-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Storage in Image Management #189
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
I'm wondering why Travis disappeared, @mrunalp do you know anything? |
ccbac72 to
e9eb4c6
Compare
|
Needs rebase. |
|
Ready. Recently-landed changes meant that some of the functionality that was implemented in the storage cri branch was no longer needed, so it's been pruned out. |
|
There is a lint failure: |
|
From quick manual testing it works fine :) Now running tests locally and reviewing. |
server/container.go
Outdated
| return nil, err | ||
| } | ||
|
|
||
| mountPoint, err := s.storage.StartContainer(containerID) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What is the difference between Create and Start in storage? Creation of r/w layer?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
At the storage level, "Start" and "Stop" are more or less equivalent to "Mount" and "Umount". The r/w layer is created in s.storage.CreatePodSandbox or s.storage.CreateContainer. CreatePodSandbox also "Starts" (mounts) the infra container's layer.
|
Rebased to master to resolve conflicts, fixed the lint error, and introduced a proposed There's some additional logic to convert references to images in other transports into references suitable for use with the local storage when creating images and containers, so some of the self-tests still refer to images using the Reporting of image sizes is kind of broken - if you get an answer at all, it is probably wrong if any of the layers were compressed. |
server/server.go
Outdated
| return nil, err | ||
| } | ||
|
|
||
| imageService, err := scri.GetStorageImageService(store, config.DefaultTransport) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we implement the image service in this repo rather than delegating it compelety?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We could. I think it would actually be cleaner in terms of dependencies to move the entirety of containers/storage/cri into this repo, but I also want it to be in a place where other projects and reuse the logic instead of having to reimplement it themselves, and I'm not sure that's within the scope of what this repo wants to be.
Turning the image functions into members of an interface that isn't exactly runtime.ImageServiceServer would let us move some of its API glue here, and let containers/storage lose its hard dependency on k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime, which pulls in quite a few other things, so maybe that'd work better.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We could. I think it would actually be cleaner in terms of dependencies to move the entirety of containers/storage/cri into this repo, but I also want it to be in a place where other projects and reuse the logic instead of having to reimplement it themselves, and I'm not sure that's within the scope of what this repo wants to be.
I agree. IMO storage library shouldn't have any dependencies on the CRI API. That actually makes it harder to use from other projects. You could have convenience APIs to create a Rootfs for an image and a container ID but higher coupling than that will make it harder to reuse.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Okay, just pushed changes which I think move us closer. We still pull in kube by way of containers/image's support for openshift, but we're insulated from changes in the runtime API, at least.
44c91c2 to
301fbfc
Compare
|
When I run make install on this PR, I see a bunch of SELinux related errors: cc: @rhatdan |
|
We have a lot of lint errors in container/storage vendoring. |
|
Looks like you got garbage in Just remove these files, they should get recreated. |
|
@rhatdan That fixed it for me. Thanks! |
Signed-off-by: Antonio Murdaca <[email protected]>
The CRI doesn't expect us to implicitly pull an image if it isn't already present before we're asked to use it to create a container, and the tests no longer depend on us doing so, either. Limit the logic which attempts to pull an image, if it isn't present, to only pulling the configured "pause" image, since our use of that image for running pod sandboxes is an implementation detail that our clients can't be expected to know or care about. Include the name of the image that we didn't pull in the error we return when we don't pull one. Signed-off-by: Nalin Dahyabhai <[email protected]>
Signed-off-by: Antonio Murdaca <[email protected]>
|
Rebased, adding debug statements in the handlers for image-related requests that log the results. Updated vendoring results now also pull in |
|
Hmm, I'm not that familiar with travis integration, but it doesn't seem to have run for this last rebase. https://www.traviscistatus.com/ says everything should be working, though. Any advice? |
mmm https://travis-ci.org/kubernetes-incubator/cri-o/pull_requests seems like anything has been triggered from this PR. Could you amend the last commit and re-push? If that doesn't work, it should be something on their end definitely and we can just wait. |
|
Sure. |
|
@nalind CI triggered, you can remove that test commit now. |
|
Okay, CI seems to be back. |
|
LGTM |
1 similar comment
|
LGTM |
|
LGTM I'm merging this one right now - there are still issues around devicemapper though and maybe c/storage, we'll tackle these in follow up since I don't believe there's anything left to do as part of this PR (it's better to iterate on simple changes from now on) - for instance, I had to increase the timeout to 15m to be able to run 2 pods spawned at the same time, there seems to be some kind of weird locking which prevents even k8s itself to ping the CRI-O, as said, let's tackle this kind of stuff in follow up. Thanks a lot @nalind and everyone who helped with this :) |
|
🎉 🎉 🎉 🎉 🎉 🎉 🎉 🎉 🎉 Awesome! Great to see this, looking forward to giving it a spin 😄 |
There's no reason to assume the pause image contains a /pause command, and it seems more sane to assume that the pause container has configured Entrypoint and Cmd appropriately without our having to repair anything. Also consider both Entrypoint and Cmd in the image config when populating the runtime config. The image-spec wording for this is in [1]. This will keep the kubernetes/pause image working, because that image sets Entrypoint [2]. Down the road we might be able to use image-tools image -> runtime config converter [3]. It's currently a private method with public access restricted to full bundle unpacks. I'm not sure we need to check for nil podContainer.Config. The check was added in c0333b1 (Integrate containers/storage, 2016-10-18, cri-o#189), but there was too much going on for a motivational comment in the commit message. For this commit, I've assumed it was important and I just clear Process in those cases (which the runtime spec allows [4]). If 'start' is called on those containers and errors (as the spec requires [5]), I think that's a "image was broken" problem and not a "cri-o didn't guess the right value" problem. [1]: https://github.com/opencontainers/image-spec/blob/v1.0.1/conversion.md#verbatim-fields [2]: https://github.com/kubernetes/kubernetes/blob/v1.9.2/build/pause/Dockerfile#L18 [3]: https://github.com/opencontainers/image-tools/blob/v0.3.0/image/config.go#L68 [4]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L145 [5]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/runtime.md#L119 Signed-off-by: W. Trevor King <[email protected]>
There's no reason to assume the pause image contains a /pause command, and it seems more sane to assume that the pause container has configured Entrypoint and Cmd appropriately without our having to repair anything. Also consider both Entrypoint and Cmd in the image config when populating the runtime config. The image-spec wording for this is in [1]. This will keep the kubernetes/pause image working, because that image sets Entrypoint [2]. Down the road we might be able to use image-tools image -> runtime config converter [3]. It's currently a private method with public access restricted to full bundle unpacks. I'm not sure we need to check for nil podContainer.Config. The check was added in c0333b1 (Integrate containers/storage, 2016-10-18, cri-o#189), but there was too much going on for a motivational comment in the commit message. For this commit, I've assumed it was important and I just clear Process in those cases (which the runtime spec allows [4]). If 'start' is called on those containers and errors (as the spec requires [5]), I think that's a "image was broken" problem and not a "cri-o didn't guess the right value" problem. I've also added a process-clearing check for image configs which set neither Entrypoint nor Cmd (both are optional [6,7]). [1]: https://github.com/opencontainers/image-spec/blob/v1.0.1/conversion.md#verbatim-fields [2]: https://github.com/kubernetes/kubernetes/blob/v1.9.2/build/pause/Dockerfile#L18 [3]: https://github.com/opencontainers/image-tools/blob/v0.3.0/image/config.go#L68 [4]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L145 [5]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/runtime.md#L119 [6]: https://github.com/opencontainers/image-spec/blame/v1.0.1/config.md#L138 [7]: https://github.com/opencontainers/image-spec/blame/v1.0.1/config.md#L143 Signed-off-by: W. Trevor King <[email protected]>
There's no reason to assume the pause image contains a /pause command, and it seems more sane to assume that the pause container has configured Entrypoint and Cmd appropriately without our having to repair anything. Also consider both Entrypoint and Cmd in the image config when populating the runtime config. The image-spec wording for this is in [1]. This will keep the kubernetes/pause image working, because that image sets Entrypoint [2]. I'm not sure we need to check for nil podContainer.Config. The check was added in c0333b1 (Integrate containers/storage, 2016-10-18, cri-o#189), but there was too much going on for a motivational comment in the commit message. For this commit, I've assumed it was important and I just clear Process in those cases (which the runtime spec allows [3]). If 'start' is called on those containers and errors (as the spec requires [4]), I think that's a "image was broken" problem and not a "cri-o didn't guess the right value" problem. I've also added a process-clearing check for image configs which set neither Entrypoint nor Cmd (both are optional [5,6]). Down the road we might be able to use image-tools image -> runtime config converter [7]. It's currently a private method with public access restricted to full bundle unpacks. [1]: https://github.com/opencontainers/image-spec/blob/v1.0.1/conversion.md#verbatim-fields [2]: https://github.com/kubernetes/kubernetes/blob/v1.9.2/build/pause/Dockerfile#L18 [3]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L145 [4]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/runtime.md#L119 [5]: https://github.com/opencontainers/image-spec/blame/v1.0.1/config.md#L138 [6]: https://github.com/opencontainers/image-spec/blame/v1.0.1/config.md#L143 [7]: https://github.com/opencontainers/image-tools/blob/v0.3.0/image/config.go#L68 Signed-off-by: W. Trevor King <[email protected]>
Use buildOCIProcessArgs to calculate process.args considering PauseCommand (if it was set) and the image's configured Entrypoint and Cmd. This improves the previous implementation, which had been ignoring Entrypoint, despite the image-spec recommendations to consider it [1]. There's no reason to assume the pause image contains a /pause command, and it seems more sane to assume that the pause container has configured Entrypoint and Cmd appropriately without our having to repair anything. Now that we're considering Entrypoint, kubernetes/pause (which sets Entrypoint [2]) no longer needs a PauseCommand "override". I've dropped the podContainer.Config nil check because later code is using it without a guard (e.g. podContainer.Config.Config.StopSignal) and that hasn't caused problems. The check was added in c0333b1 (Integrate containers/storage, 2016-10-18, cri-o#189), but there was too much going on for a motivational comment in the commit message. When processArgs is empty, I'm setting Process nil (which the runtime spec allows [3]) following createSandboxContainer. If 'start' is called on those containers and errors (as the spec requires [4]), I think that's an "image was broken" problem and not a "cri-o didn't guess the right value" problem. I've shifted the process.args code down within RunPodSandbox where the possible Process nil can clobber the Process object created by SetProcessSelinuxLabel. I didn't see any later configuration that looked like it would create Process (which would require process.args [5]). Down the road we might be able to use image-tools image -> runtime config converter [6]. It's currently a private method with public access restricted to full bundle unpacks. [1]: https://github.com/opencontainers/image-spec/blob/v1.0.1/conversion.md#verbatim-fields [2]: https://github.com/kubernetes/kubernetes/blob/v1.9.2/build/pause/Dockerfile#L18 [3]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L145 [4]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/runtime.md#L119 [5]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L157 [6]: https://github.com/opencontainers/image-tools/blob/v0.3.0/image/config.go#L68 Signed-off-by: W. Trevor King <[email protected]>
Use buildOCIProcessArgs to calculate process.args considering PauseCommand (if it was set) and the image's configured Entrypoint and Cmd. This improves the previous implementation, which had been ignoring Entrypoint, despite the image-spec recommendations to consider it [1]. There's no reason to assume the pause image contains a /pause command, and it seems more sane to assume that the pause container has configured Entrypoint and Cmd appropriately without our having to repair anything. Now that we're considering Entrypoint, kubernetes/pause (which sets Entrypoint [2]) no longer needs a PauseCommand "override". I've dropped the podContainer.Config nil check because later code is using it without a guard (e.g. podContainer.Config.Config.StopSignal) and that hasn't caused problems. The check was added in c0333b1 (Integrate containers/storage, 2016-10-18, cri-o#189), but there was too much going on for a motivational comment in the commit message. When processArgs is empty, I'm setting Process nil (which the runtime spec allows [3]) following createSandboxContainer. If 'start' is called on those containers and errors (as the spec requires [4]), I think that's an "image was broken" problem and not a "cri-o didn't guess the right value" problem. I've shifted the process.args code down within RunPodSandbox where the possible Process nil can clobber the Process object created by SetProcessSelinuxLabel. I didn't see any later configuration that looked like it would create Process (which would require process.args [5]). Down the road we might be able to use image-tools image -> runtime config converter [6]. It's currently a private method with public access restricted to full bundle unpacks. [1]: https://github.com/opencontainers/image-spec/blob/v1.0.1/conversion.md#verbatim-fields [2]: https://github.com/kubernetes/kubernetes/blob/v1.9.2/build/pause/Dockerfile#L18 [3]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L145 [4]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/runtime.md#L119 [5]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L157 [6]: https://github.com/opencontainers/image-tools/blob/v0.3.0/image/config.go#L68 Signed-off-by: W. Trevor King <[email protected]>
Use buildOCIProcessArgs to calculate process.args considering PauseCommand (if it was set) and the image's configured Entrypoint and Cmd. This improves the previous implementation, which had been ignoring Entrypoint, despite the image-spec recommendations to consider it [1]. There's no reason to assume the pause image contains a /pause command, and it seems more sane to assume that the pause container has configured Entrypoint and Cmd appropriately without our having to repair anything. Now that we're considering Entrypoint, kubernetes/pause (which sets Entrypoint [2]) no longer needs a PauseCommand "override". I've dropped the podContainer.Config nil check because later code is using it without a guard (e.g. podContainer.Config.Config.StopSignal) and that hasn't caused problems. The check was added in c0333b1 (Integrate containers/storage, 2016-10-18, cri-o#189), but there was too much going on for a motivational comment in the commit message. When processArgs is empty, I'm setting Process nil (which the runtime spec allows [3]) following createSandboxContainer. If 'start' is called on those containers and errors (as the spec requires [4]), I think that's an "image was broken" problem and not a "cri-o didn't guess the right value" problem. I've shifted the process.args code down within RunPodSandbox where the possible Process nil can clobber the Process object created by SetProcessSelinuxLabel. I didn't see any later configuration that looked like it would create Process (which would require process.args [5]). Down the road we might be able to use image-tools image -> runtime config converter [6]. It's currently a private method with public access restricted to full bundle unpacks. [1]: https://github.com/opencontainers/image-spec/blob/v1.0.1/conversion.md#verbatim-fields [2]: https://github.com/kubernetes/kubernetes/blob/v1.9.2/build/pause/Dockerfile#L18 [3]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L145 [4]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/runtime.md#L119 [5]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L157 [6]: https://github.com/opencontainers/image-tools/blob/v0.3.0/image/config.go#L68 Signed-off-by: W. Trevor King <[email protected]>
Use buildOCIProcessArgs to calculate process.args considering PauseCommand (if it was set) and the image's configured Entrypoint and Cmd. This improves the previous implementation, which had been ignoring Entrypoint, despite the image-spec recommendations to consider it [1]. There's no reason to assume the pause image contains a /pause command, and it seems more sane to assume that the pause container has configured Entrypoint and Cmd appropriately without our having to repair anything. Now that we're considering Entrypoint, kubernetes/pause (which sets Entrypoint [2]) no longer needs a PauseCommand "override". I've dropped the podContainer.Config nil check because later code is using it without a guard (e.g. podContainer.Config.Config.StopSignal) and that hasn't caused problems. The check was added in c0333b1 (Integrate containers/storage, 2016-10-18, cri-o#189), but there was too much going on for a motivational comment in the commit message. When processArgs is empty, I'm setting Process nil (which the runtime spec allows [3]) following createSandboxContainer. If 'start' is called on those containers and errors (as the spec requires [4]), I think that's an "image was broken" problem and not a "cri-o didn't guess the right value" problem. I've shifted the process.args code down within RunPodSandbox where the possible Process nil can clobber the Process object created by SetProcessSelinuxLabel. I didn't see any later configuration that looked like it would create Process (which would require process.args [5]). Down the road we might be able to use image-tools image -> runtime config converter [6]. It's currently a private method with public access restricted to full bundle unpacks. [1]: https://github.com/opencontainers/image-spec/blob/v1.0.1/conversion.md#verbatim-fields [2]: https://github.com/kubernetes/kubernetes/blob/v1.9.2/build/pause/Dockerfile#L18 [3]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L145 [4]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/runtime.md#L119 [5]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L157 [6]: https://github.com/opencontainers/image-tools/blob/v0.3.0/image/config.go#L68 Signed-off-by: W. Trevor King <[email protected]>
Use buildOCIProcessArgs to calculate process.args considering PauseCommand (if it was set) and the image's configured Entrypoint and Cmd. This improves the previous implementation, which had been ignoring Entrypoint, despite the image-spec recommendations to consider it [1]. There's no reason to assume the pause image contains a /pause command, and it seems more sane to assume that the pause container has configured Entrypoint and Cmd appropriately without our having to repair anything. Now that we're considering Entrypoint, kubernetes/pause (which sets Entrypoint [2]) no longer needs a PauseCommand "override". I've dropped the podContainer.Config nil check because later code is using it without a guard (e.g. podContainer.Config.Config.StopSignal) and that hasn't caused problems. The check was added in c0333b1 (Integrate containers/storage, 2016-10-18, cri-o#189), but there was too much going on for a motivational comment in the commit message. When processArgs is empty, I'm setting Process nil (which the runtime spec allows [3]). If 'start' is called on those containers and errors (as the spec requires [4]), I think that's an "image was broken" problem and not a "cri-o didn't guess the right value" problem. I've shifted the process.args code down within RunPodSandbox where the possible Process nil can clobber the Process object created by SetProcessSelinuxLabel. I didn't see any later configuration that looked like it would create Process (which would require process.args [5]). I've shifted the empty-args error from buildOCIProcessArgs into createSandboxContainer, so createSandboxContainer still gets that check but the new RunPodSandbox avoids it. I'd prefer to drop it from createSandboxContainer too, but Mrunal feels like worker containers will always be started and prefers to fail fast in those cases [6]. Down the road we might be able to use image-tools image -> runtime config converter [7]. It's currently a private method with public access restricted to full bundle unpacks. [1]: https://github.com/opencontainers/image-spec/blob/v1.0.1/conversion.md#verbatim-fields [2]: https://github.com/kubernetes/kubernetes/blob/v1.9.2/build/pause/Dockerfile#L18 [3]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L145 [4]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/runtime.md#L119 [5]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L157 [6]: cri-o#1265 (comment) [7]: https://github.com/opencontainers/image-tools/blob/v0.3.0/image/config.go#L68 Signed-off-by: W. Trevor King <[email protected]>
Use buildOCIProcessArgs to calculate process.args considering PauseCommand (if it was set) and the image's configured Entrypoint and Cmd. This improves the previous implementation, which had been ignoring Entrypoint, despite the image-spec recommendations to consider it [1]. There's no reason to assume the pause image contains a /pause command, and it seems more sane to assume that the pause container has configured Entrypoint and Cmd appropriately without our having to repair anything. Now that we're considering Entrypoint, kubernetes/pause (which sets Entrypoint [2]) no longer needs a PauseCommand "override". I've dropped the podContainer.Config nil check because later code is using it without a guard (e.g. podContainer.Config.Config.StopSignal) and that hasn't caused problems. The check was added in c0333b1 (Integrate containers/storage, 2016-10-18, cri-o#189), but there was too much going on for a motivational comment in the commit message. When processArgs is empty, I'm setting Process nil (which the runtime spec allows [3]). If 'start' is called on those containers and errors (as the spec requires [4]), I think that's an "image was broken" problem and not a "cri-o didn't guess the right value" problem. I've shifted the process.args code down within RunPodSandbox where the possible Process nil can clobber the Process object created by SetProcessSelinuxLabel. I didn't see any later configuration that looked like it would create Process (which would require process.args [5]). I've shifted the empty-args error from buildOCIProcessArgs into createSandboxContainer, so createSandboxContainer still gets that check but the new RunPodSandbox consumer avoids it. I'd prefer to drop it from createSandboxContainer too, but Mrunal feels like worker containers will always be started and prefers to fail fast in those cases [6]. Down the road we might be able to use image-tools image -> runtime config converter [7]. It's currently a private method with public access restricted to full bundle unpacks. [1]: https://github.com/opencontainers/image-spec/blob/v1.0.1/conversion.md#verbatim-fields [2]: https://github.com/kubernetes/kubernetes/blob/v1.9.2/build/pause/Dockerfile#L18 [3]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L145 [4]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/runtime.md#L119 [5]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L157 [6]: cri-o#1265 (comment) [7]: https://github.com/opencontainers/image-tools/blob/v0.3.0/image/config.go#L68 Signed-off-by: W. Trevor King <[email protected]>
Use buildOCIProcessArgs to calculate process.args considering PauseCommand (if it was set) and the image's configured Entrypoint and Cmd. This improves the previous implementation, which had been ignoring Entrypoint, despite the image-spec recommendations to consider it [1]. There's no reason to assume the pause image contains a /pause command, and it seems more sane to assume that the pause container has configured Entrypoint and Cmd appropriately without our having to repair anything. Now that we're considering Entrypoint, kubernetes/pause (which sets Entrypoint [2]) no longer needs a PauseCommand "override". I've dropped the podContainer.Config nil check because later code is using it without a guard (e.g. podContainer.Config.Config.StopSignal) and that hasn't caused problems. The check was added in c0333b1 (Integrate containers/storage, 2016-10-18, cri-o#189), but there was too much going on for a motivational comment in the commit message. When processArgs is empty, I'm setting Process nil (which the runtime spec allows [3]). If 'start' is called on those containers and errors (as the spec requires [4]), I think that's an "image was broken" problem and not a "cri-o didn't guess the right value" problem. I've shifted the process.args code down within RunPodSandbox where the possible Process nil can clobber the Process object created by SetProcessSelinuxLabel. I didn't see any later configuration that looked like it would create Process (which would require process.args [5]). I've shifted the empty-args error from buildOCIProcessArgs into createSandboxContainer, so createSandboxContainer still gets that check but the new RunPodSandbox consumer avoids it. I'd prefer to drop it from createSandboxContainer too, but Mrunal feels like worker containers will always be started and prefers to fail fast in those cases [6]. Down the road we might be able to use image-tools image -> runtime config converter [7]. It's currently a private method with public access restricted to full bundle unpacks. [1]: https://github.com/opencontainers/image-spec/blob/v1.0.1/conversion.md#verbatim-fields [2]: https://github.com/kubernetes/kubernetes/blob/v1.9.2/build/pause/Dockerfile#L18 [3]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L145 [4]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/runtime.md#L119 [5]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L157 [6]: cri-o#1265 (comment) [7]: https://github.com/opencontainers/image-tools/blob/v0.3.0/image/config.go#L68 Signed-off-by: W. Trevor King <[email protected]>
Use buildOCIProcessArgs to calculate process.args considering PauseCommand (if it was set) and the image's configured Entrypoint and Cmd. This improves the previous implementation, which had been ignoring Entrypoint, despite the image-spec recommendations to consider it [1]. There's no reason to assume the pause image contains a /pause command, and it seems more sane to assume that the pause container has configured Entrypoint and Cmd appropriately without our having to repair anything. Now that we're considering Entrypoint, kubernetes/pause (which sets Entrypoint [2]) no longer needs a PauseCommand "override". I've dropped the podContainer.Config nil check because later code is using it without a guard (e.g. podContainer.Config.Config.StopSignal) and that hasn't caused problems. The check was added in c0333b1 (Integrate containers/storage, 2016-10-18, cri-o#189), but there was too much going on for a motivational comment in the commit message. When processArgs is empty, I'm setting Process nil (which the runtime spec allows [3]). If 'start' is called on those containers and errors (as the spec requires [4]), I think that's an "image was broken" problem and not a "cri-o didn't guess the right value" problem. I've shifted the process.args code down within RunPodSandbox where the possible Process nil can clobber the Process object created by SetProcessSelinuxLabel. I didn't see any later configuration that looked like it would create Process (which would require process.args [5]). I've shifted the empty-args error from buildOCIProcessArgs into createSandboxContainer, so createSandboxContainer still gets that check but the new RunPodSandbox consumer avoids it. I'd prefer to drop it from createSandboxContainer too, but Mrunal feels like worker containers will always be started and prefers to fail fast in those cases [6]. Down the road we might be able to use image-tools image -> runtime config converter [7]. It's currently a private method with public access restricted to full bundle unpacks. [1]: https://github.com/opencontainers/image-spec/blob/v1.0.1/conversion.md#verbatim-fields [2]: https://github.com/kubernetes/kubernetes/blob/v1.9.2/build/pause/Dockerfile#L18 [3]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L145 [4]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/runtime.md#L119 [5]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L157 [6]: cri-o#1265 (comment) [7]: https://github.com/opencontainers/image-tools/blob/v0.3.0/image/config.go#L68 Signed-off-by: W. Trevor King <[email protected]>
unable to prepare context, unable to evaluate symlinks in context path when building target test-packaging-tools on ppc64le. Fixes: cri-o#189 Signed-off-by: Nitesh Konkar [email protected]
Use buildOCIProcessArgs to calculate process.args considering PauseCommand (if it was set) and the image's configured Entrypoint and Cmd. This improves the previous implementation, which had been ignoring Entrypoint, despite the image-spec recommendations to consider it [1]. There's no reason to assume the pause image contains a /pause command, and it seems more sane to assume that the pause container has configured Entrypoint and Cmd appropriately without our having to repair anything. Now that we're considering Entrypoint, kubernetes/pause (which sets Entrypoint [2]) no longer needs a PauseCommand "override". I've dropped the podContainer.Config nil check because later code is using it without a guard (e.g. podContainer.Config.Config.StopSignal) and that hasn't caused problems. The check was added in c0333b1 (Integrate containers/storage, 2016-10-18, cri-o#189), but there was too much going on for a motivational comment in the commit message. When processArgs is empty, I'm setting Process nil (which the runtime spec allows [3]). If 'start' is called on those containers and errors (as the spec requires [4]), I think that's an "image was broken" problem and not a "cri-o didn't guess the right value" problem. I've shifted the process.args code down within RunPodSandbox where the possible Process nil can clobber the Process object created by SetProcessSelinuxLabel. I didn't see any later configuration that looked like it would create Process (which would require process.args [5]). I've shifted the empty-args error from buildOCIProcessArgs into createSandboxContainer, so createSandboxContainer still gets that check but the new RunPodSandbox consumer avoids it. I'd prefer to drop it from createSandboxContainer too, but Mrunal feels like worker containers will always be started and prefers to fail fast in those cases [6]. Down the road we might be able to use image-tools image -> runtime config converter [7]. It's currently a private method with public access restricted to full bundle unpacks. [1]: https://github.com/opencontainers/image-spec/blob/v1.0.1/conversion.md#verbatim-fields [2]: https://github.com/kubernetes/kubernetes/blob/v1.9.2/build/pause/Dockerfile#L18 [3]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L145 [4]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/runtime.md#L119 [5]: https://github.com/opencontainers/runtime-spec/blame/v1.0.1/config.md#L157 [6]: cri-o#1265 (comment) [7]: https://github.com/opencontainers/image-tools/blob/v0.3.0/image/config.go#L68 Signed-off-by: W. Trevor King <[email protected]>
Picking up from #28, this PR builds on #210 to pull images using containers/image, and to put images, pod sandboxes, and containers in space managed by containers/storage.
Close #298