Open Stack

Hello,


TL;DR: Status of Kata Containers packaging in Fedora


I’ve been working on improving packaging for Kata Containers in Fedora.

Presently, there are 5 different packages:

https://src.fedoraproject.org/rpms/kata-runtime
https://src.fedoraproject.org/rpms/kata-osbuilder (which includes the agent)
https://src.fedoraproject.org/rpms/kata-proxy
https://src.fedoraproject.org/rpms/kata-shim
https://src.fedoraproject.org/rpms/kata-ksm-throttler

You can click on the “Build status” icon to get access to the various rpms.

If you have time, I would appreciate your help to:
1/ Review the packaging and build procedure
2/ Install and test the packages

The intent of the osbuilder is to use the host kernel by default,
although there is some ongoing work to use a kata-optimized kernel.
Notably, we have been discussing a kernel with virtualization
drivers configured, and booting it uncompressed so that qemu
can simply mmap it.

KNOWN ISSUES:

Fedora 31 only:
Building go packages on Fedora relies on “go-rpm-macros”, which is a
new package in Fedora 31. While I have private builds that do not use
these macros, for the moment, the focus is Fedora 31 only.

Packaging errors:
There are a number of errors and warnings reported by rpmlint and
rpmgrill. Nothing that should prevent anybody from using / testing
the packages AFAICT. FYI:

https://bugzilla.redhat.com/show_bug.cgi?id=1773629
https://bugzilla.redhat.com/show_bug.cgi?id=1773635
https://bugzilla.redhat.com/show_bug.cgi?id=1773638
https://bugzilla.redhat.com/show_bug.cgi?id=1773639

As far as I can tell, all this is “Fedora internal cuisine”, so unless you
are familiar with Fedora packaging, there is probably no need to
look into these ;-)

cgroupsv2 errors:
If you run on a recent kernel (post 5.3.x), you will run into
https://github.com/kata-containers/runtime/issues/2107.
Workaround 1: downgrade to kernel 5.2
Workaround 2:
   $ sudo mkdir -p /run/cgroupv1;
   $ sudo mount -t cgroup -o cpu,cpuacct cgroup /run/cgroupv1/


WISH LIST (items that would matter for Fedora):

IPv6 support:
This is tracked at https://github.com/kata-containers/runtime/issues/147.

Security-related concerns:
- Avoid running qemu as root
- libvirt integration (would address the above, I opened
https://github.com/kata-containers/runtime/issues/2227 to discuss this)
- cgroupv2 (https://github.com/kata-containers/runtime/issues/2107)
- SElinux (https://github.com/kata-containers/runtime/issues/784)


Thank you in advance for your help,
Christophe