- kata-dev - lists.katacontainers.io

Call for volunteers - February Kata AC election officials
by Sunny Cai 16 Feb '21

16 Feb '21

Hi everyone, As you might have known that we have the February Kata Architecture Committee election coming up, we need two volunteers who can help to facilitate this election process. Anyone can be the election officials, except for the people running for the elected seats. If you are interested in helping with facilitating this round’s Kata election, please email me (sunny(a)openstack.org) before next Tuesday, February 23rd! Thanks, Sunny Cai OpenStack Foundation sunny(a)openstack.org

1 0

AC meeting (Feb 16th, 2021): Add your topics to the agenda
by Fabiano Fidêncio 16 Feb '21

16 Feb '21

Kata Folks, Please, if you have something you'd like to have discussed as part of the architecture committee meeting happening Tomorrow (Feb 16th, 2021), please, add the items to the list: https://etherpad.opendev.org/p/Kata_Containers_2021_Architecture_Committee_… Best Regards, -- Fabiano Fidêncio

1 1

Shimv2 and CRI-O clarifications
by David Gibson 15 Feb '21

15 Feb '21

Hi, hoping somebody can clear up a couple of points of confusion for me. 1) The shimv2 protocol AIUI, the shimv2 protocol has basically the same semantics as the OCI runtime spec, but is over gRPC instead of a command line interface. Is that correct? Is there somewhere to find the spec of the shimv2 protocol? 2) CRI-O "runtime_type" option The CRI-O configuration has a "runtime_type" variable for each runtime, with options of "oci" or "vm". What exactly the difference between those is kind of unclear: what docs I've found say that "vm" is more suitable for VM based runtimes, but I can't really see any reason that would make a difference for crio. Looking at the code it looks like "vm" switches CRI-O to use the "shimv2" grpc based interface rather than command line. It makes sense CRI-O would need to know that, but AFAICT it has nothing whatsoever to do with whether the runtime uses a VM. -- David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson

1 0

Shimv2 and CRI-O clarifications
by David Gibson 12 Feb '21

12 Feb '21

Hi, hoping somebody can clear up a couple of points of confusion for me. 1) The shimv2 protocol AIUI, the shimv2 protocol has basically the same semantics as the OCI runtime spec, but is over gRPC instead of a command line interface. Is that correct? Is there somewhere to find the spec of the shimv2 protocol? 2) CRI-O "runtime_type" option The CRI-O configuration has a "runtime_type" variable for each runtime, with options of "oci" or "vm". What exactly the difference between those is kind of unclear: what docs I've found say that "vm" is more suitable for VM based runtimes, but I can't really see any reason that would make a difference for crio. Looking at the code it looks like "vm" switches CRI-O to use the "shimv2" grpc based interface rather than command line. It makes sense CRI-O would need to know that, but AFAICT it has nothing whatsoever to do with whether the runtime uses a VM. -- David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson

2 1

FW: Regarding, RPC Error with kata-runtime, kata 2.x (kata-containers-stable-2.0.0) with mem_encryption (AMD SEV) enabled
by Venegas Munoz, Jose Carlos 11 Feb '21

11 Feb '21

-----Original Message----- From: Gupta, Sandeep <Sandeep.Gupta(a)amd.com> Sent: Wednesday, February 10, 2021 12:02 PM To: Venegas Munoz, Jose Carlos <jose.carlos.venegas.munoz(a)intel.com> Cc: Gupta, Sandeep <Sandeep.Gupta(a)amd.com> Subject: FW: Regarding, RPC Error with kata-runtime, kata 2.x (kata-containers-stable-2.0.0) with mem_encryption (AMD SEV) enabled [AMD Official Use Only - Internal Distribution Only] Hi Carlos, Forwarding, Not sure if this email made it to the kata-dev list, If not could you please forward to the kata-dev list ? --Best Regards, --Sandeep Gupta -----Original Message----- From: Gupta, Sandeep <Sandeep.Gupta(a)amd.com> Sent: Wednesday, February 10, 2021 6:19 AM To: kata-dev <kata-dev(a)lists.katacontainers.io> Cc: Gupta, Sandeep <Sandeep.Gupta(a)amd.com>; Hollingsworth, Brent <brent.hollingsworth(a)amd.com> Subject: Regarding, RPC Error with kata-runtime, kata 2.x (kata-containers-stable-2.0.0) with mem_encryption (AMD SEV) enabled [AMD Official Use Only - Internal Distribution Only] Hi Kata Developers, Any suggestions for the following please - (1) Using containerd version 1.3.3 on Ubuntu "20.04.1 LTS (Focal Fossa)" Host: # containerd --version containerd github.com/containerd/containerd 1.3.3-0ubuntu2.2 (2) Using kata-runtime 2.0.0 (with AMD SEV mem_encryption changes): # /usr/local/bin/kata-runtime --version : 2.0.0 commit : fed5a81d373c5cb4d4a3961b5731407729572ea2-dirty OCI specs: 1.0.1-dev (3) /etc/containerd/config.toml : # cat /etc/containerd/config.toml [debug] level = "debug" [plugins.cri.containerd] no_pivot = false [plugins.cri.containerd.runtimes] [plugins.cri.containerd.runtimes.runc] runtime_type = "io.containerd.runc.v1" [plugins.cri.containerd.runtimes.runc.options] NoPivotRoot = false NoNewKeyring = false ShimCgroup = "" IoUid = 0 IoGid = 0 BinaryName = "runc" Root = "" CriuPath = "" SystemdCgroup = false [plugins.cri.containerd.runtimes.kata] runtime_type = "io.containerd.kata.v2" [plugins.cri.containerd.runtimes.kata.options] ConfigPath = "/etc/kata-containers/configuration.toml" BinaryName = "/usr/local/bin/kata-runtime" [plugins.cri.containerd.runtimes.katacli] runtime_type = "io.containerd.runc.v1" [plugins.cri.containerd.runtimes.katacli.options] NoPivotRoot = false NoNewKeyring = false ShimCgroup = "" IoUid = 0 IoGid = 0 BinaryName = "/usr/local/bin/kata-runtime" Root = "" CriuPath = "" SystemdCgroup = false (4) See RPC Error: ctr: Failed to check if grpc server is working: rpc error: code = DeadlineExceeded desc = timed out connecting to vsock 823476853:1024: unknown # ctr run --runtime io.containerd.run.kata.v2 -t --rm docker.io/library/busybox:latest csh ctr: Failed to check if grpc server is working: rpc error: code = DeadlineExceeded desc = timed out connecting to vsock 823476853:1024: unknown (5) "containerd" DEBUG Log: DEBU[2021-02-10T13:54:19.789109935Z] stat snapshot key="sha256:de168d3b8ec4765250376be559836953e27ff721fff3bc1124dd758bb153ce51" DEBU[2021-02-10T13:54:19.798103373Z] prepare snapshot key=csh parent="sha256:de168d3b8ec4765250376be559836953e27ff721fff3bc1124dd758bb153ce51" DEBU[2021-02-10T13:54:19.803804854Z] event published ns=default topic=/snapshot/prepare type=containerd.events.SnapshotPrepare DEBU[2021-02-10T13:54:19.810185332Z] get snapshot mounts key=csh DEBU[2021-02-10T13:54:19.819678316Z] event published ns=default topic=/containers/create type=containerd.events.ContainerCreate DEBU[2021-02-10T13:54:19.823584296Z] get snapshot mounts key=csh time="2021-02-10T13:54:19.902979570Z" level=debug msg="registering ttrpc server" time="2021-02-10T13:54:19.903105529Z" level=debug msg="serving api on abstract socket" socket="[inherited from parent]" time="2021-02-10T13:54:19.903130236Z" level=info msg="starting signal loop" namespace=default path=/run/containerd/io.containerd.runtime.v2.task/default/csh pid=5845 time="2021-02-10T13:54:19.903697390Z" level=debug msg="converting /run/containerd/io.containerd.runtime.v2.task/default/csh/config.json" pid=5845 sandbox=csh source=virtcontainers subsystem=compatoci time="2021-02-10T13:54:19.908139666Z" level=info msg="loaded configuration" file=/etc/kata-containers/configuration.toml format=TOML pid=5845 sandbox=csh source=katautils time="2021-02-10T13:54:19.908320729Z" level=info msg="IOMMUPlatform is disabled by default." pid=5845 sandbox=csh source=katautils time="2021-02-10T13:54:19.909315704Z" level=info msg="shm-size detected: 67108864" source=virtcontainers subsystem=oci time="2021-02-10T13:54:19.912364771Z" level=info msg="create netns" netns=/var/run/netns/cnitest-98821389-a527-2806-7bb4-8eb3f00d5cee pid=5845 sandbox=csh source=katautils time="2021-02-10T13:54:19.941668156Z" level=info msg="adding volume" pid=5845 sandbox=csh source=virtcontainers subsystem=qemu volume-type=virtio-9p time="2021-02-10T13:54:19.942304291Z" level=info msg="Endpoints found after scan" endpoints="[]" pid=5845 sandbox=csh source=virtcontainers subsystem=network time="2021-02-10T13:54:19.942425240Z" level=info msg="Starting VM" pid=5845 sandbox=csh source=virtcontainers subsystem=sandbox time="2021-02-10T13:54:19.942779692Z" level=info msg="Adding extra file [0xc0000b2d90]" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:19.942888969Z" level=info msg="launching /usr/local/bin/qemu-system-x86_64 with: [-name sandbox-csh -uuid 5e3826f7-9544-49fa-aa07-ed92460f061a -machine q35,accel=kvm,kernel_irqchip -cpu host,pmu=off -qmp unix:/run/vc/vm/csh/qmp.sock,server,nowait -m 2048M,slots=10,maxmem=129755M -device pci-bridge,bus=pcie.0,id=pci-bridge-0,chassis_nr=1,shpc=on,addr=2,romfile= -device virtio-serial-pci,disable-modern=false,disable-legacy=on,id=serial0,romfile=,iommu_platform=true -device virtconsole,chardev=charconsole0,id=console0 -chardev socket,id=charconsole0,path=/run/vc/vm/csh/console.sock,server,nowait -device virtio-scsi-pci,id=scsi0,disable-modern=false,disable-legacy=on,romfile=,iommu_platform=true -object sev-guest,id=sev0,cbitpos=51,reduced-phys-bits=5 -machine memory-encryption=sev0 -object rng-random,id=rng0,filename=/dev/urandom -device virtio-rng-pci,rng=rng0,romfile= -device vhost-vsock-pci,disable-modern=false,vhostfd=3,id=vsock-823476853,guest-cid=823476853,romfile= -device virtio-9p-pci,disable-modern=false,fsdev=extra-9p-kataShared,mount_tag=kataShared,romfile=,disable-legacy=on -fsdev local,id=extra-9p-kataShared,path=/run/kata-containers/shared/sandboxes/csh/shared,security_model=none,multidevs=remap -rtc base=utc,driftfix=slew,clock=host -global kvm-pit.lost_tick_policy=discard -vga none -no-user-config -nodefaults -nographic --no-reboot -daemonize -object memory-backend-ram,id=dimm1,size=2048M -numa node,memdev=dimm1 -kernel /usr/share/kata-containers/vmlinuz-sev-es-5.6-v3.container -initrd /usr/share/kata-containers/kata-containers-initrd.img -append tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 cryptomgr.notests net.ifnames=0 pci=lastbus=0 debug panic=1 nr_cpus=240 scsi_mod.scan=none root=/dev/vda1 rootflags=data=ordered,errors=remount-ro agent.log=debug initcall_debug -drive if=pflash,format=raw,unit=0,file=/usr/local/share/qemu/OVMF_CODE.fd.kata,readonly -pidfile /run/vc/vm/csh/pid -D /run/vc/vm/csh/qemu.log -smp 1,cores=1,threads=1,sockets=240,maxcpus=240]" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp DEBU[2021-02-10T13:54:19.981283337Z] garbage collected d=4.578314ms time="2021-02-10T13:54:21.633862888Z" level=info msg="{\"QMP\": {\"version\": {\"qemu\": {\"micro\": 0, \"minor\": 0, \"major\": 5}, \"package\": \"v5.0.0-dirty\"}, \"capabilities\": [\"oob\"]}}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:21.634304685Z" level=info msg="QMP details" pid=5845 qmp-capabilities=oob qmp-major-version=5 qmp-micro-version=0 qmp-minor-version=0 sandbox=csh source=virtcontainers subsystem=qemu time="2021-02-10T13:54:21.634487351Z" level=info msg="{\"execute\":\"qmp_capabilities\"}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:21.635071618Z" level=info msg="{\"return\": {}}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:21.635296183Z" level=info msg="scanner return error: read unix @->/run/vc/vm/csh/qmp.sock: use of closed network connection" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:21.635464933Z" level=info msg="VM started" pid=5845 sandbox=csh source=virtcontainers subsystem=sandbox time="2021-02-10T13:54:21.635653630Z" level=info msg="New client" pid=5845 sandbox=csh source=virtcontainers subsystem=kata_agent url="vsock://823476853:1024" time="2021-02-10T13:54:37.761624843Z" level=info msg="Stopping Sandbox" pid=5845 sandbox=csh source=virtcontainers subsystem=qemu time="2021-02-10T13:54:37.762194181Z" level=info msg="{\"QMP\": {\"version\": {\"qemu\": {\"micro\": 0, \"minor\": 0, \"major\": 5}, \"package\": \"v5.0.0-dirty\"}, \"capabilities\": [\"oob\"]}}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:37.762398849Z" level=info msg="{\"execute\":\"qmp_capabilities\"}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:37.763609992Z" level=info msg="{\"return\": {}}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:37.763795964Z" level=info msg="{\"execute\":\"quit\"}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:37.764363579Z" level=info msg="{\"return\": {}}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:37.764444993Z" level=info msg="{\"timestamp\": {\"seconds\": 1612965277, \"microseconds\": 764351}, \"event\": \"SHUTDOWN\", \"data\": {\"guest\": false, \"reason\": \"host-qmp-quit\"}}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:37.764556475Z" level=info msg="cleanup vm path" dir=/run/vc/vm/csh link=/run/vc/vm/csh pid=5845 sandbox=csh source=virtcontainers subsystem=qemu time="2021-02-10T13:54:37.764797291Z" level=info msg="Network namespace \"/var/run/netns/cnitest-98821389-a527-2806-7bb4-8eb3f00d5cee\" deleted" pid=5845 sandbox=csh source=virtcontainers subsystem=network time="2021-02-10T13:54:37.765695852Z" level=warning msg="sandbox cgroups path is empty" pid=5845 sandbox=csh source=virtcontainers subsystem=sandbox time="2021-02-10T13:54:37.765758611Z" level=info msg="cleanup agent" path=/run/kata-containers/shared/sandboxes/csh/shared pid=5845 sandbox=csh source=virtcontainers subsystem=kata_agent time="2021-02-10T13:54:37.766279267Z" level=warning msg="failed to cleanup netns" error="failed to get netns /var/run/netns/cnitest-98821389-a527-2806-7bb4-8eb3f00d5cee: failed to Statfs \"/var/run/netns/cnitest-98821389-a527-2806-7bb4-8eb3f00d5cee\": no such file or directory" path=/var/run/netns/cnitest-98821389-a527-2806-7bb4-8eb3f00d5cee pid=5845 sandbox=csh source=katautils time="2021-02-10T13:54:37.771597117Z" level=info msg="scanner return error: <nil>" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp INFO[2021-02-10T13:54:37.776331001Z] shim disconnected id=csh DEBU[2021-02-10T13:54:37.778567937Z] remove snapshot key=csh DEBU[2021-02-10T13:54:37.782134712Z] event published ns=default topic=/snapshot/remove type=containerd.events.SnapshotRemove DEBU[2021-02-10T13:54:37.785163547Z] event published ns=default topic=/containers/delete type=containerd.events.ContainerDelete DEBU[2021-02-10T13:54:37.960836857Z] schedule snapshotter cleanup snapshotter=overlayfs DEBU[2021-02-10T13:54:37.963802433Z] removed snapshot key=default/163/csh snapshotter=overlayfs DEBU[2021-02-10T13:54:37.964395075Z] snapshot garbage collected d=3.468218ms snapshotter=overlayfs DEBU[2021-02-10T13:54:37.964440331Z] garbage collected d=4.447562ms (6) With mem_encryption OFF (bring-up is proper) : # ctr run --runtime io.containerd.run.kata.v2 -t --rm docker.io/library/busybox:latest csh / # / # / # ps PID USER TIME COMMAND 1 root 0:00 sh 2 root 0:00 ps / # uname -a Linux sandeepg-ubuntu 5.6.0-sev-sev-es-5.6-v3.container #3 SMP Tue Nov 3 06:38:40 UTC 2020 x86_64 GNU/Linux / # exit Any suggestions please, --Regards --Sandeep Gupta

1 0

Regarding, RPC Error with kata-runtime, kata 2.x (kata-containers-stable-2.0.0) with mem_encryption (AMD SEV) enabled
by Gupta, Sandeep 10 Feb '21

10 Feb '21

[AMD Official Use Only - Internal Distribution Only] Hi Kata Developers, Any suggestions for the following please - (1) Using containerd version 1.3.3 on Ubuntu "20.04.1 LTS (Focal Fossa)" Host: # containerd --version containerd github.com/containerd/containerd 1.3.3-0ubuntu2.2 (2) Using kata-runtime 2.0.0 (with AMD SEV mem_encryption changes): # /usr/local/bin/kata-runtime --version : 2.0.0 commit : fed5a81d373c5cb4d4a3961b5731407729572ea2-dirty OCI specs: 1.0.1-dev (3) /etc/containerd/config.toml : # cat /etc/containerd/config.toml [debug] level = "debug" [plugins.cri.containerd] no_pivot = false [plugins.cri.containerd.runtimes] [plugins.cri.containerd.runtimes.runc] runtime_type = "io.containerd.runc.v1" [plugins.cri.containerd.runtimes.runc.options] NoPivotRoot = false NoNewKeyring = false ShimCgroup = "" IoUid = 0 IoGid = 0 BinaryName = "runc" Root = "" CriuPath = "" SystemdCgroup = false [plugins.cri.containerd.runtimes.kata] runtime_type = "io.containerd.kata.v2" [plugins.cri.containerd.runtimes.kata.options] ConfigPath = "/etc/kata-containers/configuration.toml" BinaryName = "/usr/local/bin/kata-runtime" [plugins.cri.containerd.runtimes.katacli] runtime_type = "io.containerd.runc.v1" [plugins.cri.containerd.runtimes.katacli.options] NoPivotRoot = false NoNewKeyring = false ShimCgroup = "" IoUid = 0 IoGid = 0 BinaryName = "/usr/local/bin/kata-runtime" Root = "" CriuPath = "" SystemdCgroup = false (4) See RPC Error: ctr: Failed to check if grpc server is working: rpc error: code = DeadlineExceeded desc = timed out connecting to vsock 823476853:1024: unknown # ctr run --runtime io.containerd.run.kata.v2 -t --rm docker.io/library/busybox:latest csh ctr: Failed to check if grpc server is working: rpc error: code = DeadlineExceeded desc = timed out connecting to vsock 823476853:1024: unknown (5) "containerd" DEBUG Log: DEBU[2021-02-10T13:54:19.789109935Z] stat snapshot key="sha256:de168d3b8ec4765250376be559836953e27ff721fff3bc1124dd758bb153ce51" DEBU[2021-02-10T13:54:19.798103373Z] prepare snapshot key=csh parent="sha256:de168d3b8ec4765250376be559836953e27ff721fff3bc1124dd758bb153ce51" DEBU[2021-02-10T13:54:19.803804854Z] event published ns=default topic=/snapshot/prepare type=containerd.events.SnapshotPrepare DEBU[2021-02-10T13:54:19.810185332Z] get snapshot mounts key=csh DEBU[2021-02-10T13:54:19.819678316Z] event published ns=default topic=/containers/create type=containerd.events.ContainerCreate DEBU[2021-02-10T13:54:19.823584296Z] get snapshot mounts key=csh time="2021-02-10T13:54:19.902979570Z" level=debug msg="registering ttrpc server" time="2021-02-10T13:54:19.903105529Z" level=debug msg="serving api on abstract socket" socket="[inherited from parent]" time="2021-02-10T13:54:19.903130236Z" level=info msg="starting signal loop" namespace=default path=/run/containerd/io.containerd.runtime.v2.task/default/csh pid=5845 time="2021-02-10T13:54:19.903697390Z" level=debug msg="converting /run/containerd/io.containerd.runtime.v2.task/default/csh/config.json" pid=5845 sandbox=csh source=virtcontainers subsystem=compatoci time="2021-02-10T13:54:19.908139666Z" level=info msg="loaded configuration" file=/etc/kata-containers/configuration.toml format=TOML pid=5845 sandbox=csh source=katautils time="2021-02-10T13:54:19.908320729Z" level=info msg="IOMMUPlatform is disabled by default." pid=5845 sandbox=csh source=katautils time="2021-02-10T13:54:19.909315704Z" level=info msg="shm-size detected: 67108864" source=virtcontainers subsystem=oci time="2021-02-10T13:54:19.912364771Z" level=info msg="create netns" netns=/var/run/netns/cnitest-98821389-a527-2806-7bb4-8eb3f00d5cee pid=5845 sandbox=csh source=katautils time="2021-02-10T13:54:19.941668156Z" level=info msg="adding volume" pid=5845 sandbox=csh source=virtcontainers subsystem=qemu volume-type=virtio-9p time="2021-02-10T13:54:19.942304291Z" level=info msg="Endpoints found after scan" endpoints="[]" pid=5845 sandbox=csh source=virtcontainers subsystem=network time="2021-02-10T13:54:19.942425240Z" level=info msg="Starting VM" pid=5845 sandbox=csh source=virtcontainers subsystem=sandbox time="2021-02-10T13:54:19.942779692Z" level=info msg="Adding extra file [0xc0000b2d90]" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:19.942888969Z" level=info msg="launching /usr/local/bin/qemu-system-x86_64 with: [-name sandbox-csh -uuid 5e3826f7-9544-49fa-aa07-ed92460f061a -machine q35,accel=kvm,kernel_irqchip -cpu host,pmu=off -qmp unix:/run/vc/vm/csh/qmp.sock,server,nowait -m 2048M,slots=10,maxmem=129755M -device pci-bridge,bus=pcie.0,id=pci-bridge-0,chassis_nr=1,shpc=on,addr=2,romfile= -device virtio-serial-pci,disable-modern=false,disable-legacy=on,id=serial0,romfile=,iommu_platform=true -device virtconsole,chardev=charconsole0,id=console0 -chardev socket,id=charconsole0,path=/run/vc/vm/csh/console.sock,server,nowait -device virtio-scsi-pci,id=scsi0,disable-modern=false,disable-legacy=on,romfile=,iommu_platform=true -object sev-guest,id=sev0,cbitpos=51,reduced-phys-bits=5 -machine memory-encryption=sev0 -object rng-random,id=rng0,filename=/dev/urandom -device virtio-rng-pci,rng=rng0,romfile= -device vhost-vsock-pci,disable-modern=false,vhostfd=3,id=vsock-823476853,guest-cid=823476853,romfile= -device virtio-9p-pci,disable-modern=false,fsdev=extra-9p-kataShared,mount_tag=kataShared,romfile=,disable-legacy=on -fsdev local,id=extra-9p-kataShared,path=/run/kata-containers/shared/sandboxes/csh/shared,security_model=none,multidevs=remap -rtc base=utc,driftfix=slew,clock=host -global kvm-pit.lost_tick_policy=discard -vga none -no-user-config -nodefaults -nographic --no-reboot -daemonize -object memory-backend-ram,id=dimm1,size=2048M -numa node,memdev=dimm1 -kernel /usr/share/kata-containers/vmlinuz-sev-es-5.6-v3.container -initrd /usr/share/kata-containers/kata-containers-initrd.img -append tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 cryptomgr.notests net.ifnames=0 pci=lastbus=0 debug panic=1 nr_cpus=240 scsi_mod.scan=none root=/dev/vda1 rootflags=data=ordered,errors=remount-ro agent.log=debug initcall_debug -drive if=pflash,format=raw,unit=0,file=/usr/local/share/qemu/OVMF_CODE.fd.kata,readonly -pidfile /run/vc/vm/csh/pid -D /run/vc/vm/csh/qemu.log -smp 1,cores=1,threads=1,sockets=240,maxcpus=240]" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp DEBU[2021-02-10T13:54:19.981283337Z] garbage collected d=4.578314ms time="2021-02-10T13:54:21.633862888Z" level=info msg="{\"QMP\": {\"version\": {\"qemu\": {\"micro\": 0, \"minor\": 0, \"major\": 5}, \"package\": \"v5.0.0-dirty\"}, \"capabilities\": [\"oob\"]}}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:21.634304685Z" level=info msg="QMP details" pid=5845 qmp-capabilities=oob qmp-major-version=5 qmp-micro-version=0 qmp-minor-version=0 sandbox=csh source=virtcontainers subsystem=qemu time="2021-02-10T13:54:21.634487351Z" level=info msg="{\"execute\":\"qmp_capabilities\"}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:21.635071618Z" level=info msg="{\"return\": {}}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:21.635296183Z" level=info msg="scanner return error: read unix @->/run/vc/vm/csh/qmp.sock: use of closed network connection" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:21.635464933Z" level=info msg="VM started" pid=5845 sandbox=csh source=virtcontainers subsystem=sandbox time="2021-02-10T13:54:21.635653630Z" level=info msg="New client" pid=5845 sandbox=csh source=virtcontainers subsystem=kata_agent url="vsock://823476853:1024" time="2021-02-10T13:54:37.761624843Z" level=info msg="Stopping Sandbox" pid=5845 sandbox=csh source=virtcontainers subsystem=qemu time="2021-02-10T13:54:37.762194181Z" level=info msg="{\"QMP\": {\"version\": {\"qemu\": {\"micro\": 0, \"minor\": 0, \"major\": 5}, \"package\": \"v5.0.0-dirty\"}, \"capabilities\": [\"oob\"]}}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:37.762398849Z" level=info msg="{\"execute\":\"qmp_capabilities\"}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:37.763609992Z" level=info msg="{\"return\": {}}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:37.763795964Z" level=info msg="{\"execute\":\"quit\"}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:37.764363579Z" level=info msg="{\"return\": {}}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:37.764444993Z" level=info msg="{\"timestamp\": {\"seconds\": 1612965277, \"microseconds\": 764351}, \"event\": \"SHUTDOWN\", \"data\": {\"guest\": false, \"reason\": \"host-qmp-quit\"}}" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp time="2021-02-10T13:54:37.764556475Z" level=info msg="cleanup vm path" dir=/run/vc/vm/csh link=/run/vc/vm/csh pid=5845 sandbox=csh source=virtcontainers subsystem=qemu time="2021-02-10T13:54:37.764797291Z" level=info msg="Network namespace \"/var/run/netns/cnitest-98821389-a527-2806-7bb4-8eb3f00d5cee\" deleted" pid=5845 sandbox=csh source=virtcontainers subsystem=network time="2021-02-10T13:54:37.765695852Z" level=warning msg="sandbox cgroups path is empty" pid=5845 sandbox=csh source=virtcontainers subsystem=sandbox time="2021-02-10T13:54:37.765758611Z" level=info msg="cleanup agent" path=/run/kata-containers/shared/sandboxes/csh/shared pid=5845 sandbox=csh source=virtcontainers subsystem=kata_agent time="2021-02-10T13:54:37.766279267Z" level=warning msg="failed to cleanup netns" error="failed to get netns /var/run/netns/cnitest-98821389-a527-2806-7bb4-8eb3f00d5cee: failed to Statfs \"/var/run/netns/cnitest-98821389-a527-2806-7bb4-8eb3f00d5cee\": no such file or directory" path=/var/run/netns/cnitest-98821389-a527-2806-7bb4-8eb3f00d5cee pid=5845 sandbox=csh source=katautils time="2021-02-10T13:54:37.771597117Z" level=info msg="scanner return error: <nil>" pid=5845 sandbox=csh source=virtcontainers subsystem=qmp INFO[2021-02-10T13:54:37.776331001Z] shim disconnected id=csh DEBU[2021-02-10T13:54:37.778567937Z] remove snapshot key=csh DEBU[2021-02-10T13:54:37.782134712Z] event published ns=default topic=/snapshot/remove type=containerd.events.SnapshotRemove DEBU[2021-02-10T13:54:37.785163547Z] event published ns=default topic=/containers/delete type=containerd.events.ContainerDelete DEBU[2021-02-10T13:54:37.960836857Z] schedule snapshotter cleanup snapshotter=overlayfs DEBU[2021-02-10T13:54:37.963802433Z] removed snapshot key=default/163/csh snapshotter=overlayfs DEBU[2021-02-10T13:54:37.964395075Z] snapshot garbage collected d=3.468218ms snapshotter=overlayfs DEBU[2021-02-10T13:54:37.964440331Z] garbage collected d=4.447562ms (6) With mem_encryption OFF (bring-up is proper) : # ctr run --runtime io.containerd.run.kata.v2 -t --rm docker.io/library/busybox:latest csh / # / # / # ps PID USER TIME COMMAND 1 root 0:00 sh 2 root 0:00 ps / # uname -a Linux sandeepg-ubuntu 5.6.0-sev-sev-es-5.6-v3.container #3 SMP Tue Nov 3 06:38:40 UTC 2020 x86_64 GNU/Linux / # exit Any suggestions please, --Regards --Sandeep Gupta

1 0

AC meeting (Feb 9th, 2021): Add your topics to the agenda
by Fabiano Fidêncio 09 Feb '21

09 Feb '21

Kata Folks, Please, if you have something you'd like to have discussed as part of the architecture committee meeting happening Tomorrow (Feb 9th, 2021), please, add the items to the list: https://etherpad.opendev.org/p/Kata_Containers_2021_Architecture_Committee_… Best Regards, -- Fabiano Fidêncio

1 1

Weekly Kata Herders
by Hunt, James O 08 Feb '21

08 Feb '21

Hi All, This week's Kata PR and issue herders are: - Eric (https://github.com/egernst) - Fabiano (https://github.com/fidencio) - Salvador (https://github.com/chavafg) # Statistics ## Issues Issues opened last week: 37 Issues closed last week: 35 Open issues: 1103 Issue backlog project board: https://github.com/orgs/kata-containers/projects/23 ## PRs PRs opened last week: 31 PRs closed last week: 33 Open PRs: 140 Open PRs (excluding dnm+wip): 104 # Get involved If you'd like to help get the open PRs merged and open issues resolved (or get involved in other ways with Kata), take a look at the contributing guide [2] and the rota process [3]. Any problems, just ask us [4]. Cheers, James [1] - https://github.com/kata-containers/community/wiki/Review-Team-Rota [2] - https://github.com/kata-containers/community/blob/master/CONTRIBUTING.md [3] - https://github.com/kata-containers/community/blob/master/Rota-Process.md [4] - https://github.com/kata-containers/community/blob/master/README.md#join-us --- https://katacontainers.io/ | https://github.com/kata-containers Open Source Technology Center Intel Corporation (UK) Ltd. - Co. Reg. #1134945 - Pipers Way, Swindon SN3 1RJ. --------------------------------------------------------------------- Intel Corporation (UK) Limited Registered No. 1134945 (England) Registered Office: Pipers Way, Swindon SN3 1RJ VAT No: 860 2173 47 This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.

1 0

Question about TSC
by Sunwoo Jang 07 Feb '21

07 Feb '21

Hello all, I'm trying to get TSC via rdtscp() instruction in kata containers. But, the value of TSC is different from that of host TSC. In runc container, I have the same TSC. My cpus are intel core and the codes are following: unsigned long long hi, lo; __asm__ __volatile__ ("rdtscp" : "=a"(lo), "=d"(hi)); unsigned long long tsc = lo | hi<<32; As far as I know, the reason why is due to TSC virtualization, such as TSC offsetting, in VMM. Is this right? and the same method is applied in kata containers? If so, is there a way to get the same host TSC from the kata containers? or disable TSC offset?

1 0

Container Plumbing Days Call for talks
by Ariel Adam 01 Feb '21

01 Feb '21

Hi everyone. Sharing with you details on the *container plumbing days call for talks* (submissions by February 10th). Should be interesting ;-). Announcing Free Open Source Micro Virtual Conference `Container Plumbing Days` sponsored by Red Hat. March 9-10, 2021. Looking for speakers. Low level talks, from the container engine down to the OS. Not orchestrators. http://containerplumbing.org/ Thanks.

1 0