Skip to content

Commit ab88fe6

Browse files
klihubklihub
committed
adaptation: allow compiling out WASM support altogether.
Allow WASM support to be disabled at compile time using the "nri_no_wasm" build tag. Signed-off-by: Krisztian Litkey <[email protected]>
1 parent 4908793 commit ab88fe6

5 files changed

Lines changed: 93 additions & 18 deletions

File tree

‎README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -454,6 +454,9 @@ the WebAssembly plugin is required, then the NRI provides a host function helper
454454
[`Log`](https://github.com/containerd/nri/blob/8ebdb076ea6aa524094a7f1c2c9ca31c30852328/plugins/wasm/plugin.go#L31-L36)
455455
for that.
456456

457+
WebAssembly support is enabled by default. It can be disabled at compile
458+
time using the `nri_no_wasm` build tag.
459+
457460
## Security Considerations
458461

459462
From a security perspective NRI plugins should be considered part of the

‎pkg/adaptation/adaptation.go‎

Lines changed: 8 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,6 @@ import (
3232
"github.com/containerd/nri/pkg/log"
3333
validator "github.com/containerd/nri/plugins/default-validator/builtin"
3434
"github.com/containerd/ttrpc"
35-
"github.com/tetratelabs/wazero"
36-
"github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1"
3735

3836
"google.golang.org/protobuf/proto"
3937
)
@@ -80,6 +78,9 @@ type Adaptation struct {
8078
var (
8179
// Used instead of nil Context in logging.
8280
noCtx = context.TODO()
81+
82+
// ErrWasmDisabled is returned for WASM initialization if WASM support is disabled.
83+
ErrWasmDisabled = errors.New("WASM support is disabled (at build time)")
8384
)
8485

8586
// Option to apply to the NRI runtime.
@@ -155,23 +156,12 @@ func New(name, version string, syncFn SyncFn, updateFn UpdateFn, opts ...Option)
155156
return nil, fmt.Errorf("failed to create NRI adaptation, nil UpdateFn")
156157
}
157158

158-
wasmWithCloseOnContextDone := func(ctx context.Context) (wazero.Runtime, error) {
159-
var (
160-
cfg = wazero.NewRuntimeConfig().WithCloseOnContextDone(true)
161-
r = wazero.NewRuntimeWithConfig(ctx, cfg)
162-
)
163-
if _, err := wasi_snapshot_preview1.Instantiate(ctx, r); err != nil {
159+
wasmService, err := getWasmService()
160+
if err != nil {
161+
log.Errorf(noCtx, "failed to initialize WASM support: %v", err)
162+
if !errors.Is(err, ErrWasmDisabled) {
164163
return nil, err
165164
}
166-
return r, nil
167-
}
168-
169-
wasmPlugins, err := api.NewPluginPlugin(
170-
context.Background(),
171-
api.WazeroRuntime(wasmWithCloseOnContextDone),
172-
)
173-
if err != nil {
174-
return nil, fmt.Errorf("unable to initialize WASM service: %w", err)
175165
}
176166

177167
r := &Adaptation{
@@ -183,7 +173,7 @@ func New(name, version string, syncFn SyncFn, updateFn UpdateFn, opts ...Option)
183173
dropinPath: DefaultPluginConfigPath,
184174
socketPath: DefaultSocketPath,
185175
syncLock: sync.RWMutex{},
186-
wasmService: wasmPlugins,
176+
wasmService: wasmService,
187177
}
188178

189179
for _, o := range opts {

‎pkg/adaptation/plugin.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,10 @@ func (r *Adaptation) newLaunchedPlugin(dir, idx, base, cfg string) (p *plugin, r
104104
fullPath := filepath.Join(dir, name)
105105

106106
if isWasm(fullPath) {
107+
if r.wasmService == nil {
108+
return nil, fmt.Errorf("can't load WASM plugin %s: no WASM support", fullPath)
109+
}
110+
107111
log.Infof(noCtx, "Found WASM plugin: %s", fullPath)
108112
wasm, err := r.wasmService.Load(context.Background(), fullPath, wasmHostFunctions{})
109113
if err != nil {

‎pkg/adaptation/wasm-disabled.go‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
//go:build nri_no_wasm
2+
3+
/*
4+
Copyright The containerd Authors.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
*/
18+
19+
package adaptation
20+
21+
import (
22+
"github.com/containerd/nri/pkg/api"
23+
)
24+
25+
func getWasmService() (*api.PluginPlugin, error) {
26+
return nil, ErrWasmDisabled
27+
}

‎pkg/adaptation/wasm-enabled.go‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
//go:build !nri_no_wasm
2+
3+
/*
4+
Copyright The containerd Authors.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
*/
18+
19+
package adaptation
20+
21+
import (
22+
"context"
23+
"fmt"
24+
25+
"github.com/containerd/nri/pkg/api"
26+
"github.com/tetratelabs/wazero"
27+
"github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1"
28+
)
29+
30+
func getWasmService() (*api.PluginPlugin, error) {
31+
wasmWithCloseOnContextDone := func(ctx context.Context) (wazero.Runtime, error) {
32+
var (
33+
cfg = wazero.NewRuntimeConfig().WithCloseOnContextDone(true)
34+
r = wazero.NewRuntimeWithConfig(ctx, cfg)
35+
)
36+
if _, err := wasi_snapshot_preview1.Instantiate(ctx, r); err != nil {
37+
return nil, err
38+
}
39+
return r, nil
40+
}
41+
42+
wasmPlugins, err := api.NewPluginPlugin(
43+
context.Background(),
44+
api.WazeroRuntime(wasmWithCloseOnContextDone),
45+
)
46+
if err != nil {
47+
return nil, fmt.Errorf("unable to initialize WASM service: %w", err)
48+
}
49+
50+
return wasmPlugins, nil
51+
}

0 commit comments

Comments
 (0)