This page does not document anything new, but it aims to be a
central document to list all the steps and considerations
necessary to run gVisor in a production environment.
This includes:
- How to make the decision to use sandboxing at all or not
(which security benefits sandboxing bring, how to think
about them).
- How to make the decision about which components to sandbox.
- What the security/performance tradeoffs are.
- How to minimize the performance impact.
- How to configure gVisor for best performance.
Also includes a crude comparative diagrams of various ways
to organize a typical production stack.
PiperOrigin-RevId: 466491023
gvisor-containerd-shim is not compatible with containerd 1.1 or earlier.
Starting from containerd 1.2, shim v2 is the preferred interface.
PiperOrigin-RevId: 351485556
- Add log statements in service entry points.
- Propagate `-debug` flag from shim invokation to the service
- Load options when shim process is invoked to ensure runsc commands
use the correct set of options, e.g. --debug --debug-logs=...
- Add debug options to the shim configuration directly, so it doesn't
rely on containerd configuration (and restart) to enable shim debug.
- Save shim logs to dedicated file, so it's easier to read logs. They
would be mixed with containerd logs and hard to distinguish
otherwise.
PiperOrigin-RevId: 342179868
Add three new doc pages to the website.
- A containerd quick start covering containerd 1.2. This is limited to shim v2
and runtime class as the docs would get too complicated explaining all the
combinations that are possible. We want folks to use shim v2 and runtime
class anyway.
- An advanced configuration page. This covers containerd and
containerd-shim-runsc-v1's configuration options.
- A page for old versions (i.e. containerd 1.1). Notes that this is deprecated
and supported on a best-effort basis.
Fixes#3279
PiperOrigin-RevId: 324775563
Jing ChenandgVisor bot
z63d
Ayush RanjanandgVisor bot
Bhautik
Adin ScannellandgVisor bot
Etienne PerotandgVisor bot
Harm-Jan.Blok
Ian LewisandgVisor bot
Naoki Oketani
Fabricio VoznikaandgVisor bot