Open Stack

On Wed, 2019-12-04 at 17:36 +0000, Montes, Julio wrote:

Stefano,


> Do you think could be an easy change in the Kata runtime?

> I need to look better, but if you already know the answer you'll
> save me some time :)


ok, this means all kata components must be in the same network namespace.

fortunately, kata-shim and qemu run in the same network namespace, so the change should be easy, just move kata-proxy and kata-runtime into the same net namespace

Well in case of vsock, we don't need kata-proxy, the shim being directly connected to the VM through vsock. And the kata-shim runs in the same netns as the VMM, so we're good from this perspective.

In case of containerd-shimv2, we don't have kata-shim anymore, the shim being a simple thread part of the kata-runtime process, which means kata-runtime needs to enter the netns, and that's where it might be pretty complex. IIRC, Julio did some experiments to run the kata-runtime in a set of namespaces, but I don't think we merged it, did we?

Sebastien


________________________________
From: Stefano Garzarella <sgarzare at redhat.com>
Sent: Wednesday, December 4, 2019 11:05 AM
To: Montes, Julio <julio.montes at intel.com>
Cc: kata-dev at lists.katacontainers.io <kata-dev at lists.katacontainers.io>
Subject: Re: [kata-dev] vsock & network namespaces in Kata

On Wed, Dec 04, 2019 at 03:54:06PM +0000, Montes, Julio wrote:
> Hi Stefano

Hi Julio

>
> > - Host: assign the same CID of VMs running in different network
> >  namespaces
>
> this means two VMs running in different namespace can use the same CID?

Exactly.

> currently we use VHOST_VSOCK_SET_GUEST_CID to get a unique context ID, is this going to change?

The only change is that the CID is unique in the network namespace
domain.

>
> > 1. Is the VMM (e.g. QEMU) running in a network namespace?
>
> yes, see https://github.com/kata-containers/runtime/blob/62cd08044d78912228d9dc800cb1b8bd3de3b971/virtcontainers/sandbox.go#L1024-L1041
>
> > 2. Is the host application, that use vsock to communicate with the
> >   guest, running in the same network namespace?
>
> afaik, no

This could be a problem with the RFC that I sent, because we allow only
the processes in the same netns of the VMM, to communicate with the
guest.

Do you think could be an easy change in the Kata runtime?
I need to look better, but if you already know the answer you'll
save me some time :)

>
> > 3. Is the agent in the guest running outside a netns (default init_netns)?
>
> yes

This is nice.

Thank you very much,
Stefano


_______________________________________________

kata-dev mailing list

<mailto:kata-dev at lists.katacontainers.io>

kata-dev at lists.katacontainers.io


<http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev>

http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev

---------------------------------------------------------------------
Intel Corporation SAS (French simplified joint stock company)
Registered headquarters: "Les Montalets"- 2, rue de Paris, 
92196 Meudon Cedex, France
Registration Number:  302 456 199 R.C.S. NANTERRE
Capital: 4,572,000 Euros

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.katacontainers.io/pipermail/kata-dev/attachments/20191205/d388d7aa/attachment-0001.html>