Thanks Christophe for raising the issues

Will look into the packaging status and filed issues.

Cheers

------------------------------------------------------------------ From:Christophe de Dinechin dinechin@redhat.com Send Time:2019年11月21日(星期四) 00:24 To:kata-dev kata-dev@lists.katacontainers.io Subject:[kata-dev] Fedora packaging for Kata Containers - Release 1.9.0

Hello,

TL;DR: Status of Kata Containers packaging in Fedora

I’ve been working on improving packaging for Kata Containers in Fedora.

Presently, there are 5 different packages:

https://src.fedoraproject.org/rpms/kata-runtime https://src.fedoraproject.org/rpms/kata-osbuilder (which includes the agent) https://src.fedoraproject.org/rpms/kata-proxy https://src.fedoraproject.org/rpms/kata-shim https://src.fedoraproject.org/rpms/kata-ksm-throttler

You can click on the “Build status” icon to get access to the various rpms.

If you have time, I would appreciate your help to: 1/ Review the packaging and build procedure 2/ Install and test the packages

The intent of the osbuilder is to use the host kernel by default, although there is some ongoing work to use a kata-optimized kernel. Notably, we have been discussing a kernel with virtualization drivers configured, and booting it uncompressed so that qemu can simply mmap it.

KNOWN ISSUES:

Fedora 31 only: Building go packages on Fedora relies on “go-rpm-macros”, which is a new package in Fedora 31. While I have private builds that do not use these macros, for the moment, the focus is Fedora 31 only.

Packaging errors: There are a number of errors and warnings reported by rpmlint and rpmgrill. Nothing that should prevent anybody from using / testing the packages AFAICT. FYI:

https://bugzilla.redhat.com/show_bug.cgi?id=1773629 https://bugzilla.redhat.com/show_bug.cgi?id=1773635 https://bugzilla.redhat.com/show_bug.cgi?id=1773638 https://bugzilla.redhat.com/show_bug.cgi?id=1773639

As far as I can tell, all this is “Fedora internal cuisine”, so unless you are familiar with Fedora packaging, there is probably no need to look into these ;-)

cgroupsv2 errors: If you run on a recent kernel (post 5.3.x), you will run into https://github.com/kata-containers/runtime/issues/2107. Workaround 1: downgrade to kernel 5.2 Workaround 2: $ sudo mkdir -p /run/cgroupv1; $ sudo mount -t cgroup -o cpu,cpuacct cgroup /run/cgroupv1/

WISH LIST (items that would matter for Fedora):

IPv6 support: This is tracked at https://github.com/kata-containers/runtime/issues/147.

Security-related concerns: - Avoid running qemu as root - libvirt integration (would address the above, I opened https://github.com/kata-containers/runtime/issues/2227 to discuss this) - cgroupv2 (https://github.com/kata-containers/runtime/issues/2107) - SElinux (https://github.com/kata-containers/runtime/issues/784)

Thank you in advance for your help, Christophe

_______________________________________________ kata-dev mailing list kata-dev@lists.katacontainers.io http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev

Hi Carlos,

On 21 Nov 2019, at 06:17, Venegas Munoz, Jose Carlos jose.carlos.venegas.munoz@intel.com wrote:

Hi Christophe,

1. I see you build both use cases, initrd and image. To make simpler your build you can just build the initrd.

For the moment at least, it’s easier to have both for experimentation, e.g. comparing configurations. Also, as far as I can tell, ‘image’ does not work quite well yet, see https://bugzilla.redhat.com/show_bug.cgi?id=1774942

2. Good to know you could have a virtualization optimized kernel that would simplify the setup a lot, is Bugzilla issue to track how this goes?

Now there is :-) https://bugzilla.redhat.com/show_bug.cgi?id=1774918

I personally believe that this flow would simplify a lot how to handle Kata on any distro. But regardless of this how far you feel is the experience today with dracut method?

Seems good enough to me, but worth testing more.

It is good to see the agent build is part of rpm generation, also is great that needed for any internet download (systemd, kernel, modules, agent are already there).

I think you mean there is no need for any Internet download, right?

3. Cgroups v2 I know Julio is looking at it.

Nice.

I would like to test the rpms next week.

I plan to keep updating them, notably for 1.9.1

Regards, Carlos

...

-----Original Message----- From: Christophe de Dinechin dinechin@redhat.com Sent: Wednesday, November 20, 2019 10:24 AM To: kata-dev@lists.katacontainers.io Subject: [kata-dev] Fedora packaging for Kata Containers - Release 1.9.0

Hello,

TL;DR: Status of Kata Containers packaging in Fedora

I’ve been working on improving packaging for Kata Containers in Fedora.

Presently, there are 5 different packages:

https://src.fedoraproject.org/rpms/kata-runtime https://src.fedoraproject.org/rpms/kata-osbuilder (which includes the agent) https://src.fedoraproject.org/rpms/kata-proxy https://src.fedoraproject.org/rpms/kata-shim https://src.fedoraproject.org/rpms/kata-ksm-throttler

You can click on the “Build status” icon to get access to the various rpms.

If you have time, I would appreciate your help to: 1/ Review the packaging and build procedure 2/ Install and test the packages

The intent of the osbuilder is to use the host kernel by default, although there is some ongoing work to use a kata-optimized kernel. Notably, we have been discussing a kernel with virtualization drivers configured, and booting it uncompressed so that qemu can simply mmap it.

KNOWN ISSUES:

Fedora 31 only: Building go packages on Fedora relies on “go-rpm-macros”, which is a new package in Fedora 31. While I have private builds that do not use these macros, for the moment, the focus is Fedora 31 only.

Packaging errors: There are a number of errors and warnings reported by rpmlint and rpmgrill. Nothing that should prevent anybody from using / testing the packages AFAICT. FYI:

https://bugzilla.redhat.com/show_bug.cgi?id=1773629 https://bugzilla.redhat.com/show_bug.cgi?id=1773635 https://bugzilla.redhat.com/show_bug.cgi?id=1773638 https://bugzilla.redhat.com/show_bug.cgi?id=1773639

As far as I can tell, all this is “Fedora internal cuisine”, so unless you are familiar with Fedora packaging, there is probably no need to look into these ;-)

cgroupsv2 errors: If you run on a recent kernel (post 5.3.x), you will run into https://github.com/kata-containers/runtime/issues/2107. Workaround 1: downgrade to kernel 5.2 Workaround 2: $ sudo mkdir -p /run/cgroupv1; $ sudo mount -t cgroup -o cpu,cpuacct cgroup /run/cgroupv1/

WISH LIST (items that would matter for Fedora):

IPv6 support: This is tracked at https://github.com/kata-containers/runtime/issues/147.

Security-related concerns:

• Avoid running qemu as root
• libvirt integration (would address the above, I opened

https://github.com/kata-containers/runtime/issues/2227 to discuss this)

• cgroupv2 (https://github.com/kata-containers/runtime/issues/2107)
• SElinux (https://github.com/kata-containers/runtime/issues/784)

Thank you in advance for your help, Christophe

---

kata-dev mailing list kata-dev@lists.katacontainers.io http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev