This CL introduces a comprehensive set of integration tests for the runsc
metric-server within the containerd shim test suite. The tests verify that
the metric-server can correctly discover, scrape, and export Prometheus
metrics from sandboxes under various scenarios.
Specifically, we add the following tests in a new file, metric_server_test.go:
- TestMetricServer: A basic smoke test verifying metric-server startup,
Unix socket binding, and basic metrics export containing the sandbox ID.
- TestMetricServerMultipleSandboxes: Verifies concurrent scraping of multiple
sandboxes sharing a runsc root directory.
- TestMetricServerMultiContainer: Verifies that adding and killing
sub-containers inside a sandbox does not break metrics export, and that the
metric-server remains responsive.
- TestMetricServerLifecycle: Verifies that the metric-server dynamically
updates the active running sandbox count (1 -> 0 -> 1) as sandboxes start
and stop.
All tests are executed in two variants:
- default: Shim grouping is OFF.
- grouping: Shim grouping is ON (standard Kubernetes/Pod setup).
We also refactored the existing shim_test.go to extract a shared setupSandbox
helper, which eliminated ~150 lines of duplicate setup code across the entire
test suite.
PiperOrigin-RevId: 938121065
- Added TestPauseResumeSandbox, TestPidsSandbox, TestDeleteContainer,
and TestExecContainer integration tests in shim_test.go.
- Configured each MockContainerd instance to launch a unique local TTRPC
events server on a short Unix socket path under /tmp.
- Refactored TestPauseResumeSandbox to reactively assert container state changes
by waiting on TaskPaused and TaskResumed events from the event channel.
- Refactored killAndWaitForContainer helper to wait on TaskExit event.
- Patched gVisor shim State RPC to map container "paused" status to PAUSED.
- Registered specs.Process in typeurl registry to allow marshaling for Exec RPC.
- Gracefully handled rootless "operation not permitted" umount errors on Delete.
PiperOrigin-RevId: 938091357
Refactor TestCreateSandbox to use helper functions for creating, starting, and
killing containers, which wait for the expected task states. Add
TestCreateSandboxWithContainer to verify the workflow of creating a sandbox,
then creating and starting a container inside it, and finally killing
the sandbox. Update shimutils.NewContainerSpec to accept a sandboxID.
PiperOrigin-RevId: 919866693
The gVisor shim is registere as containerd TTRPC plugin.
The change removes global `id` filed from runsc task service, which transitions
the shim from a single container per shim assumption to multi continers per
shim architecture.
This CL modernizes the gVisor `runsc` shim by transitioning from the legacy
`containerdshim.Run` to the modern `containerdshim.RunManager` bootstrap flow.
Since the containerdshim.Run is removed in containerd 2.0 and later, it allows
us to migrate gVisor to integrate with containerd 2.0+.
This aligns the `runsc` shim with the `runc` architecture and allows it to be
loaded natively as a containerd plugin.
PiperOrigin-RevId: 912797962
gvisor-containerd-shim is not compatible with containerd 1.1 or earlier.
Starting from containerd 1.2, shim v2 is the preferred interface.
PiperOrigin-RevId: 351485556
These are primarily simplification and lint mistakes. However, minor
fixes are also included and tests added where appropriate.
PiperOrigin-RevId: 351425971
Using the newer bazel rules necessitates a transition from proto1 to
proto2. In order to resolve the incompatibility between proto2 and
gogoproto, the cri runtimeoptions proto must be vendored.
Further, some of the semantics of bazel caching changed during the
transition. It is now necessary to:
- Ensure that :gopath depends only on pure library targets, as the
propagation of go_binary build attributes (pure, static) will
affected the generated files (though content remains the same,
there are conflicts with respect to the gopath).
- Update bazel.mk to include the possibility of binaries in the
bazel-out directory, as it will now put runsc and others there.
This required some refinements to the mechanism of extracting
paths, since some the existing regex resulted in false positives.
- Change nogo rules to prevent escape generation on binary targets.
For some reason, the newer version of bazel attempted to run the
nogo analysis on the binary targets, which fails due to the fact
that objdump does not work on the final binary. This must be due
to a change in the semantics of aspects in bazel3.
PiperOrigin-RevId: 337958324
Add three new doc pages to the website.
- A containerd quick start covering containerd 1.2. This is limited to shim v2
and runtime class as the docs would get too complicated explaining all the
combinations that are possible. We want folks to use shim v2 and runtime
class anyway.
- An advanced configuration page. This covers containerd and
containerd-shim-runsc-v1's configuration options.
- A page for old versions (i.e. containerd 1.1). Notes that this is deprecated
and supported on a best-effort basis.
Fixes#3279
PiperOrigin-RevId: 324775563
The go.mod dependency tree for the shim was somehow contradictory. After
resolving these issues (e.g. explicitly imported k8s 1.14, pulling a
specific dbus version), and adding all dependencies, the shim can now be
build as part of the regular bazel tree.
As part of this process, minor cleanup was done in all the source files:
headers were standardized (and include "The gVisor Authors" in addition
to the "The containerd Authors" if originally derived from containerd
sources), and comments were cleaned up to meet coding standards.
This change makes the containerd installation dynamic, so that multiple
versions can be tested, and drops the static installer for the VM image
itself.
This change also updates test/root/crictl_test.go and related utilities,
so that the containerd tests can be run on any version (and in cases
where it applies, they can be run on both v1 and v2 as parameterized
tests).
