Skip to content

Commit 1537f31

Browse files
ehazlettcrosbymichael
ehazlett
authored and
crosbymichael
committed
Add install support for binary images
This adds a way for users to programatically install containerd binary dependencies. With runtime v2 and new shim's being built, it will be a challenge to get those onto machines. Users would have to find the link, download, place it in their path, yada yada yada. With this functionality of a managed `/opt` directory, containerd can use existing image and distribution infra. to get binarys, shims, etc onto the system. Configuration: *default:* `/opt/containerd` *containerd config:* ```toml [plugins.opt] path = "/opt/mypath" ``` Usage: *code:* ```go image, err := client.Pull(ctx, "docker.io/crosbymichael/runc:latest") client.Install(ctx, image) ``` *ctr:* ```bash ctr content fetch docker.io/crosbymichael/runc:latest ctr install docker.io/crosbymichael/runc:latest ``` You can manage versions and see what is running via standard image commands. Images: These images MUST be small and only contain binaries. ```Dockerfile FROM scratch Add runc /bin/runc ``` Containerd will only extract files in `/bin` of the image. Later on, we can add support for `/lib`. The code adds a service to manage an `/opt/containerd` directory and provide that path to callers via the introspection service. How to Test: Delete runc from your system. ```bash > sudo ctr run --rm docker.io/library/redis:alpine redis ctr: OCI runtime create failed: unable to retrieve OCI runtime error (open /run/containerd/io.containerd.runtime.v1.linux/default/redis/log.json: no such file or directory): exec: "runc": executable file not found in $PATH: unknown > sudo ctr content fetch docker.io/crosbymichael/runc:latest > sudo ctr install docker.io/crosbymichael/runc:latest > sudo ctr run --rm docker.io/library/redis:alpine redis 1:C 01 Aug 15:59:52.864 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo 1:C 01 Aug 15:59:52.864 # Redis version=4.0.10, bits=64, commit=00000000, modified=0, pid=1, just started 1:C 01 Aug 15:59:52.864 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf 1:M 01 Aug 15:59:52.866 # You requested maxclients of 10000 requiring at least 10032 max file descriptors. 1:M 01 Aug 15:59:52.866 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. 1:M 01 Aug 15:59:52.866 # Current maximum open files is 1024. maxclients has been reduced to 992 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. 1:M 01 Aug 15:59:52.870 * Running mode=standalone, port=6379. 1:M 01 Aug 15:59:52.870 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. 1:M 01 Aug 15:59:52.870 # Server initialized 1:M 01 Aug 15:59:52.870 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect. 1:M 01 Aug 15:59:52.870 # WARNING you have Transparent Huge Pages (THP) support enabled in your kernel. This will create latency and memory usage issues with Redis. To fix this issue run the command 'echo never > /sys/kernel/mm/transparent_hugepage/enabled' as root, and add it to your /etc/rc.local in order to retain the setting after a reboot. Redis must be restarted after THP is disabled. 1:M 01 Aug 15:59:52.870 * Ready to accept connections ^C1:signal-handler (1533139193) Received SIGINT scheduling shutdown... 1:M 01 Aug 15:59:53.472 # User requested shutdown... 1:M 01 Aug 15:59:53.472 * Saving the final RDB snapshot before exiting. 1:M 01 Aug 15:59:53.484 * DB saved on disk 1:M 01 Aug 15:59:53.484 # Redis is now ready to exit, bye bye... ``` Signed-off-by: Evan Hazlett <[email protected]> Signed-off-by: Michael Crosby <[email protected]>
1 parent 9ca687b commit 1537f31

File tree

11 files changed

+253
-0
lines changed

11 files changed

+253
-0
lines changed

‎archive/tar.go

+7
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,9 @@ func Apply(ctx context.Context, root string, r io.Reader, opts ...ApplyOpt) (int
114114
return 0, errors.Wrap(err, "failed to apply option")
115115
}
116116
}
117+
if options.Filter == nil {
118+
options.Filter = all
119+
}
117120

118121
return apply(ctx, root, tar.NewReader(r), options)
119122
}
@@ -155,6 +158,10 @@ func applyNaive(ctx context.Context, root string, tr *tar.Reader, options ApplyO
155158
// Normalize name, for safety and for a simple is-root check
156159
hdr.Name = filepath.Clean(hdr.Name)
157160

161+
if !options.Filter(hdr) {
162+
continue
163+
}
164+
158165
if skipFile(hdr) {
159166
log.G(ctx).Warnf("file %q ignored: archive may not be supported on system", hdr.Name)
160167
continue

‎archive/tar_opts.go

+18
Original file line numberDiff line numberDiff line change
@@ -16,5 +16,23 @@
1616

1717
package archive
1818

19+
import "archive/tar"
20+
1921
// ApplyOpt allows setting mutable archive apply properties on creation
2022
type ApplyOpt func(options *ApplyOptions) error
23+
24+
// Filter specific files from the archive
25+
type Filter func(*tar.Header) bool
26+
27+
// all allows all files
28+
func all(_ *tar.Header) bool {
29+
return true
30+
}
31+
32+
// WithFilter uses the filter to select which files are to be extracted.
33+
func WithFilter(f Filter) ApplyOpt {
34+
return func(options *ApplyOptions) error {
35+
options.Filter = f
36+
return nil
37+
}
38+
}

‎archive/tar_opts_unix.go

+1
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,5 @@ package archive
2020

2121
// ApplyOptions provides additional options for an Apply operation
2222
type ApplyOptions struct {
23+
Filter Filter // Filter tar headers
2324
}

‎archive/tar_opts_windows.go

+1
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ package archive
2222
type ApplyOptions struct {
2323
ParentLayerPaths []string // Parent layer paths used for Windows layer apply
2424
IsWindowsContainerLayer bool // True if the tar stream to be applied is a Windows Container Layer
25+
Filter Filter // Filter tar headers
2526
}
2627

2728
// WithParentLayers adds parent layers to the apply process this is required

‎cmd/containerd/builtins.go

+1
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ import (
3030
_ "github.com/containerd/containerd/services/introspection"
3131
_ "github.com/containerd/containerd/services/leases"
3232
_ "github.com/containerd/containerd/services/namespaces"
33+
_ "github.com/containerd/containerd/services/opt"
3334
_ "github.com/containerd/containerd/services/snapshots"
3435
_ "github.com/containerd/containerd/services/tasks"
3536
_ "github.com/containerd/containerd/services/version"

‎cmd/ctr/app/main.go

+2
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
"github.com/containerd/containerd/cmd/ctr/commands/content"
2525
"github.com/containerd/containerd/cmd/ctr/commands/events"
2626
"github.com/containerd/containerd/cmd/ctr/commands/images"
27+
"github.com/containerd/containerd/cmd/ctr/commands/install"
2728
"github.com/containerd/containerd/cmd/ctr/commands/leases"
2829
namespacesCmd "github.com/containerd/containerd/cmd/ctr/commands/namespaces"
2930
"github.com/containerd/containerd/cmd/ctr/commands/plugins"
@@ -103,6 +104,7 @@ containerd CLI
103104
run.Command,
104105
snapshots.Command,
105106
tasks.Command,
107+
install.Command,
106108
}, extraCmds...)
107109
app.Before = func(context *cli.Context) error {
108110
if context.GlobalBool("debug") {

‎cmd/ctr/commands/install/install.go

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package install
18+
19+
import (
20+
"github.com/containerd/containerd/cmd/ctr/commands"
21+
"github.com/urfave/cli"
22+
)
23+
24+
// Command to install binary packages
25+
var Command = cli.Command{
26+
Name: "install",
27+
Usage: "install a new package",
28+
ArgsUsage: "<ref>",
29+
Description: "install a new package",
30+
Action: func(context *cli.Context) error {
31+
client, ctx, cancel, err := commands.NewClient(context)
32+
if err != nil {
33+
return err
34+
}
35+
defer cancel()
36+
ref := context.Args().First()
37+
image, err := client.GetImage(ctx, ref)
38+
if err != nil {
39+
return err
40+
}
41+
return client.Install(ctx, image)
42+
},
43+
}

‎install.go

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package containerd
18+
19+
import (
20+
"archive/tar"
21+
"context"
22+
"errors"
23+
"path/filepath"
24+
25+
introspectionapi "github.com/containerd/containerd/api/services/introspection/v1"
26+
"github.com/containerd/containerd/archive"
27+
"github.com/containerd/containerd/archive/compression"
28+
"github.com/containerd/containerd/content"
29+
"github.com/containerd/containerd/images"
30+
"github.com/containerd/containerd/platforms"
31+
)
32+
33+
// Install a binary image into the opt service
34+
func (c *Client) Install(ctx context.Context, image Image) error {
35+
resp, err := c.IntrospectionService().Plugins(ctx, &introspectionapi.PluginsRequest{
36+
Filters: []string{
37+
"id==opt",
38+
},
39+
})
40+
if err != nil {
41+
return err
42+
}
43+
if len(resp.Plugins) != 1 {
44+
return errors.New("opt service not enabled")
45+
}
46+
path := resp.Plugins[0].Exports["path"]
47+
if path == "" {
48+
return errors.New("opt path not exported")
49+
}
50+
var (
51+
cs = image.ContentStore()
52+
platform = platforms.Default()
53+
)
54+
manifest, err := images.Manifest(ctx, cs, image.Target(), platform)
55+
if err != nil {
56+
return err
57+
}
58+
for _, layer := range manifest.Layers {
59+
ra, err := cs.ReaderAt(ctx, layer)
60+
if err != nil {
61+
return err
62+
}
63+
cr := content.NewReader(ra)
64+
r, err := compression.DecompressStream(cr)
65+
if err != nil {
66+
return err
67+
}
68+
defer r.Close()
69+
if _, err := archive.Apply(ctx, path, r, archive.WithFilter(func(hdr *tar.Header) bool {
70+
return filepath.Dir(hdr.Name) == "bin"
71+
})); err != nil {
72+
return err
73+
}
74+
}
75+
return nil
76+
}

‎services/opt/path_unix.go

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
// +build !windows
2+
3+
/*
4+
Copyright The containerd Authors.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
*/
18+
19+
package opt
20+
21+
const defaultPath = "/opt/containerd"

‎services/opt/path_windows.go

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package opt
18+
19+
import (
20+
"path/filepath"
21+
22+
"github.com/containerd/containerd/defaults"
23+
)
24+
25+
var defaultPath = filepath.Join(defaults.DefaultRootDir, "opt")

‎services/opt/service.go

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package opt
18+
19+
import (
20+
"fmt"
21+
"os"
22+
"path/filepath"
23+
24+
"github.com/containerd/containerd/plugin"
25+
"github.com/pkg/errors"
26+
)
27+
28+
// Config for the opt manager
29+
type Config struct {
30+
// Path for the opt directory
31+
Path string `toml:"path"`
32+
}
33+
34+
func init() {
35+
plugin.Register(&plugin.Registration{
36+
Type: plugin.InternalPlugin,
37+
ID: "opt",
38+
Config: &Config{
39+
Path: defaultPath,
40+
},
41+
InitFn: func(ic *plugin.InitContext) (interface{}, error) {
42+
path := ic.Config.(*Config).Path
43+
ic.Meta.Exports["path"] = path
44+
45+
bin := filepath.Join(path, "bin")
46+
if err := os.MkdirAll(bin, 0711); err != nil {
47+
return nil, err
48+
}
49+
if err := os.Setenv("PATH", fmt.Sprintf("%s:%s", bin, os.Getenv("PATH"))); err != nil {
50+
return nil, errors.Wrapf(err, "set binary image directory in path %s", bin)
51+
}
52+
return &manager{}, nil
53+
},
54+
})
55+
}
56+
57+
type manager struct {
58+
}

0 commit comments

Comments
 (0)