May 2021 - kata-dev - lists.katacontainers.io

OpenDev Collaboratory IRC services
by Jeremy Stanley 25 May '21

25 May '21

I know lots of people are discussing the recent Freenode IRC upheaval and what it means for their projects. On behalf of the OpenDev sysadmins I've started a thread on the service-discuss(a)lists.opendev.org mailing list to get feedback from communities currently utilizing the OpenDev Collaboratory's IRC bot services in their channels on Freenode (meeting minutes/logging, Gerrit change events, OpenDev service status information, channel operator assistance): http://lists.opendev.org/pipermail/service-discuss/2021-May/000236.html Please follow up there with your thoughts, to assist in our decision making, so we can take the needs of your project into account. Thanks! -- Jeremy Stanley

3 4

Kata Containers tracing update and request for help
by Hunt, James O 25 May '21

25 May '21

Hi All, # Summary I presented a short summary of the status of tracing with Kata Containers in the AC meeting [1] earlier today. The presentation is available in markdown format (with instructions on how to view as HTML) in [2]. # Request for help To save you clicking, we'd like to encourage more community involvement with the tracing work. You don't need to be an expert in tracing, you just need to be keen ;B As shown in the new GitHub tracing project [3], we'd really like help with testing, specifically: - on different architectures. - with different hypervisors - with different config options. However, there is also documentation and development work remaining (golang for the runtime and rust for the agent). Try typing "runtime", "agent", "test" or "doc" into the "filter cards" box to see what's available. If you're interested in any of this, add issue comments, or assign issues to yourself, or ping Chelsea or myself. Thanks for reading! Cheers, James [1] - https://etherpad.opendev.org/p/Kata_Containers_2021_Architecture_Committee_… [2] - https://gist.github.com/jodh-intel/0ee54d41d2a803ba761e166136b42277 [3] - https://github.com/orgs/kata-containers/projects/28 --- https://katacontainers.io/ | https://github.com/kata-containers Open Source Technology Center Intel Corporation (UK) Ltd. - Co. Reg. #1134945 - Pipers Way, Swindon SN3 1RJ. --------------------------------------------------------------------- Intel Corporation (UK) Limited Registered No. 1134945 (England) Registered Office: Pipers Way, Swindon SN3 1RJ VAT No: 860 2173 47 This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.

1 0

Some question about virtiofs cache and dax
by 李瑞友 25 May '21

25 May '21

Hi, guys I have Some doubts about virtiofs cache and dax . In the past two days, I have asked a few questions on WeChat and slack：https://katacontainers.slack.com/archives/C86U7NZND/p1621580960033100 , and some experts have answered some of them, which is very useful. But I still hope to get more detailed knowledge and information. @fidencio suggested that I post the question to the mailing list, so I posted it Question 1 On the official website of virtio-fs, in this article https://virtio-fs.gitlab.io/howto-qemu.html, it seems that $TESTDIR can set an existing directory on the host , but if I set the source parameter in the /usr/share/defaults/kata-containers/configuration.toml configuration file and specify a directory like /opt/kata-instance on the host # Format example: # ["-o", "arg1=xxx,arg2", "-o", "hello world", "--arg3=yyy"] # # see `virtiofsd -h` for possible options. virtio_fs_extra_args = ["-o","--thread-pool-size=1","-o","/opt/kata-instance"] kubelet will report error Warning FailedCreatePodSandBox 1s (x14 over 15s) kubelet, k8s05 Failed to create pod sandbox: rpc error: code = Unknown desc = failed to create containerd task: failed to launch qemu: exit status 1, error messages from qemu log: qemu-system- x86_64: cannot create PID file: Cannot open pid file: No such file or directory Question 2 I saw a picture that said that DAX uses the nvdimm device simulated by qemu. It seems to be a device for each VM, which is mapped to the host filesystem buffer cache. For example, there are 100 kata VMs on a single host. I set virtio_fs_cache_size=1024M, Then the host will use up to 1024M memory, or 1024M*100 memory?Also, can this shmem be writable or read-only? Is it only for kata pod images or all data read and write, including kubernetes persistence volume? From the official website of qemu, I found that nvdimm is used like this -machine pc, nvdimm -m $RAM_SIZE, slots=$N,maxmem=$MAX_SIZE -object memory-backend-file,id=mem1,share=on,mem-path=$PATH,size=$NVDIMM_SIZE -device nvdimm,id=nvdimm1,memdev=mem1 When the kata instance is created, the qemu process can see that it contains a parameter memory-backend-file, -object memory-backend-file,id=dimm1,size=3072M,mem-path=/dev/shm,share=on -numa node,memdev=dimm1 Is this cache dedicated to virtiofs? Where does dimm1 come from? It has nothing to do with nvdimm, right? Qeustion 3 Now my understanding is that kata has two caches 3.1 Data transmission between guest and virtiofsd requires a cache. The corresponding qemu parameter is -object memory-backend-file,id=dimm1,size=XXX. I guess the function of this cache may be the memory space of the simulated PCI device? It seems unlikely that it is the vring queue size used by the vhost-user protocol. Sorry, I'm not very proficient in qemu There is another question. Is the virtiofs cache specially allocated for each VM? If a single host starts many VMs, won't the memory consumption be very large? 3.2 dax, the corresponding parameter is virtio_fs_cache_size, there is no cache policy control in the kata configuration file. # Cache mode: virtio_fs_cache It controls the virtiofs cache, not DAX windows, right? Sorry，asked a lot of questions, it looks a bit scary ：） ryo from shanghai 2021-05-21

4 4

Weekly Kata Herders
by Hunt, James O 24 May '21

24 May '21

Hi All, This week's Kata PR and issue herders are: - Eric (https://github.com/egernst) - Fabiano (https://github.com/fidencio) - Salvador (https://github.com/chavafg) # Statistics ## Issues Issues opened last week: 54 Issues closed last week: 35 Open issues: 319 Issue backlog project board: https://github.com/orgs/kata-containers/projects/23 ## PRs PRs opened last week: 31 PRs closed last week: 45 Open PRs: 47 Open PRs (excluding dnm+wip): 31 # Get involved If you'd like to help get the open PRs merged and open issues resolved (or get involved in other ways with Kata), take a look at the contributing guide [2] and the rota process [3]. Any problems, just ask us [4]. Cheers, James [1] - https://github.com/kata-containers/community/wiki/Review-Team-Rota [2] - https://github.com/kata-containers/community/blob/master/CONTRIBUTING.md [3] - https://github.com/kata-containers/community/blob/master/Rota-Process.md [4] - https://github.com/kata-cZhihong Yuontainers/community/blob/master/README.md#join-us --- https://katacontainers.io/ | https://github.com/kata-containers Open Source Technology Center Intel Corporation (UK) Ltd. - Co. Reg. #1134945 - Pipers Way, Swindon SN3 1RJ. --------------------------------------------------------------------- Intel Corporation (UK) Limited Registered No. 1134945 (England) Registered Office: Pipers Way, Swindon SN3 1RJ VAT No: 860 2173 47 This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.

2 1

GSoC 2021: vhost-user-vsock application and Kata Containers integration
by Harshavardhan Unnibhavi 22 May '21

22 May '21

Hi, I am Harshavardhan Unnibhavi. I am one of QEMU's google summer of code students for this year. I will be working with Fabiano Fidêncio and Stefano Garzarella on developing a vhost-user-vsock application and integrating it with Kata Container. Kata Containers leverage virtio-vsock to create a communication channel between the runtime in the host and the agent in the guest. Since, Kata Containers focus on security moving this device emulation into an external user space process is very attractive. Hence, in this project, we aim to realize an application, written in rust, that will leverage the vhost-user protocol to emulate the virtio-vsock device in an external process. This application would then be integrated into Kata Containers. I am looking forward to working on this very cool project! I also look forward to learning from and interacting with the kata community. Best, Harsha

2 1

Confidential computing meeting minutes (2021/05/20)
by Samuel Ortiz 21 May '21

21 May '21

All, A very interesting meeting, thanks to all for joining, in particular the containerd and CRIO maintainers. The minutes for the confidential computing use case meeting are here: https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJh… A large part of the discussion was centered around where the image pulling should happen. Although we started to get to some sort of consensus around having it happen in the guest entirely, we realized that part of the context (in particular the remote attestation one) was missing to those not familiar with the proposed confidential computing architecture for Kata. We'll continue the discussion next week, and we'll provide a more complete architecture diagram in advance. As a heads up, next week meeting will happen one hour later, i.e. at 3pm UTC. Ariel will send a meeting invite update and we'll send another reminder to the list. Cheers, Samuel.

1 0

Updated invitation with note: Kata containers confidential computing use case meeting @ Thu May 27, 2021 6pm - 7pm (IDT) (kata-dev@lists.katacontainers.io)
by aadam＠redhat.com 20 May '21

20 May '21

This event has been changed with this note: "We will continue the discussion with the CRIO and containerd teams. " Title: Kata containers confidential computing use case meeting Discussing kata container confidential computing use case and working on relevant tasks.Meeting notes:https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRT… will be recorded for those who can't attend. Join Zoom Meetinghttps://zoom.us/j/98038141932Passcode: kataMeeting ID: 980 3814 1932One tap mobile+12532158782,,98038141932# US (Tacoma)+13462487799,,98038141932# US (Houston)Dial by your location        +1 253 215 8782 US (Tacoma)        +1 346 248 7799 US (Houston)        +1 669 900 6833 US (San Jose)        +1 301 715 8592 US (Washington DC)        +1 312 626 6799 US (Chicago)        +1 646 876 9923 US (New York)Meeting ID: 980 3814 1932Find your local number: https://zoom.us/u/adGVd3H0IA When: Thu May 27, 2021 6pm – 7pm Israel Time (changed) Where: https://zoom.us/j/98038141932 Calendar: kata-dev(a)lists.katacontainers.io Who: * aadam(a)redhat.com - organizer * Sun, Ning * kata-dev(a)lists.katacontainers.io * Wang,Liang(ACG CCN) * Brian Kocoloski * pehunt(a)redhat.com * harpatil(a)redhat.com * mpatel(a)redhat.com Event details: https://calendar.google.com/calendar/event?action=VIEW&eid=Y2owZmVjNmY2MDJm… Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this courtesy email at the account kata-dev(a)lists.katacontainers.io because you are an attendee of this event. To stop receiving future updates for this event, decline this event. Alternatively you can sign up for a Google account at https://calendar.google.com/calendar/ and control your notification settings for your entire calendar. Forwarding this invitation could allow any recipient to send a response to the organizer and be added to the guest list, or invite others regardless of their own invitation status, or to modify your RSVP. Learn more at https://support.google.com/calendar/answer/37135#forwarding

1 0

Community use cases meeting
by Fabiano Fidêncio 19 May '21

19 May '21

Yesterday, Apr 6th, during the Architecture Committee meeting, we discussed the possibility of having the community use cases meeting split, and I assigned myself the action item to create a doodle and send an email. Well, let me start saying that I may have failed in the doodle thing, but I still am dropping the email with what I heard as a feedback and what I would like to suggest. I got the feedback, from more than one person, that the time for the community use cases meeting is not exactly optimal for everyone, and that is right. For instance, it may be too early for folks in some parts of the US, while it is still too late for folks in Australia. With this in mind, I would like to ask whether there is the interest to split the meeting, allowing then the involved parts to talk to each other in a time that suits them best. So, this message is for everyone, but here I am explicitly looking for feedback from folks interested in: * K8S CI/CD pipeline with kata containers - Here we have people interested from the US and Australia, so maybe a late meeting in the US time zone would benefit the folks in Australia. * Performance isolation - Here we have people interested from the US and China, so maybe a late meeting in the US time zone would benefit the folks in China. If the parts involved in this have the interest to do so, let me know and then I will try to organise a doodle, set an official time, etc, etc, etc. We, as the community facilitating this communication, are here to facilitate the communication in a way that it will be beneficial for all the involved parts. Best Regards, -- Fabiano Fidêncio

10 29

Canceled event with note: Kata Containers Perf Isolation Use Case Meeting @ Wed May 19, 2021 11pm - 11:45pm (SGT) (kata-dev@lists.katacontainers.io)
by bergwolf＠gmail.com 18 May '21

18 May '21

This event has been canceled with this note: "Due to conflicts of both Eric and myself, we have to cancel this week's perf isolation use case meeting. Let's meet again next week. Thanks and sorry for the inconvenience. " Title: Kata Containers Perf Isolation Use Case Meeting As discussed, let's split off and use this time slot to talk about the performance isolation use case. And let's meet weekly until we have fewer things to discuss.Zoom link (passcode: kata)https://zoom.us/j/98038141932gdoc link:https://docs.google.com/document/d/15Hc6DkJxLKev_MNKdN3OZWSpZxH3ch5TJ-… When: Wed May 19, 2021 11pm – 11:45pm Singapore Standard Time Calendar: kata-dev(a)lists.katacontainers.io Who: * bergwolf(a)gmail.com - organizer * Fabiano Fidêncio * Wang, Arron * eric.g.ernst(a)gmail.com * aadam(a)redhat.com * azaalouk(a)redhat.com * Boeuf, Sebastien * ffidenci(a)redhat.com * Sun, Ning * jrope(a)redhat.com * kata-dev(a)lists.katacontainers.io * Karl Heubaum * Liam Merwick * Boris Ostrovsky * Gupta, Sandeep * Wang,Liang(ACG CCN) * Prabhakar, Surya * Brian Kocoloski * Peng Tao Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this courtesy email at the account kata-dev(a)lists.katacontainers.io because you are an attendee of this event. To stop receiving future updates for this event, decline this event. Alternatively you can sign up for a Google account at https://calendar.google.com/calendar/ and control your notification settings for your entire calendar. Forwarding this invitation could allow any recipient to send a response to the organizer and be added to the guest list, or invite others regardless of their own invitation status, or to modify your RSVP. Learn more at https://support.google.com/calendar/answer/37135#forwarding

1 0

Updated invitation with note: Kata containers confidential computing use case meeting @ Thu May 20, 2021 5pm - 6pm (IDT) (kata-dev@lists.katacontainers.io)
by aadam＠redhat.com 17 May '21

17 May '21

This event has been changed with this note: "Moving this weeks meeting 2 hours later and adding relevant people from CRIO and containerd to join the discussion. Thanks. " Title: Kata containers confidential computing use case meeting Discussing kata container confidential computing use case and working on relevant tasks.Meeting notes:https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRT… will be recorded for those who can't attend. Join Zoom Meetinghttps://zoom.us/j/98038141932Passcode: kataMeeting ID: 980 3814 1932One tap mobile+12532158782,,98038141932# US (Tacoma)+13462487799,,98038141932# US (Houston)Dial by your location        +1 253 215 8782 US (Tacoma)        +1 346 248 7799 US (Houston)        +1 669 900 6833 US (San Jose)        +1 301 715 8592 US (Washington DC)        +1 312 626 6799 US (Chicago)        +1 646 876 9923 US (New York)Meeting ID: 980 3814 1932Find your local number: https://zoom.us/u/adGVd3H0IA When: Thu May 20, 2021 5pm – 6pm Israel Time (changed) Where: https://zoom.us/j/98038141932 Calendar: kata-dev(a)lists.katacontainers.io Who: * aadam(a)redhat.com - organizer * kata-dev(a)lists.katacontainers.io * Wang,Liang(ACG CCN) * Brian Kocoloski * harpatil(a)redhat.com * mpatel(a)redhat.com Event details: https://calendar.google.com/calendar/event?action=VIEW&eid=Y2owZmVjNmY2MDJm… Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this courtesy email at the account kata-dev(a)lists.katacontainers.io because you are an attendee of this event. To stop receiving future updates for this event, decline this event. Alternatively you can sign up for a Google account at https://calendar.google.com/calendar/ and control your notification settings for your entire calendar. Forwarding this invitation could allow any recipient to send a response to the organizer and be added to the guest list, or invite others regardless of their own invitation status, or to modify your RSVP. Learn more at https://support.google.com/calendar/answer/37135#forwarding

1 0