On Thu, Dec 05, 2019 at 08:07:23AM +0000, Boeuf, Sebastien wrote:
On Wed, 2019-12-04 at 17:36 +0000, Montes, Julio wrote:
Stefano,
Do you think could be an easy change in the Kata runtime?
I need to look better, but if you already know the answer you'll save me some time :)
ok, this means all kata components must be in the same network namespace.
fortunately, kata-shim and qemu run in the same network namespace, so the change should be easy, just move kata-proxy and kata-runtime into the same net namespace
Well in case of vsock, we don't need kata-proxy, the shim being directly connected to the VM through vsock. And the kata-shim runs in the same netns as the VMM, so we're good from this perspective.
Cool!
In case of containerd-shimv2, we don't have kata-shim anymore, the shim being a simple thread part of the kata-runtime process, which means kata-runtime needs to enter the netns, and that's where it might be pretty complex. IIRC, Julio did some experiments to run the kata-runtime in a set of namespaces, but I don't think we merged it, did we?
So, if it's complicated, as Tao suggested, we absolutely must provide a way to disable it or assign a vsock device to a netns regardless of the VMM's netns. Thanks, Stefano