Running Kata with cc-agent
Hi all, I suspect that something in the gRPC implementation isn't playing well with SEV memory encryption. For debugging purposes, I'm trying to run a Kata system in the host with cc-agent in the guest image. I've performed the following steps: 1. Build a Clear Linux image using osbuilder. 2. Install cc-agent in usr/bin and clear-containers.{service,target} in lib/system/system. 3. Remove kata-containers.{service, target} from lib/system/system. 4. Update configuration.toml and change [agent.kata] to [agent.hyperstart]. 5. Run a busybox container via docker as a test. After step 5, I get the following error from docker: $ sudo docker run --rm=true -ti --runtime sev-runtime busybox sh docker: Error response from daemon: OCI runtime create failed: AgentURL cannot be empty: unknown. Is there another change that I need to make in order to use a hyperstart agent in the guest? Alternatively, is there a way to disable gRPC for the kata-proxy <-> kata-agent communication channel? Sincerely, Jesse
Hi Jesse, You also have to hack the Makefile in order to make sure the runtime is gonna provide "clear-containers.target" as the target to execute from systemd. Because right now with kata, when using a simple make, you will end up with the target "kata-containers.target". An alternative could be to hack the line https://github.com/kata-containers/runtime/blob/master/cli/create.go#L153 and replace "systemdUnitName" with "clear-containers.target". Thanks, Sebastien ________________________________________ From: Larrew, Jesse [Jesse.Larrew@amd.com] Sent: Monday, April 23, 2018 2:27 PM To: kata-dev@lists.katacontainers.io Subject: [kata-dev] Running Kata with cc-agent Hi all, I suspect that something in the gRPC implementation isn't playing well with SEV memory encryption. For debugging purposes, I'm trying to run a Kata system in the host with cc-agent in the guest image. I've performed the following steps: 1. Build a Clear Linux image using osbuilder. 2. Install cc-agent in usr/bin and clear-containers.{service,target} in lib/system/system. 3. Remove kata-containers.{service, target} from lib/system/system. 4. Update configuration.toml and change [agent.kata] to [agent.hyperstart]. 5. Run a busybox container via docker as a test. After step 5, I get the following error from docker: $ sudo docker run --rm=true -ti --runtime sev-runtime busybox sh docker: Error response from daemon: OCI runtime create failed: AgentURL cannot be empty: unknown. Is there another change that I need to make in order to use a hyperstart agent in the guest? Alternatively, is there a way to disable gRPC for the kata-proxy <-> kata-agent communication channel? Sincerely, Jesse _______________________________________________ kata-dev mailing list kata-dev@lists.katacontainers.io http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev
Hi all,
I suspect that something in the gRPC implementation isn't playing well with SEV memory encryption. I cannot think of anything from the kata-agent that would block SEV on
On Tue, Apr 24, 2018 at 5:27 AM, Larrew, Jesse <Jesse.Larrew@amd.com> wrote: the guest side.. So I would suggest comparing the qemu command line you used to create the guest with and without SEV as a first step, assuming that you can get the system up and running withoug SEV. Also you can check the console log (via kata-proxy, e.g. `journalctl -t kata-proxy`) to see if the guest is really up running or not. Please set all `enable_debug` option in configuration.toml to `true`, and set `kernel_params = "agent.log=debug"`. Cheers, Tao -- bergwolf@hyper.sh
participants (3)
-
Boeuf, Sebastien
-
Larrew, Jesse
-
Tao Peng