Open Stack

On Thu, Dec 05, 2019 at 08:07:23AM +0000, Boeuf, Sebastien wrote:
> On Wed, 2019-12-04 at 17:36 +0000, Montes, Julio wrote:
> 
> Stefano,
> 
> 
> > Do you think could be an easy change in the Kata runtime?
> 
> > I need to look better, but if you already know the answer you'll
> > save me some time :)
> 
> 
> ok, this means all kata components must be in the same network namespace.
> 
> fortunately, kata-shim and qemu run in the same network namespace, so the change should be easy, just move kata-proxy and kata-runtime into the same net namespace
> 
> Well in case of vsock, we don't need kata-proxy, the shim being directly connected to the VM through vsock. And the kata-shim runs in the same netns as the VMM, so we're good from this perspective.

Cool!

> 
> In case of containerd-shimv2, we don't have kata-shim anymore, the shim being a simple thread part of the kata-runtime process, which means kata-runtime needs to enter the netns, and that's where it might be pretty complex. IIRC, Julio did some experiments to run the kata-runtime in a set of namespaces, but I don't think we merged it, did we?

So, if it's complicated, as Tao suggested, we absolutely must provide a way
to disable it or assign a vsock device to a netns regardless of the VMM's netns.

Thanks,
Stefano