Skip to content

Commit ce8e8e8

Browse files
mikebrowmikebrow
authored
Merge pull request #5036 from thaJeztah/split_runc_binary
Separate runc binary version from libcontainer version, and remove obsolete build-tags
2 parents 381cbdd + 79a51cd commit ce8e8e8

6 files changed

Lines changed: 61 additions & 19 deletions

File tree

‎BUILDING.md‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,13 @@ RUN apt-get update && \
180180

181181
```
182182

183-
In our Docker container we will use a specific `runc` build which includes [seccomp](https://en.wikipedia.org/wiki/seccomp) and [apparmor](https://en.wikipedia.org/wiki/AppArmor) support. Hence why our Dockerfile includes `libseccomp-dev` as a dependency (apparmor support doesn't require external libraries). Please refer to [RUNC.md](/docs/RUNC.md) for the currently supported version of `runc` that is used by containerd.
183+
In our Docker container we will build `runc` build, which includes
184+
[seccomp](https://en.wikipedia.org/wiki/seccomp), [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux),
185+
and [AppArmor](https://en.wikipedia.org/wiki/AppArmor) support. Seccomp support
186+
in runc requires `libseccomp-dev` as a dependency (AppArmor and SELinux support
187+
do not require external libraries at build time). Refer to [RUNC.md](docs/RUNC.md)
188+
in the docs directory to for details about building runc, and to learn about
189+
supported versions of `runc` as used by containerd.
184190

185191
Let's suppose you build an image called `containerd/build` from the above Dockerfile. You can run the following command:
186192

@@ -209,9 +215,12 @@ Next, let's build `runc`:
209215

210216
```sh
211217
cd /go/src/github.com/opencontainers/runc
212-
make BUILDTAGS='seccomp apparmor selinux' && make install
218+
make && make install
213219
```
214220

221+
For further details about building runc, refer to [RUNC.md](docs/RUNC.md) in the
222+
docs directory.
223+
215224
When working with `ctr`, the simple test client we just built, don't forget to start the daemon!
216225

217226
```sh

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,8 @@ Please be aware: nightly builds might have critical bugs, it's not recommended f
4949

5050
Runtime requirements for containerd are very minimal. Most interactions with
5151
the Linux and Windows container feature sets are handled via [runc](https://github.com/opencontainers/runc) and/or
52-
OS-specific libraries (e.g. [hcsshim](https://github.com/Microsoft/hcsshim) for Microsoft). The current required version of `runc` is always listed in [RUNC.md](/docs/RUNC.md).
52+
OS-specific libraries (e.g. [hcsshim](https://github.com/Microsoft/hcsshim) for Microsoft).
53+
The current required version of `runc` is described in [RUNC.md](docs/RUNC.md).
5354

5455
There are specific features
5556
used by containerd core code and snapshotters that will require a minimum kernel

‎contrib/Dockerfile.test‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@
55
# 2.) docker run -it --privileged -v /tmp:/tmp --tmpfs /var/lib/containerd-test containerd-test bash
66
# 3.) $ make binaries install test
77
#
8+
# Use the RUNC_VERSION build-arg to build with a custom version of runc, for example,
9+
# to build runc v1.0.0-rc93, use:
10+
#
11+
# docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc93 -f Dockerfile.test ../
812

913
ARG GOLANG_VERSION=1.16.1
1014

@@ -32,8 +36,9 @@ RUN apt-get update && apt-get install -y \
3236
libseccomp-dev \
3337
--no-install-recommends
3438

35-
COPY go.mod go.mod
36-
COPY script/setup/install-runc install-runc
39+
COPY script/setup/runc-version script/setup/install-runc ./
40+
# Allow overriding the version of runc to install through build-args
41+
ARG RUNC_VERSION
3742
ARG GOPROXY=direct
3843
RUN ./install-runc
3944

‎docs/RUNC.md‎

Lines changed: 34 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,48 @@
1-
containerd is built with OCI support and with support for advanced features provided by [runc](https://github.com/opencontainers/runc).
1+
containerd is built with OCI support and with support for advanced features
2+
provided by [runc](https://github.com/opencontainers/runc).
23

3-
We depend on a specific `runc` version when dealing with advanced features. You should have a specific runc build for development. The current supported runc commit is described in [`go.mod`](../go.mod). Please refer to the line that starts with `github.com/opencontainers/runc`.
4+
Development (`-dev`) and pre-releases of containerd may depend features in `runc`
5+
that have not yet been released, and may require a specific runc build. The version
6+
of runc that is tested against in our CI can be found in the [`script/setup/runc-version`](../script/setup/runc-version)
7+
file, which may point to a git-commit (for pre releases) or tag in the runc
8+
repository.
49

5-
For more information on how to clone and build runc see the runc Building [documentation](https://github.com/opencontainers/runc#building).
10+
For regular (non-pre-)releases of containerd releases, we attempt to use released
11+
(tagged) versions of runc. We recommend using a version of runc that's equal to
12+
or higher than the version of runc described in [`script/setup/runc-version`](../script/setup/runc-version).
613

7-
Note: before building you may need to install additional support, which will vary by platform. For example, you may need to install `libseccomp` e.g. `libseccomp-dev` for Ubuntu.
14+
If you encounter any runtime errors, make sure your runc is in sync with the
15+
commit or tag provided in that file.
816

917
## building
1018

11-
From within your `opencontainers/runc` repository run:
19+
> For more information on how to clone and build runc also refer to the runc
20+
> building [documentation](https://github.com/opencontainers/runc#building).
21+
22+
Before building runc you may need to install additional build dependencies, which
23+
will vary by platform. For example, you may need to install `libseccomp` e.g.
24+
`libseccomp-dev` for Ubuntu.
1225

13-
### apparmor
26+
From within your `opencontainers/runc` repository run:
1427

1528
```bash
16-
make BUILDTAGS='seccomp apparmor' && sudo make install
29+
make && sudo make install
1730
```
1831

19-
### selinux
32+
Starting with runc 1.0.0-rc93, the "selinux" and "apparmor" buildtags have been
33+
removed, and runc builds have SELinux, AppArmor, and seccomp support enabled
34+
by default. Note that "seccomp" can be disabled by passing an empty `BUILDTAGS`
35+
make variable, but is highly recommended to keep enabled.
2036

21-
```bash
22-
make BUILDTAGS='seccomp selinux' && sudo make install
37+
By default, runc is compiled with kernel-memory limiting support enabled. This
38+
functionality is deprecated in kernel 5.4 and up, and is known to be broken on
39+
RHEL7 and CentOS 7 3.10 kernels. For these kernels, we recommend disabling kmem
40+
support using the `nokmem` build-tag. When doing so, be sure to set the `seccomp`
41+
build-tag to enable seccomp support, for example:
42+
43+
```sh
44+
make BUILDTAGS='nokmem seccomp' && make install
2345
```
2446

25-
After an official runc release we will start pinning containerd support to a specific version but various development and testing features may require a newer runc version than the latest release. If you encounter any runtime errors, please make sure your runc is in sync with the commit/tag provided in this document.
47+
For details about the `nokmem` build-tag, refer to the discussion on [opencontainers/runc#2594](https://github.com/opencontainers/runc/pull/2594).
48+
For further details on building runc, refer to the [build instructions in the runc README](https://github.com/opencontainers/runc#building).

‎script/setup/install-runc‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,16 @@
2121
set -eu -o pipefail
2222

2323
function install_runc() {
24-
RUNC_COMMIT=$(grep opencontainers/runc "$GOPATH"/src/github.com/containerd/containerd/go.mod | awk '{print $2}')
24+
script_dir="$(cd -- "$(dirname -- "$0")" > /dev/null 2>&1; pwd -P)"
25+
26+
# When updating runc-version, consider updating the runc module in go.mod as well
27+
: "${RUNC_VERSION:=$(cat "${script_dir}/runc-version")}"
2528

2629
TMPROOT=$(mktemp -d)
2730
git clone https://github.com/opencontainers/runc.git "${TMPROOT}"/runc
2831
pushd "${TMPROOT}"/runc
29-
git checkout "${RUNC_COMMIT}"
30-
make BUILDTAGS='apparmor seccomp selinux' runc
32+
git checkout "${RUNC_VERSION}"
33+
make
3134
make install
3235
popd
3336
rm -fR "${TMPROOT}"

‎script/setup/runc-version‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
v1.0.0-rc93

0 commit comments

Comments
 (0)