Open Stack

Hi,
Paolo Bonzini, Xu Wang, and I discussed using dracut
(https://dracut.wiki.kernel.org/) to build a distro-friendly initramfs
at the OpenStack Denver PTG.

I'm sharing a proof-of-concept for Fedora.  Other distros can probably
follow a similar approach.

This process creates an initramfs from the host system using dracut.
It's fast and produces a relatively small initramfs.  On my Fedora 30
system the file size is 19 MB including kata-agent and it could probably
be optimized further.

osbuilder is replaced with dracut, a tool that distro kernel packagers
are familiar with.  I hope that this approach will make it easy and
acceptable to package Kata Containers.

The scripts below build a kata-containers-initrd.img with systemd and
the kernel modules from the host system.  The generic distro kernel is
used in the sandbox VM, something that distro kernel packagers will be
happy about since it keeps their test matrix unchanged.

The proof-of-concept code is available here:

  https://github.com/stefanha/agent/tree/fedora-dracut

To build the Kata sandbox VM initramfs:

  # make
  # mkdir initramfs-overlay
  # make DESTDIR=initramfs-overlay install
  # make initrd

Edit /etc/kata-containers/configuration.toml so that
hypervisor.qemu.kernel points to the host's vmlinuz and initrd points to
the generated kata-containers-initrd.img file.
hypervisor.qemu.kernel_params must contain
systemd.unit=kata-containers.target so that kata-agent is launched upon
sandbox VM boot.  Also set hypervisor.qemu.use_vsock to true.

Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <http://lists.katacontainers.io/pipermail/kata-dev/attachments/20190507/a34e82c7/attachment.sig>