netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into ip-forwarding

Browse Source 
- Merges aleksej-paschenko's with HEAD
- Adds vfs2 support for ip_forward
This commit is contained in:
Ian Lewis
2020-08-17 21:44:31 -04:00
parent 352ae1022c 6d0c5803d5
commit ac324f646e
2261 changed files with 202373 additions and 39738 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.bazelrc
+36 -19
View File
@@ -12,36 +12,53 @@
# See the License for the specific language governing permissions and
# limitations under the License.
# RBE requires a strong hash function, such as SHA256.
startup --host_jvm_args=-Dbazel.DigestFunction=SHA256
# Build with C++17.
build --cxxopt=-std=c++17
# Display the current git revision in the info block.
build --stamp --workspace_status_command tools/workspace_status.sh
# Enable remote execution so actions are performed on the remote systems.
build:remote --remote_executor=grpcs://remotebuildexecution.googleapis.com
# Add a custom platform and toolchain that builds in a privileged docker
# container, which is required by our syscall tests.
build:remote --host_platform=//test:rbe_ubuntu1604
build:remote --extra_toolchains=//test:cc-toolchain-clang-x86_64-default
build:remote --extra_execution_platforms=//test:rbe_ubuntu1604
build:remote --platforms=//test:rbe_ubuntu1604
# Use default image for crosstool toolchain.
build:remote --crosstool_top=@rbe_default//cc:toolchain
# Default parallelism and timeout for remote jobs.
build:remote --jobs=50
build:remote --remote_timeout=3600
# RBE requires a strong hash function, such as SHA256.
startup --host_jvm_args=-Dbazel.DigestFunction=SHA256
build:remote --bes_backend=buildeventservice.googleapis.com
build:remote --bes_results_url="https://source.cloud.google.com/results/invocations"
build:remote --bes_timeout=600s
build:remote --project_id=gvisor-rbe
build:remote --remote_instance_name=projects/gvisor-rbe/instances/default_instance
build:remote3 --remote_executor=grpcs://remotebuildexecution.googleapis.com
build:remote3 --project_id=gvisor-rbe
build:remote3 --bes_backend=buildeventservice.googleapis.com
build:remote3 --bes_results_url="https://source.cloud.google.com/results/invocations"
build:remote3 --bes_timeout=600s
build:remote3 --remote_instance_name=projects/gvisor-rbe/instances/default_instance
# Enable authentication. This will pick up application default credentials by
# default. You can use --google_credentials=some_file.json to use a service
# account credential instead.
build:remote --google_default_credentials=true
# Auth scope needed for authentication with RBE.
build:remote --auth_scope="https://www.googleapis.com/auth/cloud-source-tools"
build:remote3 --google_default_credentials=true
build:remote3 --auth_scope="https://www.googleapis.com/auth/cloud-source-tools"
# Add a custom platform and toolchain that builds in a privileged docker
# container, which is required by our syscall tests.
build:remote --host_platform=//tools/bazeldefs:rbe_ubuntu1604
build:remote --extra_toolchains=//tools/bazeldefs:cc-toolchain-clang-x86_64-default
build:remote --extra_execution_platforms=//tools/bazeldefs:rbe_ubuntu1604
build:remote --platforms=//tools/bazeldefs:rbe_ubuntu1604
build:remote --crosstool_top=@rbe_default//cc:toolchain
build:remote --jobs=100
build:remote --remote_timeout=3600
build:remote3 --host_platform=//tools/bazeldefs:rbe_ubuntu1604_bazel3
build:remote3 --extra_toolchains=//tools/bazeldefs:cc-toolchain-clang-x86_64-default_bazel3
build:remote3 --extra_execution_platforms=//tools/bazeldefs:rbe_ubuntu1604_bazel3
build:remote3 --platforms=//tools/bazeldefs:rbe_ubuntu1604_bazel3
build:remote3 --crosstool_top=@rbe_default//cc:toolchain
build:remote3 --jobs=100
build:remote3 --remote_timeout=3600
# Set flags for uploading to BES in order to view results in the Bazel Build
# Results UI.
.github/ISSUE_TEMPLATE/bug_report.md
+31
View File
@@ -0,0 +1,31 @@
---
name: Bug report
about: Create a bug report to help us improve
title:
labels:
- 'type: bug'
assignees: ''
---
**Description**
A clear description of what the bug is. If possible, explicitly indicate the
expected behavior vs. the observed behavior.
**Steps to reproduce**
If available, please include detailed reproduction steps.
If the bug requires software that is not publicly available, see if it can be
reproduced with software that is publicly available.
**Environment**
Please include the following details of your environment:
* `runsc -v`
* `docker version` or `docker info` (if available)
* `kubectl version` and `kubectl get nodes` (if using Kubernetes)
* `uname -a`
* `git describe` (if built from source)
* `runsc` debug logs (if available)
.github/ISSUE_TEMPLATE/config.yml
+11
View File
@@ -0,0 +1,11 @@
blank_issues_enabled: false
contact_links:
- name: gVisor Documentation (FAQ)
url: https://gvisor.dev/docs/user_guide/faq/
about: Please see our documentation for common questions and answers.
- name: gVisor Documentation (Debugging)
url: https://gvisor.dev/docs/user_guide/debugging/
about: Please see our documentation for debugging tips.
- name: gVisor User Forum
url: https://groups.google.com/g/gvisor-users
about: Ask and answer general questions here.
.github/ISSUE_TEMPLATE/feature_request.md
+21
View File
@@ -0,0 +1,21 @@
---
name: Feature request
about: Suggest an idea or improvement
title: ''
labels:
- 'type: enhancement'
assignees: ''
---
**Description**
A clear description of the feature or enhancement.
**Is this feature related to a specific bug?**
Please include a bug references if yes.
**Do you have a specific solution in mind?**
Please include any details about a solution that you have in mind, including any
alternatives considered.
.github/issue_template.md
-20
View File
@@ -1,20 +0,0 @@
Before filling an issue, please consult our FAQ:
https://gvisor.dev/docs/user_guide/faq/
Also check that the issue hasn't been reported before.
If you have a question, please email gvisor-users@googlegroups.com rather than filing a bug.
If you believe you've found a security issue, please email gvisor-security@googlegroups.com rather than filing a bug.
If this is your first time compiling or running gVisor, please make sure that your system meets the minimum requirements: https://github.com/google/gvisor#requirements
For all other issues, please attach debug logs. To get debug logs, follow the
instructions here: https://gvisor.dev/docs/user_guide/debugging/
Other useful information to include is:
* `runsc -v`
* `docker version` or `docker info` if more relevant
* `uname -a` - `git describe`
* Detailed reproduction steps
.github/labeler.yml
+42
View File
@@ -0,0 +1,42 @@
"arch: arm":
- "**/*_arm64.*"
- "**/*_aarch64.*"
"arch: x86_64":
- "**/*_amd64.*"
- "**/*_x86.*"
"area: bazel":
- "**/BUILD"
- "**/*.bzl"
"area: docs":
- "**/g3doc/**"
- "**/README.md"
"area: filesystem":
- "pkg/sentry/fs/**"
- "pkg/sentry/vfs/**"
- "pkg/sentry/fsimpl/**"
"area: hostinet":
- "pkg/sentry/socket/hostinet/**"
"area: networking":
- "pkg/tcpip/**"
- "pkg/sentry/socket/**"
"area: kernel":
- "pkg/sentry/arch/**"
- "pkg/sentry/kernel/**"
- "pkg/sentry/syscalls/**"
"area: mm":
- "pkg/sentry/mm/**"
"area: tests":
- "**/tests/**"
- "**/*_test.go"
- "**/test/**"
"area: tooling":
- "tools/**"
"dependencies":
- "WORKSPACE"
- "go.mod"
- "go.sum"
"platform: kvm":
- "pkg/sentry/platform/kvm/**"
- "pkg/sentry/platform/ring0/**"
"platform: ptrace":
- "pkg/sentry/platform/ptrace/**"
.github/pull_request_template.md
+5
View File
@@ -0,0 +1,5 @@
* [ ] Have you followed the guidelines in [CONTRIBUTING.md](../blob/master/CONTRIBUTING.md)?
* [ ] Have you formatted and linted your code?
* [ ] Have you added relevant tests?
* [ ] Have you added appropriate Fixes & Updates references?
* [ ] If yes, please erase all these lines!
.github/workflows/build.yml
+21
View File
@@ -0,0 +1,21 @@
name: "Build"
on:
push:
branches:
- master
pull_request:
branches:
- master
jobs:
default:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/cache@v1
with:
path: ~/.cache/bazel
key: ${{ runner.os }}-bazel-${{ hashFiles('WORKSPACE') }}
restore-keys: |
${{ runner.os }}-bazel-
- run: make
.github/workflows/go.yml
+75
View File
@@ -0,0 +1,75 @@
name: "Go"
on:
push:
branches:
- master
pull_request:
branches:
- master
jobs:
generate:
runs-on: ubuntu-latest
steps:
- id: setup
run: |
if ! [[ -z "${{ secrets.GO_TOKEN }}" ]]; then
echo ::set-output name=has_token::true
else
echo ::set-output name=has_token::false
fi
- run: |
jq -nc '{"state": "pending", "context": "go tests"}' | \
curl -sL -X POST -d @- \
-H "Content-Type: application/json" \
-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
"${{ github.event.pull_request.statuses_url }}"
if: github.event_name == 'pull_request'
- uses: actions/checkout@v2
if: github.event_name == 'push' && steps.setup.outputs.has_token == 'true'
with:
fetch-depth: 0
token: '${{ secrets.GO_TOKEN }}'
- uses: actions/checkout@v2
if: github.event_name == 'pull_request' || steps.setup.outputs.has_token != 'true'
with:
fetch-depth: 0
- uses: actions/setup-go@v2
with:
go-version: 1.14
- uses: actions/cache@v1
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
restore-keys: |
${{ runner.os }}-go-
- uses: actions/cache@v1
with:
path: ~/.cache/bazel
key: ${{ runner.os }}-bazel-${{ hashFiles('WORKSPACE') }}
restore-keys: |
${{ runner.os }}-bazel-
- run: |
rm -rf bazel-bin/gopath
make build TARGETS="//:gopath"
- run: tools/go_branch.sh
- run: git checkout go && git clean -f
- run: go build ./...
- if: github.event_name == 'push'
run: |
git remote add upstream "https://github.com/${{ github.repository }}"
git push upstream go:go
- if: ${{ success() && github.event_name == 'pull_request' }}
run: |
jq -nc '{"state": "success", "context": "go tests"}' | \
curl -sL -X POST -d @- \
-H "Content-Type: application/json" \
-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
"${{ github.event.pull_request.statuses_url }}"
- if: ${{ failure() && github.event_name == 'pull_request' }}
run: |
jq -nc '{"state": "failure", "context": "go tests"}' | \
curl -sL -X POST -d @- \
-H "Content-Type: application/json" \
-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
"${{ github.event.pull_request.statuses_url }}"
.github/workflows/issue_reviver.yml
+16
View File
@@ -0,0 +1,16 @@
name: "Issue reviver"
on:
schedule:
- cron: '0 0 * * *'
jobs:
issue_reviver:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
if: github.repository == 'google/gvisor'
- run: make run TARGETS="//tools/issue_reviver"
if: github.repository == 'google/gvisor'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_REPOSITORY: ${{ github.repository }}
.github/workflows/labeler.yml
+12
View File
@@ -0,0 +1,12 @@
name: "Labeler"
on:
- pull_request
jobs:
label:
runs-on: ubuntu-latest
steps:
- uses: actions/labeler@v2
if: github.base_ref == null
with:
repo-token: "${{ secrets.GITHUB_TOKEN }}"
.github/workflows/stale.yml
+20
View File
@@ -0,0 +1,20 @@
name: "Close stale issues"
on:
schedule:
- cron: "0 0 * * *"
jobs:
stale:
runs-on: ubuntu-latest
steps:
- uses: actions/stale@v3
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
stale-issue-label: 'stale'
stale-pr-label: 'stale'
exempt-issue-labels: 'exported, type: bug, type: cleanup, type: enhancement, type: process, type: proposal, type: question'
exempt-pr-labels: 'ready to pull'
stale-issue-message: 'This issue is stale because it has been open 90 days with no activity. Remove the stale label or comment or this will be closed in 30 days.'
stale-pr-message: 'This pull request is stale because it has been open 90 days with no activity. Remove the stale label or comment or this will be closed in 30 days.'
days-before-stale: 90
days-before-close: 30
.travis.yml
+47
View File
@@ -0,0 +1,47 @@
language: shell
dist: xenial
git:
clone: false # Clone manually in before_install
before_install:
- set -e -o pipefail
- |
if [ "${TRAVIS_PULL_REQUEST}" = false ]; then
# This is not a PR build, fetch and checkout the commit being tested
git clone -q --depth 1 "https://github.com/${TRAVIS_REPO_SLUG}.git" "${TRAVIS_REPO_SLUG}"
cd "${TRAVIS_REPO_SLUG}"
git fetch origin "${TRAVIS_COMMIT}" --depth 1
git checkout -qf "${TRAVIS_COMMIT}"
else
# This is a PR build, simulate +refs/pull/{num}/merge.
# We can do that by fetching +refs/pull/{num}/head and cherry picking it
# onto the target branch.
git clone -q --branch "${TRAVIS_BRANCH}" --depth 1 "https://github.com/${TRAVIS_REPO_SLUG}.git" "${TRAVIS_REPO_SLUG}"
cd "${TRAVIS_REPO_SLUG}"
git fetch origin "+refs/pull/${TRAVIS_PULL_REQUEST}/head" --depth 1
git config --global user.email "$(git log -1 FETCH_HEAD --pretty="%cE")"
git config --global user.name "$(git log -1 FETCH_HEAD --pretty="%aN")"
git cherry-pick --strategy=recursive -X theirs --keep-redundant-commits FETCH_HEAD
fi
cache:
directories:
- /home/travis/.cache/bazel/
os: linux
services:
- docker
jobs:
include:
# AMD64 builds are tested on kokoro, so don't run them in travis to save
# capacity for arm64 builds.
# - os: linux
# arch: amd64
- os: linux
arch: arm64
script:
# On arm64, we need to create our own pipes for stderr and stdout,
# otherwise we will not be able to open /dev/stderr. This is probably
# due to AppArmor rules.
- bash -xeo pipefail -c 'uname -a && make smoke-tests 2>&1 | cat'
branches:
except:
# Skip copybara branches.
- /^test\/cl.*$/
BUILD
+74 -17
View File
@@ -1,13 +1,68 @@
package(licenses = ["notice"]) # Apache 2.0
load("//tools:defs.bzl", "build_test", "gazelle", "go_path")
load("//website:defs.bzl", "doc")
load("@io_bazel_rules_go//go:def.bzl", "go_path", "nogo")
load("@bazel_gazelle//:def.bzl", "gazelle")
package(licenses = ["notice"])
exports_files(["LICENSE"])
doc(
name = "contributing",
src = "CONTRIBUTING.md",
category = "Project",
permalink = "/contributing/",
visibility = ["//website:__pkg__"],
weight = "20",
)
doc(
name = "security",
src = "SECURITY.md",
category = "Project",
permalink = "/security/",
visibility = ["//website:__pkg__"],
weight = "30",
)
doc(
name = "governance",
src = "GOVERNANCE.md",
category = "Project",
permalink = "/community/governance/",
subcategory = "Community",
visibility = ["//website:__pkg__"],
weight = "20",
)
doc(
name = "code_of_conduct",
src = "CODE_OF_CONDUCT.md",
category = "Project",
permalink = "/community/code_of_conduct/",
subcategory = "Community",
visibility = ["//website:__pkg__"],
weight = "99",
)
# The sandbox filegroup is used for sandbox-internal dependencies.
package_group(
name = "sandbox",
packages = [
"//...",
packages = ["//..."],
)
# For targets that will not normally build internally, we ensure that they are
# least build by a static BUILD test.
build_test(
name = "build_test",
targets = [
"//test/e2e:integration_test",
"//test/image:image_test",
"//test/root:root_test",
"//test/benchmarks/base:base_test",
"//test/benchmarks/database:database_test",
"//test/benchmarks/fs:fs_test",
"//test/benchmarks/media:media_test",
"//test/benchmarks/ml:ml_test",
"//test/benchmarks/network:network_test",
],
)
@@ -20,10 +75,24 @@ go_path(
name = "gopath",
mode = "link",
deps = [
# Main binary.
"//runsc",
"//shim/v1:gvisor-containerd-shim",
"//shim/v2:containerd-shim-runsc-v1",
# Packages that are not dependencies of //runsc.
"//pkg/sentry/kernel/memevent",
"//pkg/tcpip/adapters/gonet",
"//pkg/tcpip/link/channel",
"//pkg/tcpip/link/muxed",
"//pkg/tcpip/link/sharedmem",
"//pkg/tcpip/link/sharedmem/pipe",
"//pkg/tcpip/link/sharedmem/queue",
"//pkg/tcpip/link/tun",
"//pkg/tcpip/link/waitable",
"//pkg/tcpip/sample/tun_tcp_connect",
"//pkg/tcpip/sample/tun_tcp_echo",
"//pkg/tcpip/transport/tcpconntrack",
],
)
@@ -32,15 +101,3 @@ go_path(
# To update the WORKSPACE from go.mod, use:
# bazel run //:gazelle -- update-repos -from_file=go.mod
gazelle(name = "gazelle")
# nogo applies checks to all Go source in this repository, enforcing code
# guidelines and restrictions. Note that the tool libraries themselves should
# live in the tools subdirectory (unless they are standard).
nogo(
name = "nogo",
config = "tools/nogo.js",
visibility = ["//visibility:public"],
deps = [
"//tools/checkunsafe",
],
)
CODE_OF_CONDUCT.md
+2 -3
View File
@@ -87,6 +87,5 @@ harassment or threats to anyone's safety, we may take action without notice.
## Attribution
This Code of Conduct is adapted from the Contributor Covenant, version 1.4,
available at
https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
This Code of Conduct is adapted from the
[Contributor Covenant, version 1.4](https://www.contributor-covenant.org/version/1/4/code-of-conduct.html).
CONTRIBUTING.md
+13 -31
View File
@@ -32,11 +32,13 @@ will need to be added to the appropriate `BUILD` files, and the `:gopath` target
will need to be re-run to generate appropriate symlinks in the `GOPATH`
directory tree.
Dependencies can be added by using `go mod get`. In order to keep the
`WORKSPACE` file in sync, run `tools/go_mod.sh` in place of `go mod`.
### Coding Guidelines
All Go code should conform to the [Go style guidelines][gostyle]. C++ code
should conform to the [Google C++ Style Guide][cppstyle] and the guidelines
described for [tests][teststyle].
All code should comply with the [style guide](g3doc/style.md). Note that code
may be automatically formatted per the guidelines when merged.
As a secure runtime, we need to maintain the safety of all of code included in
gVisor. The following rules help mitigate issues.
@@ -46,7 +48,7 @@ Definitions for the rules below:
`core`:
* `//pkg/sentry/...`
* Transitive dependencies in `//pkg/...`, `//third_party/...`.
* Transitive dependencies in `//pkg/...`, etc.
`runsc`:
@@ -104,32 +106,15 @@ ignored.
### Build and test with Docker
`scripts/dev.sh` is a convenient script that builds and installs `runsc` as a
new Docker runtime for you. The scripts tries to extract the runtime name from
your local environment and will print it at the end. You can also customize it.
The script creates one regular runtime and another with debug flags enabled.
Here are a few examples:
Running `make dev` is a convenient way to build and install `runsc` as a Docker
runtime. The output of this command will show the runtimes installed.
You may use `make refresh` to refresh the binary after any changes. For example:
```bash
# Default case (inside branch my-branch)
$ scripts/dev.sh
...
Runtimes my-branch and my-branch-d (debug enabled) setup.
Use --runtime=my-branch with your Docker command.
docker run --rm --runtime=my-branch --rm hello-world
If you rebuild, use scripts/dev.sh --refresh.
Logs are in: /tmp/my-branch/logs
# --refresh just updates the runtime binary and doesn't restart docker.
$ git/my_branch> scripts/dev.sh --refresh
# Using a custom runtime name
$ git/my_branch> scripts/dev.sh my-runtime
...
Runtimes my-runtime and my-runtime-d (debug enabled) setup.
Use --runtime=my-runtime with your Docker command.
docker run --rm --runtime=my-runtime --rm hello-world
make dev
docker run --rm --runtime=my-branch --rm hello-world
make refresh
```
### The small print
@@ -138,10 +123,7 @@ Contributions made by corporations are covered by a different agreement than the
one above, the
[Software Grant and Corporate Contributor License Agreement][gccla].
[cppstyle]: https://google.github.io/styleguide/cppguide.html
[gcla]: https://cla.developers.google.com/about/google-individual
[gccla]: https://cla.developers.google.com/about/google-corporate
[github]: https://github.com/google/gvisor/compare
[gvisor-dev-list]: https://groups.google.com/forum/#!forum/gvisor-dev
[gostyle]: https://github.com/golang/go/wiki/CodeReviewComments
[teststyle]: ./test/
Dockerfile
-8
View File
@@ -1,8 +0,0 @@
FROM ubuntu:bionic
RUN apt-get update && apt-get install -y curl gnupg2 git python3
RUN echo "deb [arch=amd64] http://storage.googleapis.com/bazel-apt stable jdk1.8" | tee /etc/apt/sources.list.d/bazel.list && \
curl https://bazel.build/bazel-release.pub.gpg | apt-key add -
RUN apt-get update && apt-get install -y bazel && apt-get clean
WORKDIR /gvisor
GOVERNANCE.md
+113
View File
@@ -0,0 +1,113 @@
# Governance
## Projects
A *project* is the primary unit of collaboration. Each project may have its own
repository and contribution process.
All projects are covered by the [Code of Conduct](CODE_OF_CONDUCT.md), and
should include an up-to-date copy in the project repository or a link here.
## Contributors
Anyone can be a *contributor* to a project, provided they have signed relevant
Contributor License Agreements (CLAs) and follow the project's contribution
guidelines. Contributions will be reviewed by a maintainer, and must pass all
applicable tests.
Reviews check for code quality and style, including documentation, and enforce
other policies. Contributions may be rejected for reasons unrelated to the code
in question. For example, a change may be too complex to maintain or duplicate
existing functionality.
Note that contributions are not limited to code alone. Bugs, documentation,
experience reports or public advocacy are all valuable ways to contribute to a
project and build trust in the community.
## Maintainers
Each project has one or more *maintainers*. Maintainers set technical direction,
facilitate contributions and exercise overall stewardship.
Maintainers have write access to the project repository. Maintainers review and
approve changes. They can also assign issues and add additional reviewers.
Note that some repositories may not allow direct commit access, which is
reserved for administrators or automated processes. In this case, maintainers
have approval rights, and a separate process exists for merging a change.
Maintainers are responsible for upholding the code of conduct in interactions
via project communication channels. If comments or exchanges are in violation,
they may remove them at their discretion.
### Repositories requiring synchronization
For some projects initiated by Google, the infrastructure which synchronizes and
merges internal and external changes requires that merges are performed by a
Google employee. In such cases, Google will initiate a rotation to merge changes
once they pass tests and are approved by a maintainer. This does not preclude
non-Google contributors from becoming maintainers, in which case the maintainer
holds approval rights and the merge is an automated process. In some cases,
Google-internal tests may fail and have to be fixed: the Google employee will
work with the submitter to achieve this.
### Becoming a maintainer
The list of maintainers is defined by the list of people with commit access or
approval authority on a repository, typically via a Gerrit group or a GitHub
team.
Existing maintainers may elevate a contributor to maintainer status on evidence
of previous contributions and established trust. This decision is based on lazy
consensus from existing maintainers. While contributors may ask maintainers to
make this decision, existing maintainers will also pro-actively identify
contributors who have demonstrated a sustained track record of technical
leadership and direct contributions.
## Special Interest Groups (SIGs)
From time-to-time, a SIG may be formed in order to solve larger, more complex
problems across one or more projects. There are many avenues for collaboration
outside a SIG, but a SIG can provide structure for collaboration on a single
topic.
Each group will be established by a charter, and governed by the Code of
Conduct. Some resources may be provided to the group, such as mailing lists or
meeting space, and archives will be public.
## Security disclosure
Projects may maintain security mailing lists for vulnerability reports and
internal project audits may occasionally reveal security issues. Access to these
lists and audits will be limited to project *maintainers*; individual
maintainers should opt to participate in these lists based on need and
expertise. Once maintainers become aware of a potential security issue, they
will assess the scope and potential impact. If reported externally, maintainers
will determine a reasonable embargo period with the reporter.
During the embargo period, the maintainers will prioritize a fix for the
security issue. They may choose to disclose the issue to additional trusted
contributors in order to facilitate a fix, subjecting them to the embargo, or
notify affected users in order to give them an advanced opportunity to mitigate
the issue. The inclusion of specific users in this disclosure is left to the
discretion of the maintainers and contributors involved, and depends on the
scale of known project use and exposure.
Once a fix is widely available or the embargo period ends, the maintainers will
make technical details about the vulnerability and associated fixes available.
## Mailing lists
There are four key mailing lists that span projects.
* [gvisor-users](mailto:gvisor-users@googlegroups.com): general purpose user
list.
* [gvisor-dev](mailto:gvisor-dev@googlegroups.com): general purpose
development list.
* [gvisor-security](mailto:gvisor-security@googlegroups.com): private security
list. Access to this list is restricted to maintainers of the core gVisor
project, subject to the security disclosure policy described above.
* [gvisor-syzkaller](mailto:gvisor-syzkaller@googlegroups.com): private
syzkaller bug tracking list. Access to this list is not limited to
maintainers, but will be granted to those who can credibly contribute to
fixes.
LICENSE
+22
View File
@@ -200,3 +200,25 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
------------------
Some files carry the following license, noted at the top of each file:
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
Makefile
+360 -36
View File
@@ -1,47 +1,371 @@
UID := $(shell id -u ${USER})
GID := $(shell id -g ${USER})
GVISOR_BAZEL_CACHE := $(shell readlink -f ~/.cache/bazel/)
#!/usr/bin/make -f
all: runsc
# Copyright 2019 The gVisor Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
docker-build:
docker build -t gvisor-bazel .
# Helpful pretty-printer.
MAKEBANNER := \033[1;34mmake\033[0m
submake = echo -e '$(MAKEBANNER) $1' >&2; $(MAKE) $1
bazel-shutdown:
docker exec -i gvisor-bazel bazel shutdown && \
docker kill gvisor-bazel
# Described below.
OPTIONS :=
STARTUP_OPTIONS :=
TARGETS := //runsc
ARGS :=
bazel-server-start: docker-build
mkdir -p "$(GVISOR_BAZEL_CACHE)" && \
docker run -d --rm --name gvisor-bazel \
--user 0:0 \
-v "$(GVISOR_BAZEL_CACHE):$(HOME)/.cache/bazel/" \
-v "$(CURDIR):$(CURDIR)" \
--workdir "$(CURDIR)" \
--tmpfs /tmp:rw,exec \
--privileged \
gvisor-bazel \
sh -c "while :; do sleep 100; done" && \
docker exec --user 0:0 -i gvisor-bazel sh -c "groupadd --gid $(GID) --non-unique gvisor && useradd --uid $(UID) --gid $(GID) -d $(HOME) gvisor"
default: runsc
.PHONY: default
bazel-server:
docker exec gvisor-bazel true || \
$(MAKE) bazel-server-start
## usage: make <target>
## or
## make <build|test|copy|run|sudo> STARTUP_OPTIONS="..." OPTIONS="..." TARGETS="..." ARGS="..."
##
## Basic targets.
##
## This Makefile wraps basic build and test targets for ease-of-use. Bazel
## is run inside a canonical Docker container in order to simplify up-front
## requirements.
##
## There are common arguments that may be passed to targets. These are:
## STARTUP_OPTIONS - Bazel startup options.
## OPTIONS - Build or test options.
## TARGETS - The bazel targets.
## ARGS - Arguments for run or sudo.
##
## Additionally, the copy target expects a DESTINATION to be provided.
##
## For example, to build runsc using this Makefile, you can run:
## make build OPTIONS="" TARGETS="//runsc"'
##
help: ## Shows all targets and help from the Makefile (this message).
@grep --no-filename -E '^([a-z.A-Z_-]+:.*?|)##' $(MAKEFILE_LIST) | \
awk 'BEGIN {FS = "(:.*?|)## ?"}; { \
if (length($$1) > 0) { \
printf " \033[36m%-20s\033[0m %s\n", $$1, $$2; \
} else { \
printf "%s\n", $$2; \
} \
}'
build: ## Builds the given $(TARGETS) with the given $(OPTIONS). E.g. make build TARGETS=runsc
test: ## Tests the given $(TARGETS) with the given $(OPTIONS). E.g. make test TARGETS=pkg/buffer:buffer_test
copy: ## Copies the given $(TARGETS) to the given $(DESTINATION). E.g. make copy TARGETS=runsc DESTINATION=/tmp
run: ## Runs the given $(TARGETS), built with $(OPTIONS), using $(ARGS). E.g. make run TARGETS=runsc ARGS=-version
sudo: ## Runs the given $(TARGETS) as per run, but using "sudo -E". E.g. make sudo TARGETS=test/root:root_test ARGS=-test.v
.PHONY: help build test copy run sudo
BAZEL_OPTIONS := build runsc
bazel: bazel-server
docker exec -u $(UID):$(GID) -i gvisor-bazel bazel $(BAZEL_OPTIONS)
# Load all bazel wrappers.
#
# This file should define the basic "build", "test", "run" and "sudo" rules, in
# addition to the $(BRANCH_NAME) variable.
ifneq (,$(wildcard tools/google.mk))
include tools/google.mk
else
include tools/bazel.mk
endif
bazel-alias:
@echo "alias bazel='docker exec -u $(UID):$(GID) -i gvisor-bazel bazel'"
##
## Docker image targets.
##
## Images used by the tests must also be built and available locally.
## The canonical test targets defined below will automatically load
## relevant images. These can be loaded or built manually via these
## targets.
##
## (*) Note that you may provide an ARCH parameter in order to build
## and load images from an alternate archiecture (using qemu). When
## bazel is run as a server, this has the effect of running an full
## cross-architecture chain, and can produce cross-compiled binaries.
##
define images
$(1)-%: ## Image tool: $(1) a given image (also may use 'all-images').
@$(call submake,-C images $$@)
endef
rebuild-...: ## Rebuild the given image. Also may use 'rebuild-all-images'.
$(eval $(call images,rebuild))
push-...: ## Push the given image. Also may use 'push-all-images'.
$(eval $(call images,pull))
pull-...: ## Pull the given image. Also may use 'pull-all-images'.
$(eval $(call images,push))
load-...: ## Load (pull or rebuild) the given image. Also may use 'load-all-images'.
$(eval $(call images,load))
list-images: ## List all available images.
@$(call submake, -C images $$@)
runsc:
$(MAKE) BAZEL_OPTIONS="build runsc" bazel
##
## Canonical build and test targets.
##
## These targets are used by continuous integration and provide
## convenient entrypoints for testing changes. If you're adding a
## new subsystem or workflow, consider adding a new target here.
##
runsc: ## Builds the runsc binary.
@$(call submake,build OPTIONS="-c opt" TARGETS="//runsc")
.PHONY: runsc
tests:
$(MAKE) BAZEL_OPTIONS="test --test_tag_filters runsc_ptrace //test/syscalls/..." bazel
debian: ## Builds the debian packages.
@$(call submake,build OPTIONS="-c opt" TARGETS="//runsc:runsc-debian")
.PHONY: debian
unit-tests:
$(MAKE) BAZEL_OPTIONS="test //pkg/... //runsc/... //tools/..." bazel
smoke-tests: ## Runs a simple smoke test after build runsc.
@$(call submake,run DOCKER_PRIVILEGED="" ARGS="--alsologtostderr --network none --debug --TESTONLY-unsafe-nonroot=true --rootless do true")
.PHONY: smoke-tests
.PHONY: docker-build bazel-shutdown bazel-server-start bazel-server bazel runsc tests
unit-tests: ## Local package unit tests in pkg/..., runsc/, tools/.., etc.
@$(call submake,test TARGETS="pkg/... runsc/... tools/...")
tests: ## Runs all unit tests and syscall tests.
tests: unit-tests
@$(call submake,test TARGETS="test/syscalls/...")
.PHONY: tests
integration-tests: ## Run all standard integration tests.
integration-tests: docker-tests overlay-tests hostnet-tests swgso-tests
integration-tests: do-tests kvm-tests root-tests containerd-tests
.PHONY: integration-tests
network-tests: ## Run all networking integration tests.
network-tests: iptables-tests packetdrill-tests packetimpact-tests
.PHONY: network-tests
# Standard integration targets.
INTEGRATION_TARGETS := //test/image:image_test //test/e2e:integration_test
syscall-%-tests:
@$(call submake,test OPTIONS="--test_tag_filters runsc_$* test/syscalls/...")
syscall-native-tests:
@$(call submake,test OPTIONS="--test_tag_filters native test/syscalls/...")
.PHONY: syscall-native-tests
syscall-tests: ## Run all system call tests.
syscall-tests: syscall-ptrace-tests syscall-kvm-tests syscall-native-tests
.PHONY: syscall-tests
%-runtime-tests: load-runtimes_%
@$(call submake,install-test-runtime)
@$(call submake,test-runtime OPTIONS="--test_timeout=10800" TARGETS="//test/runtimes:$*")
do-tests: runsc
@$(call submake,run TARGETS="//runsc" ARGS="--rootless do true")
@$(call submake,run TARGETS="//runsc" ARGS="--rootless -network=none do true")
@$(call submake,sudo TARGETS="//runsc" ARGS="do true")
.PHONY: do-tests
simple-tests: unit-tests # Compatibility target.
.PHONY: simple-tests
docker-tests: load-basic-images
@$(call submake,install-test-runtime RUNTIME="vfs1")
@$(call submake,test-runtime RUNTIME="vfs1" TARGETS="$(INTEGRATION_TARGETS)")
@$(call submake,install-test-runtime RUNTIME="vfs2" ARGS="--vfs2")
@$(call submake,test-runtime RUNTIME="vfs2" TARGETS="$(INTEGRATION_TARGETS)")
.PHONY: docker-tests
overlay-tests: load-basic-images
@$(call submake,install-test-runtime RUNTIME="overlay" ARGS="--overlay")
@$(call submake,test-runtime RUNTIME="overlay" TARGETS="$(INTEGRATION_TARGETS)")
.PHONY: overlay-tests
swgso-tests: load-basic-images
@$(call submake,install-test-runtime RUNTIME="swgso" ARGS="--software-gso=true --gso=false")
@$(call submake,test-runtime RUNTIME="swgso" TARGETS="$(INTEGRATION_TARGETS)")
.PHONY: swgso-tests
hostnet-tests: load-basic-images
@$(call submake,install-test-runtime RUNTIME="hostnet" ARGS="--network=host")
@$(call submake,test-runtime RUNTIME="hostnet" OPTIONS="--test_arg=-checkpoint=false" TARGETS="$(INTEGRATION_TARGETS)")
.PHONY: hostnet-tests
kvm-tests: load-basic-images
@(lsmod | grep -E '^(kvm_intel|kvm_amd)') || sudo modprobe kvm
@if ! [[ -w /dev/kvm ]]; then sudo chmod a+rw /dev/kvm; fi
@$(call submake,test TARGETS="//pkg/sentry/platform/kvm:kvm_test")
@$(call submake,install-test-runtime RUNTIME="kvm" ARGS="--platform=kvm")
@$(call submake,test-runtime RUNTIME="kvm" TARGETS="$(INTEGRATION_TARGETS)")
.PHONY: kvm-tests
iptables-tests: load-iptables
@$(call submake,test-runtime RUNTIME="runc" TARGETS="//test/iptables:iptables_test")
@$(call submake,install-test-runtime RUNTIME="iptables" ARGS="--net-raw")
@$(call submake,test-runtime RUNTIME="iptables" TARGETS="//test/iptables:iptables_test")
.PHONY: iptables-tests
packetdrill-tests: load-packetdrill
@$(call submake,install-test-runtime RUNTIME="packetdrill")
@$(call submake,test-runtime RUNTIME="packetdrill" TARGETS="$(shell $(MAKE) query TARGETS='attr(tags, packetdrill, tests(//...))')")
.PHONY: packetdrill-tests
packetimpact-tests: load-packetimpact
@sudo modprobe iptable_filter ip6table_filter
@$(call submake,install-test-runtime RUNTIME="packetimpact")
@$(call submake,test-runtime OPTIONS="--jobs=HOST_CPUS*3 --local_test_jobs=HOST_CPUS*3" RUNTIME="packetimpact" TARGETS="$(shell $(MAKE) query TARGETS='attr(tags, packetimpact, tests(//...))')")
.PHONY: packetimpact-tests
root-tests: load-basic-images
@$(call submake,install-test-runtime)
@$(call submake,sudo TARGETS="//test/root:root_test" ARGS="-test.v")
.PHONY: root-tests
# Specific containerd version tests.
containerd-test-%: load-basic_alpine load-basic_python load-basic_busybox load-basic_resolv load-basic_httpd install-test-runtime
@CONTAINERD_VERSION=$* $(MAKE) sudo TARGETS="tools/installers:containerd"
@$(MAKE) sudo TARGETS="tools/installers:shim"
@$(MAKE) sudo TARGETS="test/root:root_test" ARGS="-test.v"
# Note that we can't run containerd-test-1.1.8 tests here.
#
# Containerd 1.1.8 should work, but because of a bug in loading images locally
# (https://github.com/kubernetes-sigs/cri-tools/issues/421), we are unable to
# actually drive the tests. The v1 API is tested exclusively through 1.2.13.
containerd-tests: ## Runs all supported containerd version tests.
containerd-tests: containerd-test-1.2.13
containerd-tests: containerd-test-1.3.4
containerd-tests: containerd-test-1.4.0-beta.0
##
## Website & documentation helpers.
##
## The website is built from repository documentation and wrappers, using
## using a locally-defined Docker image (see images/jekyll). The following
## variables may be set when using website-push:
## WEBSITE_IMAGE - The name of the container image.
## WEBSITE_SERVICE - The backend service.
## WEBSITE_PROJECT - The project id to use.
## WEBSITE_REGION - The region to deploy to.
##
WEBSITE_IMAGE := gcr.io/gvisordev/gvisordev
WEBSITE_SERVICE := gvisordev
WEBSITE_PROJECT := gvisordev
WEBSITE_REGION := us-central1
website-build: load-jekyll ## Build the site image locally.
@$(call submake,run TARGETS="//website:website")
.PHONY: website-build
website-server: website-build ## Run a local server for development.
@docker run -i -p 8080:8080 gvisor.dev/images/website
.PHONY: website-server
website-push: website-build ## Push a new image and update the service.
@docker tag gvisor.dev/images/website $(WEBSITE_IMAGE) && docker push $(WEBSITE_IMAGE)
.PHONY: website-push
website-deploy: website-push ## Deploy a new version of the website.
@gcloud run deploy $(WEBSITE_SERVICE) --platform=managed --region=$(WEBSITE_REGION) --project=$(WEBSITE_PROJECT) --image=$(WEBSITE_IMAGE)
.PHONY: website-deploy
##
## Repository builders.
##
## This builds a local apt repository. The following variables may be set:
## RELEASE_ROOT - The repository root (default: "repo" directory).
## RELEASE_KEY - The repository GPG private key file (default: dummy key is created).
## RELEASE_NIGHTLY - Set to true if a nightly release (default: false).
## RELEASE_COMMIT - The commit or Change-Id for the release (needed for tag).
## RELEASE_NAME - The name of the release in the proper format (needed for tag).
## RELEASE_NOTES - The file containing release notes (needed for tag).
##
RELEASE_ROOT := $(CURDIR)/repo
RELEASE_KEY := repo.key
RELEASE_NIGHTLY := false
RELEASE_COMMIT :=
RELEASE_NAME :=
RELEASE_NOTES :=
GPG_TEST_OPTIONS := $(shell if gpg --pinentry-mode loopback --version >/dev/null 2>&1; then echo --pinentry-mode loopback; fi)
$(RELEASE_KEY):
@echo "WARNING: Generating a key for testing ($@); don't use this."
T=$$(mktemp /tmp/keyring.XXXXXX); \
C=$$(mktemp /tmp/config.XXXXXX); \
echo Key-Type: DSA >> $$C && \
echo Key-Length: 1024 >> $$C && \
echo Name-Real: Test >> $$C && \
echo Name-Email: test@example.com >> $$C && \
echo Expire-Date: 0 >> $$C && \
echo %commit >> $$C && \
gpg --batch $(GPG_TEST_OPTIONS) --passphrase '' --no-default-keyring --keyring $$T --no-tty --gen-key $$C && \
gpg --batch $(GPG_TEST_OPTIONS) --export-secret-keys --no-default-keyring --keyring $$T --secret-keyring $$T > $@; \
rc=$$?; rm -f $$T $$C; exit $$rc
release: $(RELEASE_KEY) ## Builds a release.
@mkdir -p $(RELEASE_ROOT)
@T=$$(mktemp -d /tmp/release.XXXXXX); \
$(call submake,copy TARGETS="runsc" DESTINATION=$$T) && \
$(call submake,copy TARGETS="runsc:runsc-debian" DESTINATION=$$T) && \
NIGHTLY=$(RELEASE_NIGHTLY) tools/make_release.sh $(RELEASE_KEY) $(RELEASE_ROOT) $$T/*; \
rc=$$?; rm -rf $$T; exit $$rc
.PHONY: release
tag: ## Creates and pushes a release tag.
@tools/tag_release.sh "$(RELEASE_COMMIT)" "$(RELEASE_NAME)" "$(RELEASE_NOTES)"
.PHONY: tag
##
## Development helpers and tooling.
##
## These targets faciliate local development by automatically
## installing and configuring a runtime. Several variables may
## be used here to tweak the installation:
## RUNTIME - The name of the installed runtime (default: branch).
## RUNTIME_DIR - Where the runtime will be installed (default: temporary directory with the $RUNTIME).
## RUNTIME_BIN - The runtime binary (default: $RUNTIME_DIR/runsc).
## RUNTIME_LOG_DIR - The logs directory (default: $RUNTIME_DIR/logs).
## RUNTIME_LOGS - The log pattern (default: $RUNTIME_LOG_DIR/runsc.log.%TEST%.%TIMESTAMP%.%COMMAND%).
##
ifeq (,$(BRANCH_NAME))
RUNTIME := runsc
RUNTIME_DIR := $(shell dirname $(shell mktemp -u))/$(RUNTIME)
else
RUNTIME := $(BRANCH_NAME)
RUNTIME_DIR := $(shell dirname $(shell mktemp -u))/$(RUNTIME)
endif
RUNTIME_BIN := $(RUNTIME_DIR)/runsc
RUNTIME_LOG_DIR := $(RUNTIME_DIR)/logs
RUNTIME_LOGS := $(RUNTIME_LOG_DIR)/runsc.log.%TEST%.%TIMESTAMP%.%COMMAND%
dev: ## Installs a set of local runtimes. Requires sudo.
@$(call submake,refresh ARGS="--net-raw")
@$(call submake,configure RUNTIME_NAME="$(RUNTIME)" ARGS="--net-raw")
@$(call submake,configure RUNTIME_NAME="$(RUNTIME)-d" ARGS="--net-raw --debug --strace --log-packets")
@$(call submake,configure RUNTIME_NAME="$(RUNTIME)-p" ARGS="--net-raw --profile")
@$(call submake,configure RUNTIME_NAME="$(RUNTIME)-vfs2-d" ARGS="--net-raw --debug --strace --log-packets --vfs2")
@sudo systemctl restart docker
.PHONY: dev
refresh: ## Refreshes the runtime binary (for development only). Must have called 'dev' or 'install-test-runtime' first.
@mkdir -p "$(RUNTIME_DIR)"
@$(call submake,copy TARGETS=runsc DESTINATION="$(RUNTIME_BIN)")
.PHONY: refresh
install-test-runtime: ## Installs the runtime for testing. Requires sudo.
@$(call submake,refresh ARGS="--net-raw --TESTONLY-test-name-env=RUNSC_TEST_NAME --debug --strace --log-packets $(ARGS)")
@$(call submake,configure RUNTIME_NAME=runsc)
@$(call submake,configure RUNTIME_NAME="$(RUNTIME)")
@sudo systemctl restart docker
@if [[ -f /etc/docker/daemon.json ]]; then \
sudo chmod 0755 /etc/docker && \
sudo chmod 0644 /etc/docker/daemon.json; \
fi
.PHONY: install-test-runtime
configure: ## Configures a single runtime. Requires sudo. Typically called from dev or install-test-runtime.
@sudo sudo "$(RUNTIME_BIN)" install --experimental=true --runtime="$(RUNTIME_NAME)" -- --debug-log "$(RUNTIME_LOGS)" $(ARGS)
@echo -e "$(INFO) Installed runtime \"$(RUNTIME)\" @ $(RUNTIME_BIN)"
@echo -e "$(INFO) Logs are in: $(RUNTIME_LOG_DIR)"
@sudo rm -rf "$(RUNTIME_LOG_DIR)" && mkdir -p "$(RUNTIME_LOG_DIR)"
.PHONY: configure
test-runtime: ## A convenient wrapper around test that provides the runtime argument. Target must still be provided.
@$(call submake,test OPTIONS="$(OPTIONS) --test_arg=--runtime=$(RUNTIME)")
.PHONY: test-runtime

Some files were not shown because too many files have changed in this diff Show More