unikontainers

package
v0.8.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 7, 2026 License: Apache-2.0 Imports: 45 Imported by: 0

Documentation

Index

Constants

View Source 
const UruncConfigFileEnv = "URUNC_CONFIG_FILE"

UruncConfigFileEnv is the environment variable that overrides the default location of the urunc configuration file.

View Source 
const UruncConfigPath = "/etc/urunc/config.toml"

Variables

View Source 
var ErrCopyDir = errors.New("can not copy a directory")
View Source 
var ErrMountpoint = errors.New("no FS is mounted in this mountpoint")
View Source 
var ErrNotExistingNS = errors.New("the namespace does not exist")
View Source 
var ErrNotUnikernel = errors.New("this is not a unikernel container")
View Source 
var ErrQueueProxy = errors.New("this a queue proxy container")
View Source 
var ErrVAccelDisabled = errors.New("vaccel is disabled")

ErrVAccelDisabled is returned by resolveVAccelConfig when the vAccel annotation is absent. This is an expected condition, not a misconfiguration.

Functions

func AwaitMessage 

func AwaitMessage(listener *net.UnixListener, expectedMessage IPCMessage) error

awaitMessage opens a new connection to socketAddress and waits for a given message

func ChooseRootfs added in v0.8.0 

func ChooseRootfs(bundle, specRoot string, annot map[string]string, cfg *UruncConfig) (types.RootfsParams, error)

chooseRootfs determines the best rootfs configuration based on available options Priority order:

  1. Initrd (if specified)
  2. Explicit block device annotation (if mounted at /)
  3. Container rootfs as block device (if MountRootfs=true and supported)
  4. Container rootfs as shared-fs: virtiofs > 9pfs (if MountRootfs=true and supported)
  5. No rootfs

func CreateReadyPipe added in v0.8.0 

func CreateReadyPipe(baseDir string) (*os.File, error)

CreateReadyPipe creates the ready FIFO in the container's state dir and opens its write end. The returned file is meant to be passed as the urunc's monitor process' single Process.ExtraFiles entry, so the monitor inherits it at ReadyPipeFD.

func ExecMonitor added in v0.8.0 

func ExecMonitor(metrics m.Writer) error

ExecMonitor is the entry point of the urunc process libcontainer starts inside the monitor's container. It reads the monitor spec, finalizes the environment for the monitor execution and execs it.

func LoadMonitorSpec added in v0.8.0 

func LoadMonitorSpec(dir string) (monitorSpec, error)

LoadMonitorSpec reads the monitor spec-file from dir

func MonitorCapabilities added in v0.8.0 

func MonitorCapabilities(spec *specs.Spec) *configs.Capabilities

MonitorCapabilities returns the capability set the monitor process requires to finalize the execution environment for the monitor. Currently, it consists of the container's own set plus CAP_NET_ADMIN in all five sets. TODO: Narrow down to the extremely necessary capabilities.

func ResolveUruncConfigPath added in v0.8.0 

func ResolveUruncConfigPath() string

ResolveUruncConfigPath returns the path to the urunc configuration file. It uses the URUNC_CONFIG_FILE environment variable when it is set and falls back to UruncConfigPath (/etc/urunc/config.toml) otherwise.

func SendIPCMessage 

func SendIPCMessage(socketAddress string, message IPCMessage) error

SendIPCMessage creates a new connection to socketAddress, sends the message and closes the connection

func SetupNet added in v0.8.0 

func SetupNet(networkType string, uid, gid uint32) (types.NetDevParams, error)

SetupNet creates the sandbox's network device (tap) in the current network namespace and returns its parameters; uid and gid own the tap device.

func SockAddrExists 

func SockAddrExists(sockAddr string) bool

sockAddrExists returns true if given sock address exists returns false if any error is encountered

Types

type IPCMessage 

type IPCMessage string
const (

	// ReadyPipeFD is the descriptor the FIFO's write end lands on inside
	// the urunc monitor process.The ready pipe is passed as the single,
	// first ExtraFile so it is always fd 3. All other files are placed after it.
	ReadyPipeFD = 3

	ReexecStarted IPCMessage = "RX_START"
	AckReexec     IPCMessage = "UC_ACK"
	StartExecve   IPCMessage = "UC_START"
	StartSuccess  IPCMessage = "RX_SUCCESS"
	StartErr      IPCMessage = "RX_ERROR"

	FromReexec = true
)

type LogMetricsUruncConfig 

type LogMetricsUruncConfig struct {
	Log        UruncLog        `toml:"log"`
	Timestamps UruncTimestamps `toml:"timestamps"`
}

this struct is used to parse only the log and timestamp section of the urunc config file

func ParseLogMetricsConfig 

func ParseLogMetricsConfig(path string) (LogMetricsUruncConfig, error)

type UnikernelConfig 

type UnikernelConfig struct {
	UnikernelType    string `json:"com.urunc.unikernel.unikernelType"`
	UnikernelVersion string `json:"com.urunc.unikernel.unikernelVersion"`
	UnikernelBinary  string `json:"com.urunc.unikernel.binary"`
	Hypervisor       string `json:"com.urunc.unikernel.hypervisor"`
	Initrd           string `json:"com.urunc.unikernel.initrd,omitempty"`
	Block            string `json:"com.urunc.unikernel.block,omitempty"`
	BlkMntPoint      string `json:"com.urunc.unikernel.blkMntPoint,omitempty"`
	MountRootfs      string `json:"com.urunc.unikernel.mountRootfs"`
	NetDev           string `json:"com.urunc.unikernel.solo5NetDev,omitempty"`
	BlkDev           string `json:"com.urunc.unikernel.solo5BlkDev,omitempty"`
	// The vAccel annotations are deliberately not part of urunc.json, since their
	// values are runtime specific and therefore we should only reach them
	// through the annotations of the spec.
	VAccel     string `json:"-"`
	RPCAddress string `json:"-"`
}

A UnikernelConfig struct holds the info provided by bima image on how to execute our unikernel

func GetUnikernelConfig 

func GetUnikernelConfig(bundleDir string, spec *specs.Spec) (*UnikernelConfig, error)

GetUnikernelConfig tries to get the Unikernel config from the bundle annotations. If that fails, it gets the Unikernel config from the urunc.json file inside the rootfs.

func (*UnikernelConfig) Map 

func (c *UnikernelConfig) Map() map[string]string

Map returns a map containing the Unikernel config data

type Unikontainer 

type Unikontainer struct {
	State    *specs.State
	Spec     *specs.Spec
	BaseDir  string
	RootDir  string
	UruncCfg *UruncConfig
	Listener *net.UnixListener
	Conn     *net.UnixConn
	// contains filtered or unexported fields
}

Unikontainer holds the data necessary to create, manage and delete unikernel containers

func Get 

func Get(containerID string, rootDir string) (*Unikontainer, error)

Get retrieves unikernel data from disk to create a Unikontainer object

func New 

func New(bundlePath string, containerID string, rootDir string, cfg *UruncConfig) (*Unikontainer, error)

New parses the bundle and creates a new Unikontainer object

func (*Unikontainer) AwaitMsg 

func (u *Unikontainer) AwaitMsg(msg IPCMessage) error

AwaitMessage waits for a specific message in the listener of unikontainer instance

func (*Unikontainer) BuildContainerConfig added in v0.8.0 

func (u *Unikontainer) BuildContainerConfig(systemdCgroup bool) (*configs.Config, error)

BuildContainerConfig modifies the container's OCI spec, according to the monitor mounts and devices gathered during InitialSetup

func (*Unikontainer) Create 

func (u *Unikontainer) Create(pid int, pidFilePath string) error

Create sets the Unikernel status as created, and saves the given PID in the provided pid file path. If pidFilePath is empty, it falls back to the default init.pid path.

func (*Unikontainer) CreateConn 

func (u *Unikontainer) CreateConn(isReexec bool) error

CreateConn opens a new connection to a unix socket. If the caller is reexec then the new connection will refer to the uruncSock, the socket that holds messages from reexec to urunc instances If it is not the reexec process then the connection will refer to the ReexecSock, the socket that holds messages from urunc instances to the reexec process

func (*Unikontainer) CreateListener 

func (u *Unikontainer) CreateListener(isReexec bool) error

CreateListener creates a new listener over a Unix socket. If the caller is reexec then the new listener will refer to the ReexecSock, the socket that holds messages from urunc instances to the reexec process If it is not the reexec process then the listener will refer to the uruncSock, the socket that holds messages from reexec to urunc instances

func (*Unikontainer) Delete 

func (u *Unikontainer) Delete() error

Delete removes the monitor rootfs and the container's base directory.

func (*Unikontainer) DestroyConn 

func (u *Unikontainer) DestroyConn(isReexec bool) error

DestroyListenerReexec destroys an existing listener over a socket

func (*Unikontainer) DestroyListener 

func (u *Unikontainer) DestroyListener(isReexec bool) error

DestroyListener destroys an existing listener over a socket

func (*Unikontainer) Exec 

func (u *Unikontainer) Exec(metrics m.Writer) error

nolint:gocyclo

func (*Unikontainer) ExecuteHooks 

func (u *Unikontainer) ExecuteHooks(name string) error

func (*Unikontainer) FormatNsenterInfo 

func (u *Unikontainer) FormatNsenterInfo() (rdr io.Reader, retErr error)

nolint:gocyclo FormatNsenterInfo encodes namespace info in netlink binary format as a io.Reader, in order to send the info to nsenter. The implementation is inspired from: https://github.com/opencontainers/runc/blob/c8737446d2f99c1b7f2fcf374a7ee5b4519b2051/libcontainer/container_linux.go#L1047

func (*Unikontainer) InitialSetup 

func (u *Unikontainer) InitialSetup() error

InitialSetup sets the Unikernel status as creating, creates the Unikernel base directory and saves the state.json file with the current Unikernel state

func (*Unikontainer) Kill 

func (u *Unikontainer) Kill() error

Kill stops the VMM process, first by asking the VMM struct to stop and consequently by killing the process described in u.State.Pid

func (*Unikontainer) LibcontainerRoot added in v0.8.0 

func (u *Unikontainer) LibcontainerRoot() string

LibcontainerRoot returns the state directory libcontainer uses for the monitor's process execution environment. It is placed under the root directory

func (*Unikontainer) SendMessage 

func (u *Unikontainer) SendMessage(message IPCMessage) error

SendMessage sends message over the active connection

func (*Unikontainer) SetRunningState 

func (u *Unikontainer) SetRunningState() error

SetRunningState sets the Unikernel status as running,

func (*Unikontainer) Signal added in v0.8.0 

func (u *Unikontainer) Signal(signal unix.Signal) error

Signal sends a specified signal to container's init.

type UruncConfig 

type UruncConfig struct {
	Log        UruncLog                        `toml:"log"`
	Timestamps UruncTimestamps                 `toml:"timestamps"`
	Runtime    UruncRuntime                    `toml:"runtime"`
	Monitors   map[string]types.MonitorConfig  `toml:"monitors"`
	ExtraBins  map[string]types.ExtraBinConfig `toml:"extra_binaries"`
}

func LoadUruncConfig 

func LoadUruncConfig(path string) (*UruncConfig, error)

LoadUruncConfig loads the urunc configuration from the specified path. If the file does not exist or is malformed, it returns the default configuration.

func UruncConfigFromMap 

func UruncConfigFromMap(cfgMap map[string]string) *UruncConfig

func (*UruncConfig) Map 

func (p *UruncConfig) Map() map[string]string

type UruncLog 

type UruncLog struct {
	Level  string `toml:"level"`
	Syslog bool   `toml:"syslog"`
}

type UruncRuntime added in v0.8.0 

type UruncRuntime struct {
	// Libcontainer selects whether the monitor's execution environment
	// is set up through runc's libcontainer instead of urunc's own implementation.
	Libcontainer bool `toml:"libcontainer"`
	// VAccel is required to accept vAccel related annotations.
	VAccel bool `toml:"vAccel"`
}

UruncRuntime holds runtime-wide behavior options.

type UruncTimestamps 

type UruncTimestamps struct {
	Enabled     bool   `toml:"enabled"`
	Destination string `toml:"destination"` // Used to specify a file for timestamps
}

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.