- kata-dev - lists.katacontainers.io

[Diversity] D&I WG Office Hours at the PTG
by Amy Marrich 16 Apr '21

16 Apr '21

The Diversity and Inclusion WG has grabbed our usual PTG slot Monday at 16:00UTC and we will be holding office hours to help any project with Inclusive Naming or other D&I related topics. If you'd like us to attend any of your sessions please let me know. If you've been interested in learning more about the WG please come join us! Thanks, Amy (spotz)

1 0

virtiofs memory accounting
by Christophe de Dinechin 15 Apr '21

15 Apr '21

Eric reminded me that I had forgotten to send this email to kata-dev. I did a quick experiment that I believe confirms that the cgroup accounting for shared memory as mapped by virtiofs and qemu is correct, i.e. that if a same page is mapped in two processes in the cgroup, it is only reported once. Specifically, I did an experiment where: 1) I started a container in a pod 2) I measured the output of ps and of cgroup memory.stat before doing any I/O 3) I did a basic I/O (using dnf install) 4) I measured the increase in rss as reported by "ps" for both qemu and virtiofs (roughly 140M for qemu, 93M for virtiofs in that case) 5) I checked that there was an increase in memory.stat reporting that a) showed a very minor rss increase b) accounted for the largest of the two increases, and not the sum of the two increases. What I find weird is that the idea of "rss" in ps/top and in cgroup would be so different. There is also a "share" field that displays as - and a vsize field that is total virtual memory size, so a bit useless. Details of the experiment below. Starting with a simple ubi8 pod and container, I see qemu using ~320M (319924) and virtiofs using less than 10M, plus the parent process (5604 + 8308): [root@worker-0-0 core]# ps -e -o pid,rss,cmd | grep "qemu\|virtiofsd" 1207264 5604 /usr/libexec/virtiofsd --fd=3 -o source=/run/kata-containers/shared/sandboxes/6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3/shared -o cache=auto --syslog -o no_posix_lock -f --thread-pool-size=1 1207270 319924 /usr/libexec/qemu-kiwi -name sandbox-6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3 -uuid de74cc11-f3b3-4ec5-b5f6-ec5f0bb4077b -machine q35,accel=kvm,kernel_irqchip -cpu host,pmu=off -qmp unix:/run/vc/vm/6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3/qmp.sock,server,nowait -m 2048M,slots=10,maxmem=17029M -device pci-bridge,bus=pcie.0,id=pci-bridge-0,chassis_nr=1,shpc=on,addr=2,romfile= -device virtio-serial-pci,disable-modern=true,id=serial0,romfile=,max_ports=2 -device virtconsole,chardev=charconsole0,id=console0 -chardev socket,id=charconsole0,path=/run/vc/vm/6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3/console.sock,server,nowait -device virtio-scsi-pci,id=scsi0,disable-modern=true,romfile= -object rng-random,id=rng0,filename=/dev/urandom -device virtio-rng-pci,rng=rng0,romfile= -device vhost-vsock-pci,disable-modern=true,vhostfd=3,id=vsock-2835622479,guest-cid=2835622479,romfile= -chardev socket,id=char-a45ee029c15635f3,path=/run/vc/vm/6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3/vhost-fs.sock -device vhost-user-fs-pci,chardev=char-a45ee029c15635f3,tag=kataShared,romfile= -netdev tap,id=network-0,vhost=on,vhostfds=4,fds=5 -device driver=virtio-net-pci,netdev=network-0,mac=0a:58:0a:82:03:ab,disable-modern=true,mq=on,vectors=4,romfile= -rtc base=utc,driftfix=slew,clock=host -global kvm-pit.lost_tick_policy=discard -vga none -no-user-config -nodefaults -nographic --no-reboot -daemonize -object memory-backend-file,id=dimm1,size=2048M,mem-path=/dev/shm,share=on -numa node,memdev=dimm1 -kernel /usr/lib/modules/4.18.0-240.15.1.el8_3.x86_64/vmlinuz -initrd /var/cache/kata-containers/osbuilder-images/4.18.0-240.15.1.el8_3.x86_64/"rhcos"-kata-4.18.0-240.15.1.el8_3.x86_64.initrd -append tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 cryptomgr.notests net.ifnames=0 pci=lastbus=0 quiet panic=1 nr_cpus=8 scsi_mod.scan=none -pidfile /run/vc/vm/6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3/pid -smp 1,cores=1,threads=1,sockets=8,maxcpus=8 1207277 8308 /usr/libexec/virtiofsd --fd=3 -o source=/run/kata-containers/shared/sandboxes/6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3/shared -o cache=auto --syslog -o no_posix_lock -f --thread-pool-size=1 I can check that they are put in the same cgroup: [root@worker-0-0 core]# cat /proc/1207270/cgroup | grep memory 4:memory:/vc/kata_kubepods-besteffort-podfd24e8a3_c942_47fd_abdc_2845368484fa.slice:crio:6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3 [root@worker-0-0 core]# cat /proc/1207264/cgroup | grep memory 4:memory:/vc/kata_kubepods-besteffort-podfd24e8a3_c942_47fd_abdc_2845368484fa.slice:crio:6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3 [root@worker-0-0 core]# cat /proc/1207277/cgroup | grep memory 4:memory:/vc/kata_kubepods-besteffort-podfd24e8a3_c942_47fd_abdc_2845368484fa.slice:crio:6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3 Looking into that cgroup memory stats right after boot, I see: rss 25522176 (24M) rss_huge 12582912 (12M) shmem 280879104 (267M) mapped_file 280879104 (267M) Notice that cgroup's idea of rss is different from ps (we have 36M instead of 330M). Presumably, ps counts as resident stuff that cgroup counts as shared or file mapped. Complete output in case there is something important I failed to share: [root@worker-0-0 core]# cd /sys/fs/cgroup/memory/vc/kata_kubepods-besteffort-podfd24e8a3_c942_47fd_abdc_2845368484fa.slice\:crio\:6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3/ [root@worker-0-0 kata_kubepods-besteffort-podfd24e8a3_c942_47fd_abdc_2845368484fa.slice:crio:6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3]# cat memory.stat cache 281960448 rss 25522176 rss_huge 12582912 shmem 280879104 mapped_file 280879104 dirty 0 writeback 0 swap 0 pgpgin 110352 pgpgout 38323 pgfault 108834 pgmajfault 0 inactive_anon 280338432 active_anon 25870336 inactive_file 946176 active_file 0 unevictable 0 hierarchical_memory_limit 9223372036854771712 hierarchical_memsw_limit 9223372036854771712 total_cache 281960448 total_rss 25522176 total_rss_huge 12582912 total_shmem 280879104 total_mapped_file 280879104 total_dirty 0 total_writeback 0 total_swap 0 total_pgpgin 110352 total_pgpgout 38323 total_pgfault 108834 total_pgmajfault 0 total_inactive_anon 280338432 total_active_anon 25870336 total_inactive_file 946176 total_active_file 0 total_unevictable 0 Now I run `dnf install -y procps-ng` from within the guest. Now, the ps output gives me a ps rss that went from ~320M to ~460M for qemu alone, and from ~8M to 101M for the worker virtiofsd: [root@worker-0-0 kata_kubepods-besteffort-podfd24e8a3_c942_47fd_abdc_2845368484fa.slice:crio:6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3]# ps -e -o pid,rss,cmd | grep "qemu\|virtiofsd" 1207264 5604 /usr/libexec/virtiofsd 1207270 458516 /usr/libexec/qemu-kiwi 1207277 100888 /usr/libexec/virtiofsd As seen by cgroup, we now have a tiny increase in rss (went from 24M to 25M), no change at all in rss_huge, but shmem and mapped_file went from 267M to 406M: rss 26165248 rss_huge 12582912 shmem 426184704 mapped_file 426184704 Complete output just in case: [root@worker-0-0 kata_kubepods-besteffort-podfd24e8a3_c942_47fd_abdc_2845368484fa.slice:crio:6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3]# cat memory.stat cache 477405184 rss 26165248 rss_huge 12582912 shmem 426184704 mapped_file 426184704 dirty 15273984 writeback 0 swap 0 pgpgin 170544 pgpgout 50532 pgfault 163614 pgmajfault 0 inactive_anon 425779200 active_anon 26816512 inactive_file 18788352 active_file 32034816 unevictable 0 hierarchical_memory_limit 9223372036854771712 hierarchical_memsw_limit 9223372036854771712 total_cache 477405184 total_rss 26165248 total_rss_huge 12582912 total_shmem 426184704 total_mapped_file 426184704 total_dirty 15273984 total_writeback 0 total_swap 0 total_pgpgin 170544 total_pgpgout 50532 total_pgfault 163614 total_pgmajfault 0 total_inactive_anon 425779200 total_active_anon 26816512 total_inactive_file 18788352 total_active_file 32034816 total_unevictable 0 [root@worker-0-0 kata_kubepods-besteffort-podfd24e8a3_c942_47fd_abdc_2845368484fa.slice:crio:6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3]# [root@worker-0-0 kata_kubepods-besteffort-podfd24e8a3_c942_47fd_abdc_2845368484fa.slice:crio:6b6b51b0e11f4736aa88698f30f9570b0f56b3c7a1620fedb15c6596d08de7e3]# Conclusion on this simple example: - ps reports an increase in "rss" of 460M - 320M or roughly 140M, and then another 93M for virtiofs - cgroup reports a total increase of 139M So I would say that the cgroup accounting is correct, i.e. that it is not double-counting. Now the next step is to check what metrics are actually reported to the upper layers of the stack.

2 2

Permission for regular backlog scrubbers
by Christophe de Dinechin 14 Apr '21

14 Apr '21

During our weekly backlog scrubbing meeting, a few "regulars" (Cameron Meadors, Ariel Adam and myself) do not have access to some of the repos, so we can't change labels, etc. This week, this applied to the documentation and .github repos. We were lucky that Jose joined us and had sufficient access rights. Can someone with the adequate admin rights grant us sufficient privilege for triaging on all repos in the org? Thank you in advance, Christophe

2 4

vPTG April 2021 PTGBot, Etherpads, & IRC
by Kendall Nelson 13 Apr '21

13 Apr '21

Hello! We just wanted to take a second to point out a couple things as we all get ready for the PTG. Firstly, the PTGBot is up to date and ready to go-- as are the autogenerated etherpads! You can see the schedule page, etherpads, etc here[1]. If you/your team have already created an etherpad, please feel free to use the PTGBot[2] to override the default, auto-generated one. Secondly, but perhaps more importantly, with the migration to being more inclusive of projects outside of just openstack, we will be using the #openinfra-events IRC channel! The redirect is in place so you should automatically get sent to the right channel if you try to join the old one. And one more plug: Please register! Its free and important for getting the zoom information, etc. Thanks! -The Kendalls (diablo_rojo & wendallkaters) [1] PTG Website www.openstack.org/ptg [2] PTGbot Etherpad Override Command: https://github.com/openstack/ptgbot#etherpad [3] PTG Registration: https://april2021-ptg.eventbrite.com

1 0

Weekly Kata Herders
by Hunt, James O 12 Apr '21

12 Apr '21

Hi All, This week's Kata PR and issue herders are: - Bergwolf (https://github.com/bergwolf) - Chelsea (https://github.com/cmaf) # Statistics ## Issues Issues opened last week: 35 Issues closed last week: 736 Open issues: 395 Issue backlog project board: https://github.com/orgs/kata-containers/projects/23 ## PRs PRs opened last week: 47 PRs closed last week: 59 Open PRs: 132 Open PRs (excluding dnm+wip): 100 # Get involved If you'd like to help get the open PRs merged and open issues resolved (or get involved in other ways with Kata), take a look at the contributing guide [2] and the rota process [3]. Any problems, just ask us [4]. Cheers, James [1] - https://github.com/kata-containers/community/wiki/Review-Team-Rota [2] - https://github.com/kata-containers/community/blob/master/CONTRIBUTING.md [3] - https://github.com/kata-containers/community/blob/master/Rota-Process.md [4] - https://github.com/kata-cZhihong Yuontainers/community/blob/master/README.md#join-us --- https://katacontainers.io/ | https://github.com/kata-containers Open Source Technology Center Intel Corporation (UK) Ltd. - Co. Reg. #1134945 - Pipers Way, Swindon SN3 1RJ. --------------------------------------------------------------------- Intel Corporation (UK) Limited Registered No. 1134945 (England) Registered Office: Pipers Way, Swindon SN3 1RJ VAT No: 860 2173 47 This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.

1 0

Releases annoucement: 2.1.0-alpha2 and 2.0.3 are out!
by Fabiano Fidêncio 10 Apr '21

10 Apr '21

On behalf of the kata-containers project I am glad to announce two releases that happened Today (April 9th, 2021). Kata Containers 2.1.0-alpha2 is the last alpha release before we cut a release candidate and create the stable-2.1 branch. This release (compared to 2.0) brings huge changes, such as: IPv6 support, a better tracing support, and a remodeling of the agent (which is now asynchronous). Please, grab it while it is still hot, give it a try, and report issues back in order to help us to provide a solid 2.1.0 release soon. https://github.com/kata-containers/kata-containers/releases/tag/2.1.0-alpha2 Kata Containers 2.0.3 is the newest patch release and includes improvements in the documentation, a newer version of cloud-hypervisor (v0.14.1), and some fixes & improvements for kata-deploy. As usual, please, give it a try and report back the issues you face. https://github.com/kata-containers/kata-containers/releases/tag/2.0.3 Best Regards, -- Fabiano Fidêncio

1 0

Please label issues
by Hunt, James O 08 Apr '21

08 Apr '21

Hi All, If you raise GitHub issues or review them (hint: if you're on the Kata Rota [1], you should be reviewing them ;), please can you add a label or two to categorise each issue. # "Rule of thumb" Every issue should have atleast an "area" label. # More details We need to update our docs on this topic [2], but as a minimum please add an "area/*" label. For example: - If the issue is related to the agent, add the "area/agent" label. - If the issue is a show-stopper, add one of the "priority" labels. The area label will help us divide the work into smaller chunks that particular teams can work on (see the project board [3]). # But I don't know which labels to add If you are unsure, just ask someone [4]. # Get some practice in now! All the issues in the "To do" column on the issue board [3] need to have an "area" label added to them... so what are you waiting for! ;) # Caveat Note: If you are not a member of one of the Kata repos, unfortuanately, GitHub does not allow you to even see the available labels (nor apply them). Cheers, James [1] - https://github.com/kata-containers/community/wiki/Review-Team-Rota [2] - https://github.com/kata-containers/community/blob/master/Rota-Process.md#is… [3] - https://github.com/orgs/kata-containers/projects/23 [4] - https://github.com/kata-containers/community#join-us --- https://katacontainers.io/ | https://github.com/kata-containers Open Source Technology Center Intel Corporation (UK) Ltd. - Co. Reg. #1134945 - Pipers Way, Swindon SN3 1RJ. --------------------------------------------------------------------- Intel Corporation (UK) Limited Registered No. 1134945 (England) Registered Office: Pipers Way, Swindon SN3 1RJ VAT No: 860 2173 47 This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.

1 0

Re: [kata-dev] [Kata-hypervisor] macos support?
by Xu Wang 08 Apr '21

08 Apr '21

Hi Victor, I agree it would be useful if we could support macOS natively, which will turn kata into a development tool. Actually we had done some investigation years ago (maybe before we launched kata project in late 2017). Some of the issues (at that time) for xhyve included: - kata employs hotplugging for resources; - we don't have a proper image storage engine; It's too long time ago, maybe these issues have been solved, and maybe there were other issues I missed. However, I think it would be nice if we could have an elegant macOS. What do you think about, Eric? Xu ------------------------------------------------------------------ From:Victor Palade <victor(a)cloudflavor.io> Send Time:2021年4月6日(星期二) 22:27 To:kata-hypervisor@lists.katacontainers.io <kata-hypervisor(a)lists.katacontainers.io> Subject:[Kata-hypervisor] macos support? Hi, Sorry if this is a super ignorant question, i'm not too familiar with kata-runtime and how it communicates with different hypervisors but what would be the challenges to add xhyve as a supported hypervisor or qemu for mac to kata containers? Is this even possible? Alternatively i'd be interested if someone already made this work, maybe i'm missing some important piece of info that i didn't find in the github issues and docs. The way that it is currently for me, at least, is that i need to run a VM at all times, (this reserves at least half of my system resources) either if it's the Docker for desktop VM or something like Parallels where i do my development. Even if the tasks i use it for are not memory intensive, the memory is still reserved for the VM. Not having to run a (beefy) VM and inside run containers as docker for desktop currently does would be a huge improvement for developers. Not to mention you would probably be able to use the rest of the tooling to spin up k8s clusters with Kind for example, where your containers are a bunch of smaller vms. Anyway, would appreciate any pointers on this, if _it is possible_ and there's interest, i'd be more than happy to put it in the time to make it happen. Best, Victor

2 1

vPTG April 2021 Registration & Schedule
by Kendall Waters 08 Apr '21

08 Apr '21

Hello everyone! The April 2021 Project Teams Gathering is right around the corner! The official schedule has now been posted on the PTG website [1], the PTGbot will be up to date by the end of the week [2], and we have also attached it to this email. Please double check your rooms! We did a little consolidation and shifting while maintaining the times you signed up for. Friendly reminder, if you have not already registered, please do so [3]. It is important that we get everyone to register for the event as this is how we will contact you about tooling information/passwords and other event details. Please let us know if you have any questions! Cheers, - The Kendalls (diablo_rojo & wendallkaters) [1] PTG Website www.openstack.org/ptg <http://www.openstack.org/ptg> [2] PTGbot: http://ptg.openstack.org/ptg.html <http://ptg.openstack.org/ptg.html> [3] PTG Registration: https://april2021-ptg.eventbrite.com <https://april2021-ptg.eventbrite.com/>

1 0

Query on Support for Windows by Kata Containers
by Rahul Gupta 07 Apr '21

07 Apr '21

Hi, We want to experiment with some workloads on Windows contains. Please guide if Kata containers support Windows with EKS on AWS. Regards, Rahul

1 0