU. That is logged: the missing symlink surfaces much later, as a loader error in the workload, with nothing pointing back here. Every path component under rootfs comes from the actor image, so the writes go through os.Root: an image that ships a driver-mount's parent directory as a symlink out of the rootfs would otherwise have the kernel resolve it in ateom's mount namespace, where the shared image cache and other actors' bundles are mounted. Same treatment as createExtraDirs in internal/imagecache.
Types ¶
type Options ¶
type Options struct {
// Devices names the CDI devices to apply.
Devices []string
// AllowedHooks are the createContainer hooks that may run, by their first
// argument. An allowlist because the generator is usually the cluster's own
// toolkit, so its version is not ours to choose and a newer one can emit
// hooks nobody has reviewed against this sandbox's posture.
AllowedHooks map[string]bool
// HookBinary replaces the hook path the spec carries, so hooks run from a
// binary the caller trusts rather than wherever the generator pointed.
HookBinary string
// LibraryDirs are prepended to the container's LD_LIBRARY_PATH.
LibraryDirs []string
// DropEnv are environment variables to remove from the container.
DropEnv []string
}
Options tune what a merge is allowed to do. Everything vendor-specific lives here rather than in the merge itself.
Source Files