Separate runc binary version from libcontainer version, and remove obsolete build-tags #5036

thaJeztah · 2021-02-15T18:45:56Z

Remove references to apparmor and selinux buildtags for runc

From the runc v1.0.0-rc93 release notes:

The "selinux" and "apparmor" buildtags have been removed, and now all runc
builds will have SELinux and AppArmor support enabled. Note that "seccomp"
is still optional (though we very highly recommend you enable it).

Separate runc binary version from libcontainer version

Now that the dependency on runc (libcontaienr) code has been reduced
considerably, it is probbaly ok to cut the version dependency between
libcontainer and the runc binary that is supported.

This patch separates the runc binary version from the version of
libcontainer that is defined in go.mod, and updates the documentation
accordingly.

The RUNC_COMMIT variable in the install-runc script is renamed to
RUNC_VERSION to encourage using tagged versions, and the Dockerfile
in contrib is updated to allow building with a custom version.

move runc version to a separate file for easier consumption

This moves the runc version to build to scripts/setup/runc-version,
which makes it easier for packagers to find the default version
to use.

The RUNC_VERSION environment variable can still be used to override
the version, which can be used (e.g.) to test against different versions
in our CI.

theopenlab-ci · 2021-02-15T18:46:18Z

Build succeeded.

containerd-build-arm64 : NODE_FAILURE in 0s (non-voting)

thaJeztah · 2021-02-15T18:48:03Z

This was brought up as consideration by @AkihiroSuda in #4717 (comment)

estesp

LGTM

mikebrow · 2021-02-15T21:27:16Z

BUILDING.md

maybe add:

The "selinux" and "apparmor" buildtags have been removed, and now all runc builds will have SELinux and AppArmor support enabled. Note that "seccomp" is still optional (though we very highly recommend you enable it).

BUILDTAGS=seccomp is specified by default, so just make && make install should work

The default runc BUILDTAGS gets overwritten if passing any BUILDTAGS to make cri-cni-release, because it passes the same value through to the runc Makefile if it isn't explicitly set here.

I've been building with make BUILDTAGS=no_btrfs cri-cni-release and containerd started failing in my test k8s clusters after pulling this change into master.

(in script/setup/install-runc) HEAD is now at 12644e61 VERSION: release 1.0.0~rc93 make[1]: Entering directory '/tmp/tmp.ZJzc2KtI0A/runc' go build -trimpath "-mod=vendor" "-buildmode=pie" -tags "no_btrfs" -ldflags "-X main.gitCommit="12644e614e25b05da6fd08a38ffa0cfe1903fdec" -X main.version=1.0.0-rc93 " -o runc . ^^^^^^^^^^^^^^^^

Maybe this should be documented somewhere, or if the runc build tags aren't intended to be changed from the default then go back to setting it here again?

Hmm... good one; that's because both containerd and runc use the same variable name. Also wondering if runc looks at environment variables, or make variables 🤔

I guess we can add the BUILDTAGS back here, because we always build with the same options in our script

opened #5184

mikebrow · 2021-02-15T21:28:45Z

docs/RUNC.md

same as above..

mikebrow

see comment around leaving some historical reference so people will know why it's no longer there...

dims · 2021-02-16T00:04:37Z

script/setup/install-runc

what is a good way to publicize this? we want to highlight this well enough for folks who have now been used to picking up SHA from the go.mod

chase it down with hound and push commits ? :-)

chase it down with hound and push commits ? :-)

Hehehe!

Should we change the name of the variable to RUNC_VERSION to encourage using tagged releases (and default to using a tag)?

theopenlab-ci · 2021-03-08T18:13:09Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 5m 39s (non-voting)

From the runc v1.0.0-rc93 release notes: > The "selinux" and "apparmor" buildtags have been removed, and now all runc > builds will have SELinux and AppArmor support enabled. Note that "seccomp" > is still optional (though we very highly recommend you enable it). Also adding a note about kmem support. Signed-off-by: Sebastiaan van Stijn <[email protected]>

theopenlab-ci · 2021-03-10T12:33:57Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 6m 24s (non-voting)

dims · 2021-03-10T12:34:59Z

script/setup/install-runc

could we please pick up the RUNC_VERSION from a file? ( we could have a file name RUNC_VERSION with the contents of v1.0.0-rc93 ) So it will then be easy to curl the version from a branch or master (directly from github raw url) easily for automation (in downstream or other CI in other projects).

So; pick from file, but allow the RUNC_VERSION env-var to override, correct? Yes I guess we can do that. Let me have a look

works! thanks!

Now that the dependency on runc (libcontaienr) code has been reduced considerably, it is probbaly ok to cut the version dependency between libcontainer and the runc binary that is supported. This patch separates the runc binary version from the version of libcontainer that is defined in go.mod, and updates the documentation accordingly. The RUNC_COMMIT variable in the install-runc script is renamed to RUNC_VERSION to encourage using tagged versions, and the Dockerfile in contrib is updated to allow building with a custom version. Signed-off-by: Sebastiaan van Stijn <[email protected]>

theopenlab-ci · 2021-03-10T12:49:12Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 6m 18s (non-voting)

thaJeztah · 2021-03-10T13:02:47Z

@dims updated; pushed a commit that moves the version to a separate file

thaJeztah · 2021-03-10T13:04:13Z

README.md

keeping RUNC.md as the "canonical" place to describe what version to use instead of pointing to the runs-version file (I think it's useful for readers to get the additional context that the RUNC.md document provides

thaJeztah · 2021-03-10T13:05:54Z

Arf.. that didn't work; probably needs abs-path (relative to the script)

cat: ./runc-version: No such file or directory

theopenlab-ci · 2021-03-10T13:16:37Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 5m 47s (non-voting)

dims

LGTM

thanks @thaJeztah !

thaJeztah · 2021-03-10T13:25:56Z

Hmm.. looks like a commit message is not passing validation;

f39ea1f6 "Merge 7d18415109f7a6378d8fa296b1a2096980a07535 into 17ab5dd08cc06b6f15af66918c4740795087355e" ... FAIL
    - FAIL - has whitespace errors. See `git show --check f39ea1f6a8bec1cce3cae0e305c6e5fe2f84a246`.
    - PASS - merge commits do not require DCO
    - PASS - merge commits do not require length check
   * 7d184151 "move runc version to a separate file for easier consumption" ... FAIL
    - FAIL - has whitespace errors. See `git show --check 7d18415109f7a6378d8fa296b1a2096980a07535`.
    - PASS - has a valid DCO
    - PASS - commit subject is 72 characters or less! *yay*

let me check

ah! shell script formatting; looks I left a stray space;

script/setup/install-runc:24: space before tab in indent.
+       script_dir="$(cd -- "$(dirname -- "$0")" > /dev/null 2>&1; pwd -P)"

This moves the runc version to build to scripts/setup/runc-version, which makes it easier for packagers to find the default version to use. The RUNC_VERSION environment variable can still be used to override the version, which can be used (e.g.) to test against different versions in our CI. Signed-off-by: Sebastiaan van Stijn <[email protected]>

theopenlab-ci · 2021-03-10T13:36:18Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 5m 57s (non-voting)

thaJeztah · 2021-03-10T22:55:37Z

@mikebrow ptal; hope the latest changes LGTY

mikebrow

LGTM

- bump docker-proxy dep to 0.8.0_p20210525 - unfortunately tests require priveleges and fetching from network - ESYSROOT should be used to locate headers and libraries. - Remove CONFIG_RT_GROUP_SCHED - drop the dependency on runc since this is pulled in by containerd - set a lower limit for the dependency oncontainerd but do not pin it to a specific version. For more information, see the below upstream issue. moby/moby#42117 containerd/containerd#5036

Zyqsempai approved these changes Feb 15, 2021

View reviewed changes

estesp approved these changes Feb 15, 2021

View reviewed changes

mikebrow reviewed Feb 15, 2021

View reviewed changes

docs/RUNC.md Outdated

Copy link

Member

mikebrow Feb 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same as above..

mikebrow reviewed Feb 15, 2021

View reviewed changes

mikebrow mentioned this pull request Feb 15, 2021

Add a development doc for cri #5037

Closed

dims reviewed Feb 16, 2021

View reviewed changes

dims mentioned this pull request Feb 20, 2021

bump runc to v1.0.0-rc93 google/cadvisor#2809

Merged

This was referenced Mar 7, 2021

docker 20.10.4 and 20.10.5 have a dependency conflict moby/moby#42117

Closed

Fix detection of default runc version due upstream to switch to go.mod docker/containerd-packaging#224

Merged

thaJeztah force-pushed the split_runc_binary branch from bb48350 to b9320aa Compare March 8, 2021 18:06

thaJeztah force-pushed the split_runc_binary branch from b9320aa to 60c0300 Compare March 10, 2021 12:25

dims reviewed Mar 10, 2021

View reviewed changes

thaJeztah force-pushed the split_runc_binary branch from 60c0300 to 8325ba5 Compare March 10, 2021 12:41

thaJeztah commented Mar 10, 2021

View reviewed changes

thaJeztah force-pushed the split_runc_binary branch from 6412df6 to 7d18415 Compare March 10, 2021 13:09

dims approved these changes Mar 10, 2021

View reviewed changes

thaJeztah force-pushed the split_runc_binary branch from 7d18415 to 79a51cd Compare March 10, 2021 13:28

AkihiroSuda approved these changes Mar 10, 2021

View reviewed changes

mikebrow approved these changes Mar 11, 2021

View reviewed changes

mikebrow merged commit ce8e8e8 into containerd:master Mar 11, 2021

thaJeztah deleted the split_runc_binary branch March 11, 2021 15:52

This was referenced Mar 11, 2021

[release/1.4] update to runc binary to v1.0.0-rc93, and decouple version from vendor.conf #5166

Merged

Prevent runc inheriting BUILDTAGS from containerd #5184

Merged

thaJeztah mentioned this pull request Apr 22, 2021

Update docker 20.10.6 linuxkit/linuxkit#3554

Merged

thaJeztah mentioned this pull request Feb 8, 2023

Don't check for apparmor_parser to be present #5519

Merged

thaJeztah mentioned this pull request Aug 1, 2023

[release/1.7] Update hcsshim tag to v0.10.0 #8903

Closed

Separate runc binary version from libcontainer version, and remove obsolete build-tags #5036

Separate runc binary version from libcontainer version, and remove obsolete build-tags #5036

Conversation

thaJeztah commented Feb 15, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Remove references to apparmor and selinux buildtags for runc

Separate runc binary version from libcontainer version

move runc version to a separate file for easier consumption

Uh oh!

theopenlab-ci bot commented Feb 15, 2021

Uh oh!

thaJeztah commented Feb 15, 2021

Uh oh!

estesp left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mikebrow left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

theopenlab-ci bot commented Mar 8, 2021

Uh oh!

theopenlab-ci bot commented Mar 10, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

theopenlab-ci bot commented Mar 10, 2021

Uh oh!

thaJeztah commented Mar 10, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thaJeztah commented Mar 10, 2021

Uh oh!

theopenlab-ci bot commented Mar 10, 2021

Uh oh!

dims left a comment

Choose a reason for hiding this comment

Uh oh!

thaJeztah commented Mar 10, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

theopenlab-ci bot commented Mar 10, 2021

Uh oh!

thaJeztah commented Mar 10, 2021

Uh oh!

mikebrow left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

thaJeztah commented Feb 15, 2021 •

edited

Loading

thaJeztah commented Mar 10, 2021 •

edited

Loading