From ec2e4cdd66219a6809952345cf27b1b60403120e Mon Sep 17 00:00:00 2001 From: Ayush Ranjan Date: Tue, 16 May 2023 22:04:39 -0700 Subject: [PATCH] Prepare to make directfs the default in runsc. We plan on making --directfs=true the default for runsc. That will be a risky change which might need rollbacks. This change is in preparation for that so that the breaking change has a small delta. PiperOrigin-RevId: 532670826 --- .buildkite/pipeline.yaml | 36 ++++++++++++++++++------------------ runsc/boot/loader_test.go | 10 +++++++--- runsc/cmd/capability_test.go | 13 ++++++++++++- test/runner/main.go | 2 ++ 4 files changed, 39 insertions(+), 22 deletions(-) diff --git a/.buildkite/pipeline.yaml b/.buildkite/pipeline.yaml index 656c55746..b50ea29f1 100644 --- a/.buildkite/pipeline.yaml +++ b/.buildkite/pipeline.yaml @@ -401,8 +401,8 @@ steps: <<: *source_test label: ":podman: Podman" commands: - - sudo ./test/podman/run.sh - - sudo RUNTIME_ARGS=--directfs ./test/podman/run.sh + - sudo RUNTIME_ARGS=--directfs=false ./test/podman/run.sh + - sudo RUNTIME_ARGS=--directfs=true ./test/podman/run.sh agents: <<: *ubuntu_agents cgroup: "v2" @@ -439,7 +439,7 @@ steps: - <<: *common <<: *docker label: ":php: PHP runtime tests" - command: make php8.1.1-runtime-tests + command: make php8.1.1-runtime-tests RUNTIME_ARGS=--directfs parallelism: 10 agents: <<: *platform_specific_agents @@ -448,7 +448,7 @@ steps: - <<: *common <<: *docker label: ":java: Java runtime tests" - command: make java17-runtime-tests + command: make java17-runtime-tests RUNTIME_ARGS=--directfs parallelism: 40 agents: <<: *platform_specific_agents @@ -457,7 +457,7 @@ steps: - <<: *common <<: *docker label: ":golang: Go runtime tests" - command: make go1.20-runtime-tests + command: make go1.20-runtime-tests RUNTIME_ARGS=--directfs parallelism: 10 agents: <<: *platform_specific_agents @@ -466,7 +466,7 @@ steps: - <<: *common <<: *docker label: ":node: NodeJS runtime tests" - command: make nodejs16.13.2-runtime-tests + command: make nodejs16.13.2-runtime-tests RUNTIME_ARGS=--directfs parallelism: 10 agents: <<: *platform_specific_agents @@ -475,18 +475,18 @@ steps: - <<: *common <<: *docker label: ":python: Python runtime tests" - command: make python3.10.2-runtime-tests + command: make python3.10.2-runtime-tests RUNTIME_ARGS=--directfs parallelism: 10 agents: <<: *platform_specific_agents <<: *ubuntu_agents arch: "amd64" - # Runtime tests (directfs). + # Runtime tests (goferfs). Continuous only. - <<: *common <<: *docker - label: ":php: PHP runtime tests (directfs)" - command: make php8.1.1-runtime-tests RUNTIME_ARGS=--directfs + label: ":php: PHP runtime tests (goferfs)" + command: make php8.1.1-runtime-tests RUNTIME_ARGS=--directfs=false parallelism: 10 if: build.branch == "master" agents: @@ -495,8 +495,8 @@ steps: arch: "amd64" - <<: *common <<: *docker - label: ":java: Java runtime tests (directfs)" - command: make java17-runtime-tests RUNTIME_ARGS=--directfs + label: ":java: Java runtime tests (goferfs)" + command: make java17-runtime-tests RUNTIME_ARGS=--directfs=false parallelism: 40 if: build.branch == "master" agents: @@ -505,8 +505,8 @@ steps: arch: "amd64" - <<: *common <<: *docker - label: ":golang: Go runtime tests (directfs)" - command: make go1.20-runtime-tests RUNTIME_ARGS=--directfs + label: ":golang: Go runtime tests (goferfs)" + command: make go1.20-runtime-tests RUNTIME_ARGS=--directfs=false parallelism: 10 if: build.branch == "master" agents: @@ -515,8 +515,8 @@ steps: arch: "amd64" - <<: *common <<: *docker - label: ":node: NodeJS runtime tests (directfs)" - command: make nodejs16.13.2-runtime-tests RUNTIME_ARGS=--directfs + label: ":node: NodeJS runtime tests (goferfs)" + command: make nodejs16.13.2-runtime-tests RUNTIME_ARGS=--directfs=false parallelism: 10 if: build.branch == "master" agents: @@ -525,8 +525,8 @@ steps: arch: "amd64" - <<: *common <<: *docker - label: ":python: Python runtime tests (directfs)" - command: make python3.10.2-runtime-tests RUNTIME_ARGS=--directfs + label: ":python: Python runtime tests (goferfs)" + command: make python3.10.2-runtime-tests RUNTIME_ARGS=--directfs=false parallelism: 10 if: build.branch == "master" agents: diff --git a/runsc/boot/loader_test.go b/runsc/boot/loader_test.go index a2663392c..81753ff6f 100644 --- a/runsc/boot/loader_test.go +++ b/runsc/boot/loader_test.go @@ -77,7 +77,7 @@ func testSpec() *specs.Spec { // startGofer starts a new gofer routine serving 'root' path. It returns the // sandbox side of the connection, and a function that when called will stop the // gofer. -func startGofer(root string) (int, func(), error) { +func startGofer(root string, conf *config.Config) (int, func(), error) { fds, err := unix.Socketpair(unix.AF_UNIX, unix.SOCK_STREAM|unix.SOCK_CLOEXEC, 0) if err != nil { return 0, nil, err @@ -90,7 +90,11 @@ func startGofer(root string) (int, func(), error) { unix.Close(goferEnd) return 0, nil, fmt.Errorf("error creating server on FD %d: %v", goferEnd, err) } - server := fsgofer.NewLisafsServer(fsgofer.Config{}) + server := fsgofer.NewLisafsServer(fsgofer.Config{ + HostUDS: conf.GetHostUDS(), + HostFifo: conf.HostFifo, + DonateMountPointFD: conf.DirectFS, + }) c, err := server.CreateConnection(socket, root, true /* readonly */) if err != nil { return 0, nil, err @@ -113,7 +117,7 @@ func createLoader(conf *config.Config, spec *specs.Spec) (*Loader, func(), error if err != nil { return nil, nil, err } - sandEnd, cleanup, err := startGofer(spec.Root.Path) + sandEnd, cleanup, err := startGofer(spec.Root.Path, conf) if err != nil { return nil, nil, err } diff --git a/runsc/cmd/capability_test.go b/runsc/cmd/capability_test.go index c7da8131a..b2685ee4f 100644 --- a/runsc/cmd/capability_test.go +++ b/runsc/cmd/capability_test.go @@ -70,6 +70,11 @@ func checkCaps(which capability.CapType, curCaps capability.Capabilities, wantCa } func TestCapabilities(t *testing.T) { + t.Run("directfs", func(t *testing.T) { testCapabilities(t, true) }) + t.Run("lisafs", func(t *testing.T) { testCapabilities(t, false) }) +} + +func testCapabilities(t *testing.T, directfs bool) { stop := testutil.StartReaper() defer stop() @@ -86,6 +91,7 @@ func TestCapabilities(t *testing.T) { } conf := testutil.TestConfig(t) + conf.DirectFS = directfs // Use --network=host to make sandbox use spec's capabilities. conf.Network = config.NetworkHost @@ -111,8 +117,13 @@ func TestCapabilities(t *testing.T) { t.Fatalf("error starting container: %v", err) } + wantSandboxCaps := spec.Process.Capabilities + if directfs { + // With directfs, the sandbox has additional capabilities. + wantSandboxCaps = specutils.MergeCapabilities(wantSandboxCaps, directfsSandboxLinuxCaps) + } // Check that sandbox and gofer have the proper capabilities. - if err := checkProcessCaps(c.Sandbox.Getpid(), spec.Process.Capabilities); err != nil { + if err := checkProcessCaps(c.Sandbox.Getpid(), wantSandboxCaps); err != nil { t.Error(err) } if err := checkProcessCaps(c.GoferPid, goferCaps); err != nil { diff --git a/test/runner/main.go b/test/runner/main.go index a8d3491c6..ff8bdce0e 100644 --- a/test/runner/main.go +++ b/test/runner/main.go @@ -271,6 +271,8 @@ func runRunsc(tc *gtest.TestCase, spec *specs.Spec) error { } if *directfs { args = append(args, "-directfs") + } else { + args = append(args, "-directfs=false") } testLogDir := ""