Skip to content

Commit 5f422ee

Browse files
wkingwking
committed
proto: Flesh out runtime.json (and pass it through example_cpp)
So it matches (modulo key order) our examples from the runtime-config.md series. To get as much matching up as possible, I've converted externally-visible runtime_config.proto entries from under_scores to camelCase. We're still not matching some cases well, and I've interspersed my notes on why in the diff: $ diff -u <(cat config.json runtime.json) <(./example_cpp | jq .) --- /dev/fd/63 2015-09-27 00:04:18.464247761 -0700 +++ /dev/fd/62 2015-09-27 00:04:18.463247761 -0700 @@ -34,43 +34,9 @@ } } { - "mounts": { - "proc": { - "type": "proc", - "source": "proc", - "options": [] - }, - ... - }, + "mounts": [ + {} + ], Protobuf doesn't like objects with arbitrary keys (or at least we haven't found a way to set that up). So we probably need a pre-processer to convert mount entries into: "mounts": [ { "key": "proc", "value": { "type": "proc", "source": "proc", "options": [] }, } ] You can do that with jq [1], and that makes the mount difference much smaller (sysctl need the same change): $ mv runtime.json runtime.json-orig $ jq '.mounts |= to_entries | .linuxx.sysctl |= to_entries' <runtime.json-orig >runtime.json $ diff -u <(cat config.json runtime.json) <(./example_cpp | jq .) --- /dev/fd/63 2015-09-27 00:15:56.656282533 -0700 +++ /dev/fd/62 2015-09-27 00:15:56.656282533 -0700 @@ -78,8 +78,7 @@ "key": "proc", "value": { "type": "proc", - "source": "proc", - "options": [] + "source": "proc" } } ], ... The difference here is that protobuf isn't serializing default values, so it drops the empty array [2] (which I'd suggested we do anyway [3] ;) ... "rlimits": [ { "type": "RLIMIT_NPROC", - "soft": 1024, - "hard": 102400 + "hard": "102400", + "soft": "1024" } ], ... Protobuf uses strings when writing 64-bit-wide numbers [2], but it reads both numbers and strings, so this isn't a big deal. @@ -198,63 +171,44 @@ "devices": [ { "path": "/dev/random", - "type": "c", - "major": 1, - "minor": 8, - "permissions": "rwm", - "fileMode": 666, - "uid": 0, - "gid": 0 + "major": "1", + "minor": "8", + "permissions": "rwm", + "fileMode": 666 }, ... This has some of the default-dropping and number-string issues mentioned earlier, as well as the effect of runtime_config.proto's: // TODO(vbatts) ensure int32 is fine here, instead of golang's rune optional int32 type = 2; [1]: https://stedolan.github.io/jq/ [2]: https://developers.google.com/protocol-buffers/docs/proto3#json [3]: opencontainers#123 Signed-off-by: W. Trevor King <[email protected]>
1 parent a7129a6 commit 5f422ee

File tree

3 files changed

+253
-21
lines changed

3 files changed

+253
-21
lines changed

‎proto/example.cc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
#include <google/protobuf/util/type_resolver_util.h>
1111

1212
#include "config.pb.h"
13+
#include "runtime_config.pb.h"
1314

1415
using namespace std;
1516

@@ -65,6 +66,7 @@ int main(int argc, char* argv[]) {
6566
GOOGLE_PROTOBUF_VERIFY_VERSION;
6667

6768
oci::Spec config;
69+
oci::RuntimeSpec runtime;
6870

6971
if (!ReadMessage("config.json", &config)) {
7072
cerr << "config.json: Failed to load." << endl;
@@ -85,6 +87,16 @@ int main(int argc, char* argv[]) {
8587
return -1;
8688
}
8789

90+
if (!ReadMessage("runtime.json", &runtime)) {
91+
cerr << "runtime.json: Failed to load." << endl;
92+
return -1;
93+
}
94+
95+
if (!WriteMessage(runtime)) {
96+
cerr << "runtime.json: Failed to write to stdout." << endl;
97+
return -1;
98+
}
99+
88100
// Optional: Delete all global objects allocated by libprotobuf.
89101
google::protobuf::ShutdownProtobufLibrary();
90102

‎proto/runtime.json‎

Lines changed: 220 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,220 @@
1+
{
2+
"mounts": {
3+
"proc": {
4+
"type": "proc",
5+
"source": "proc",
6+
"options": []
7+
},
8+
"dev": {
9+
"type": "tmpfs",
10+
"source": "tmpfs",
11+
"options": [
12+
"nosuid",
13+
"strictatime",
14+
"mode=755",
15+
"size=65536k"
16+
]
17+
},
18+
"devpts": {
19+
"type": "devpts",
20+
"source": "devpts",
21+
"options": [
22+
"nosuid",
23+
"noexec",
24+
"newinstance",
25+
"ptmxmode=0666",
26+
"mode=0620",
27+
"gid=5"
28+
]
29+
},
30+
"data": {
31+
"type": "bind",
32+
"source": "/volumes/testing",
33+
"options": [
34+
"rbind",
35+
"rw"
36+
]
37+
}
38+
},
39+
"hooks": {
40+
"prestart": [
41+
{
42+
"path": "/usr/bin/fix-mounts",
43+
"args": [
44+
"arg1",
45+
"arg2"
46+
],
47+
"env": [
48+
"key1=value1"
49+
]
50+
},
51+
{
52+
"path": "/usr/bin/setup-network"
53+
}
54+
],
55+
"poststop": [
56+
{
57+
"path": "/usr/sbin/cleanup.sh",
58+
"args": [
59+
"-f"
60+
]
61+
}
62+
]
63+
},
64+
"linuxx": {
65+
"uidMappings": [
66+
{
67+
"hostID": 1000,
68+
"containerID": 0,
69+
"size": 10
70+
}
71+
],
72+
"gidMappings": [
73+
{
74+
"hostID": 1000,
75+
"containerID": 0,
76+
"size": 10
77+
}
78+
],
79+
"rlimits": [
80+
{
81+
"type": "RLIMIT_NPROC",
82+
"soft": 1024,
83+
"hard": 102400
84+
}
85+
],
86+
"sysctl": {
87+
"net.ipv4.ip_forward": "1",
88+
"net.core.somaxconn": "256"
89+
},
90+
"resources": {
91+
"disableOOMKiller": false,
92+
"memory": {
93+
"limit": 0,
94+
"reservation": 0,
95+
"swap": 0,
96+
"kernel": 0,
97+
"swappiness": -1
98+
},
99+
"cpu": {
100+
"shares": 0,
101+
"quota": 0,
102+
"period": 0,
103+
"realtimeRuntime": 0,
104+
"realtimePeriod": 0,
105+
"cpus": "",
106+
"mems": ""
107+
},
108+
"blockIO": {
109+
"blkioWeight": 0,
110+
"blkioWeightDevice": "",
111+
"blkioThrottleReadBpsDevice": "",
112+
"blkioThrottleWriteBpsDevice": "",
113+
"blkioThrottleReadIopsDevice": "",
114+
"blkioThrottleWriteIopsDevice": ""
115+
},
116+
"hugepageLimits": null,
117+
"network": {
118+
"classId": "",
119+
"priorities": null
120+
}
121+
},
122+
"cgroupsPath": "/myRuntime/myContainer",
123+
"namespaces": [
124+
{
125+
"type": "pid",
126+
"path": "/proc/1234/ns/pid"
127+
},
128+
{
129+
"type": "network",
130+
"path": "/var/run/netns/neta"
131+
},
132+
{
133+
"type": "mount"
134+
},
135+
{
136+
"type": "ipc"
137+
},
138+
{
139+
"type": "uts"
140+
},
141+
{
142+
"type": "user"
143+
}
144+
],
145+
"devices": [
146+
{
147+
"path": "/dev/random",
148+
"type": "c",
149+
"major": 1,
150+
"minor": 8,
151+
"permissions": "rwm",
152+
"fileMode": 666,
153+
"uid": 0,
154+
"gid": 0
155+
},
156+
{
157+
"path": "/dev/urandom",
158+
"type": "c",
159+
"major": 1,
160+
"minor": 9,
161+
"permissions": "rwm",
162+
"fileMode": 666,
163+
"uid": 0,
164+
"gid": 0
165+
},
166+
{
167+
"path": "/dev/null",
168+
"type": "c",
169+
"major": 1,
170+
"minor": 3,
171+
"permissions": "rwm",
172+
"fileMode": 666,
173+
"uid": 0,
174+
"gid": 0
175+
},
176+
{
177+
"path": "/dev/zero",
178+
"type": "c",
179+
"major": 1,
180+
"minor": 5,
181+
"permissions": "rwm",
182+
"fileMode": 666,
183+
"uid": 0,
184+
"gid": 0
185+
},
186+
{
187+
"path": "/dev/tty",
188+
"type": "c",
189+
"major": 5,
190+
"minor": 0,
191+
"permissions": "rwm",
192+
"fileMode": 666,
193+
"uid": 0,
194+
"gid": 0
195+
},
196+
{
197+
"path": "/dev/full",
198+
"type": "c",
199+
"major": 1,
200+
"minor": 7,
201+
"permissions": "rwm",
202+
"fileMode": 666,
203+
"uid": 0,
204+
"gid": 0
205+
}
206+
],
207+
"apparmorProfile": "acme_secure_profile",
208+
"selinuxProcessLabel": "system_u:system_r:svirt_lxc_net_t:s0:c124,c675",
209+
"seccomp": {
210+
"defaultAction": "SCMP_ACT_ALLOW",
211+
"syscalls": [
212+
{
213+
"name": "getcwd",
214+
"action": "SCMP_ACT_ERRNO"
215+
}
216+
]
217+
},
218+
"rootfsPropagation": "slave"
219+
}
220+
}

‎proto/runtime_config.proto‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,9 @@ BEGIN Linux specific runtime
5454
// LinuxRuntime hosts the Linux-only runtime information
5555
message LinuxRuntime {
5656
// UidMapping specifies user mappings for supporting user namespaces on linux.
57-
repeated IDMapping uid_mapping = 1;
57+
repeated IDMapping uidMappings = 1;
5858
// GidMapping specifies group mappings for supporting user namespaces on linux.
59-
repeated IDMapping gid_mapping = 2;
59+
repeated IDMapping gidMappings = 2;
6060
// Rlimits specifies rlimit options to apply to the container's process.
6161
repeated Rlimit rlimits = 3;
6262
// Sysctl are a set of key value pairs that are set for the container on start
@@ -67,27 +67,27 @@ message LinuxRuntime {
6767
// CgroupsPath specifies the path to cgroups that are created and/or joined by the container.
6868
// The path is expected to be relative to the cgroups mountpoint.
6969
// If resources are specified, the cgroups at CgroupsPath will be updated based on resources.
70-
string cgroups_path = 6;
70+
string cgroupsPath = 6;
7171
// Namespaces contains the namespaces that are created and/or joined by the container
7272
repeated Namespace namespaces = 7;
7373
// Devices are a list of device nodes that are created and enabled for the container
7474
repeated Device devices = 8;
7575
// ApparmorProfile specified the apparmor profile for the container.
76-
string apparmor_profile = 9;
76+
string apparmorProfile = 9;
7777
// SelinuxProcessLabel specifies the selinux context that the container process is run as.
78-
string selinux_process_label = 10;
78+
string selinuxProcessLabel = 10;
7979
// Seccomp specifies the seccomp security settings for the container.
8080
Seccomp seccomp = 11;
8181
// RootfsPropagation is the rootfs mount propagation mode for the container
82-
string rootfs_propagation = 12;
82+
string rootfsPropagation = 12;
8383
}
8484

8585
// IDMapping specifies UID/GID mappings
8686
message IDMapping {
8787
// HostID is the UID/GID of the host user or group
88-
int32 host_id = 1;
88+
int32 hostID = 1;
8989
// ContainerID is the UID/GID of the container's user or group
90-
int32 container_id = 2;
90+
int32 containerID = 2;
9191
// Size is the length of the range of IDs mapped between the two namespaces
9292
int32 size = 3;
9393
}
@@ -111,17 +111,17 @@ message StringStringEntry {
111111
// Resources has container runtime resource constraints
112112
message Resources {
113113
// DisableOOMKiller disables the OOM killer for out of memory conditions
114-
bool disable_oom_killer = 1;
114+
bool disableOomKiller = 1;
115115
// Memory restriction configuration
116116
Memory memory = 2;
117117
// CPU resource restriction configuration
118118
CPU cpu = 3;
119119
// Task resource restriction configuration.
120120
Pids pids = 4;
121121
// BlockIO restriction configuration
122-
BlockIO block_io = 5;
122+
BlockIO blockIO = 5;
123123
// Hugetlb limit (in bytes)
124-
repeated HugepageLimit hugepage_limits = 6;
124+
repeated HugepageLimit hugepageLimits = 6;
125125
// Network restriction configuration
126126
Network network = 7;
127127
}
@@ -149,9 +149,9 @@ message CPU {
149149
// CPU period to be used for hardcapping (in usecs). 0 to use system default
150150
int64 period = 3;
151151
// How many time CPU will use in realtime scheduling (in usecs)
152-
int64 realtime_runtime = 4;
152+
int64 realtimeRuntime = 4;
153153
// CPU period to be used for realtime scheduling (in usecs)
154-
int64 realtime_period = 5;
154+
int64 realtimePeriod = 5;
155155
// CPU to use within the cpuset
156156
string cpus = 6;
157157
// MEM to use within the cpuset
@@ -169,15 +169,15 @@ message BlockIO {
169169
// Specifies per cgroup weight, range is from 10 to 1000
170170
int64 weight = 1;
171171
// Weight per cgroup per device, can override BlkioWeight
172-
string weight_device = 2;
172+
string weightDevice = 2;
173173
// IO read rate limit per cgroup per device, bytes per second
174-
string throttle_read_bps_device = 3;
174+
string throttleReadBpsDevice = 3;
175175
// IO write rate limit per cgroup per divice, bytes per second
176-
string throttle_write_bps_device = 4;
176+
string throttleWriteBpsDevice = 4;
177177
// IO read rate limit per cgroup per device, IO per second
178-
string throttle_read_iops_device = 5;
178+
string throttleReadIopsDevice = 5;
179179
// IO write rate limit per cgroup per device, IO per second
180-
string throttle_write_iops_device = 6;
180+
string throttleWriteIopsDevice = 6;
181181
}
182182

183183
// HugepageLimit structure corresponds to limiting kernel hugepages
@@ -189,7 +189,7 @@ message HugepageLimit {
189189
// Network identification and priority configuration
190190
message Network {
191191
// Set class identifier for container's network packets
192-
string class_id = 1;
192+
string classId = 1;
193193
// Set priority of network traffic for container
194194
repeated InterfacePriority priorities = 2;
195195
}
@@ -226,7 +226,7 @@ message Device {
226226
string permissions = 5;
227227
// FileMode permission bits for the device.
228228
// TODO(vbatts) os.FileMode is an octal uint32
229-
uint32 file_mode = 6;
229+
uint32 fileMode = 6;
230230
// Uid of the device.
231231
uint32 uid = 7;
232232
// Gid of the device.
@@ -236,7 +236,7 @@ message Device {
236236
// Seccomp represents syscall restrictions
237237
message Seccomp {
238238
// TODO(vbatts) string instead of "Action" type
239-
string default_action = 1;
239+
string defaultAction = 1;
240240
repeated Syscall syscalls = 2;
241241
}
242242

0 commit comments

Comments
 (0)