And enable all of the netlink tests that depend on this functionality.
Specifially, this CL implements hostinet.stack:
* .RemoveInterface()
* .AddInterfaceAddr()
* .RemoveInterfaceAddr()
Applications use netlink messages to call into these methods. For hostinet, we
use netlink messages to the host to implement these methods.
Note that the netlink messages are not simple passed from the application to
the host -- they are parsed first and only carefully crafted messages are sent
to the host.
This CL required a lot of refactoring to the existing netlink code in the
hostinet package, as well as a bunch of new functionality. All of that code has
been collected in hostinet/netlink.go
I also changed how we handle CAP_NET_ADMIN and CAP_NET_RAW in tests, since we
must drop those capabilities inside the sandbox if we don't have them on the
host. The new solution is cleaner and does not rely on google-specific env
variables.
PiperOrigin-RevId: 522685544
Add portforward comand so that we can use runsc to forward connections
to container ports. This will eventually be supported in k8s.
PiperOrigin-RevId: 520739913
We plan on making --overlay2=root:self the default for runsc. That will be a
risky change which might need rollbacks. This change is in preparation for
that. We manually set --overlay2=none in places where we don't want the
overlay configuration to impact. This change should be a noop. The intention
for this change is to make the risky change very small and limited to just
flipping a flag.
PiperOrigin-RevId: 513930702
We must have CAP_NET_RAW to create raw sockets with hostinet. This change makes
the runsc Loader fail if hostinet+raw sockets are configured but we do not have
the necessary capability.
PiperOrigin-RevId: 513417124
Add the usage benchmark which queries memory usage from the container. This
is meant to replace the size benchmark which has a ton of noise.
Flakes are due to the complicated measurement technique of dropping caches ->
parse /proc/meminfo -> start containers -> drops caches again -> parse
/proc/meminfo -> take the diference. This was done because not all runtimes
support docker/containerd stats.
Buuuut...gVisor does, so we'll just take the stats figures to reduce noise
for the memory usage benchmark.
In addition, the returned types.StatsJSON object contains several useful stats
like page faults and CPU usage, so adding these will be trivial and will not
slow down benchmark performance.
[types.StatsJSON linky link](https://github.com/moby/moby/blob/42c8b314993e5eb3cc2776da0bbe41d5eb4b707b/api/types/stats.go#LL153)
PiperOrigin-RevId: 503342363
--overlay2 flag supersedes --overlay flag. It allows more granular
configuration for overlayfs in runsc. It does so in two ways:
1. Allows to apply overlay on all mounts or only the root mount.
--overlay applies overlay to all mounts.
2. Allows to specify if overlay's upper layer should be backed by
container memory or disk. --overlay always used container memory.
Allowing tmpfs to be backed by a file on disk prevents the container
memory from bloating up. Note that the tmpfs filesystem tree will
still be stored in sentry memory.
Using overlay on the root filesystem, helps avoid expensive
communication with the gofer process. The root filesystem of the
container is not preserved across container lifecycle. So we don't
need to keep updating the host filesystem, which will anyways be
destroyed once the container is destroyed. It is wasted effort.
Instead we keep all the changes to the root filesystem in tmpfs which
is directly accessible by the sentry.
The host file is created as an unnamed file using O_TMPFILE. Support
has been added for sub-containers too. Save/restore support is
still lacking.
Co-authored-by: Andrei Vagin <[email protected]>
PiperOrigin-RevId: 491988485
Without this, attempting to build or test gVisor on machines where the default
runtime isn't `runc` may fail, as that runtime may not support what we need.
PiperOrigin-RevId: 486205081
This adds flags and env variables for the following settings to runtime tests:
- `per_test_timeout`: A per-test timeout which can be shorter
than the batch timeout. Useful to cap the duration of tests
which flake by getting stuck (as is the case for
`bug60120.phpt`)
- `runs_per_test`: Number of times to run each test (useful to
detect flakes).
- `flaky_is_error`: Controls whether a flaky test is considered
passing or failing for batch error code purposes. Useful when
either diagnosing a flaky test, or diagnosing a
consistently-failing test while bypassing flaky others.
- `flaky_short_circuit`: If a test is found to be flaky, declare
it as such immediately, rather than waiting for the rest of the
`--runs_per_test` to finish. Speeds up bisecting flaky test, at
the cost of flakiness percentage accuracy.
PiperOrigin-RevId: 466791296
proctor is running in a sandbox and it executes tests. If it is able to
handle timeouts, we will know that a test sandbox is alive and proctor
will send SIGTERM to test processes and collect all logs.
In addition, these changes contains a few things:
* upload runsc logs with other test artifacts.
* increase log level for java tests.
* call Fatalf instead of Errorf when we want to terminate a test.
PiperOrigin-RevId: 437385756
First, this change moves the internal config API to use flag.FlagSet, which
allows more flexibility and fixes many test usages.
Second, the runtime flags are validated during install. The platform is opened
and a warning issued if this fails, but this is not fatal.
This change requires moving the Makefile to --test_env, since the attribute
is not properly supported by test targets. Therefore, the targets can use args
while the Makefile must pass in configuration via --test_env.
PiperOrigin-RevId: 428048274
In some cases, it may be desirable to prebuild binaries and run all tests,
for example to run benchmarks with various experiments. Allow the top-level
Makefile to support this by checking for a STAGED_BINARIES variable.
PiperOrigin-RevId: 410673120
Executing `select {}` to wait forever triggers Go runtime deadlock
detection and kills the child, causing the number actual processes
be less than expected.
PiperOrigin-RevId: 376298799
Due to https://github.com/moby/moby/issues/42345, the docker daemon is passing
the incorrect `--root` flag to runsc. So our profiler is not able to find the
container stat files where it expects them to be.
PiperOrigin-RevId: 372067954
- Don't cleanup containers in Network.Cleanup, otherwise containers will
be killed and removed several times.
- Don't set AutoRemove for containers. This will prevent the confusing
'removal already in progress' messages.
Fixes#3795
PiperOrigin-RevId: 364404414
The syscall package has been deprecated in favor of golang.org/x/sys.
Note that syscall is still used in the following places:
- pkg/sentry/socket/hostinet/stack.go: some netlink related functionalities
are not yet available in golang.org/x/sys.
- syscall.Stat_t is still used in some places because os.FileInfo.Sys() still
returns it and not unix.Stat_t.
Updates #214
PiperOrigin-RevId: 360701387
Fix issue with iperf where b.N wasn't changing across runs.
Also, if the given runtime is runc/not given, don't run a profile against it.
PiperOrigin-RevId: 357231450
Whether the variable was found is already returned by syscall.Getenv.
os.Getenv drops this value while os.Lookupenv passes it along.
PiperOrigin-RevId: 351674032
gvisor-containerd-shim is not compatible with containerd 1.1 or earlier.
Starting from containerd 1.2, shim v2 is the preferred interface.
PiperOrigin-RevId: 351485556
This creates a TTY pair and runs `/bin/sh` in interactive mode within it.
It provides useful helper functions to interact with the shell and read the
output of commands run within it.
This is meant to be used for testing upcoming changes allowing `runsc exec` to
work in `-detach=false -tty=true` mode.
PiperOrigin-RevId: 350841006
This includes minor fix-ups:
* Handle SIGTERM in runsc debug, to exit gracefully.
* Fix cmd.debug.go opening all profiles as RDONLY.
* Fix the test name in fio_test.go, and encode the block size in the test.
PiperOrigin-RevId: 350205718
- Tweak the benchmarks to work with b.N where appropriate. In many cases,
b.N was simply being ignored. This creates an implicit dependency in the
user passing a reasonable benchtime (less than or equal to the actual
runtime of the test, or using the X syntax) otherwise the test runs
forever.
- In cases where the above is impossible, explicitly set benchtime from
the test wrapper, to prevent the above behavior (tensorflow).
- Drop the *Reverse variants, which are simply hey benchmarks. We should
just add a hey benchmark. The platforms benchmarks already include a
native platform, and thus these benchmarks are incredibly confusing.
(In other words, BenchmarkNginxReverse has nothing to do with an nginx
benchmark for runsc.)
- Remove the redunant Harness object, which contains no state, in order
to slightly simplify the code.
- Make Block and Heap profiling actually work, but setting appropriate
runtime parameters (and plumbing them through the config).
- Split the profiling into two phases: start and stop, since some will
need to be started early, and others will need to happen at the end.
PiperOrigin-RevId: 349495377
testutil.RandomID was using Rand.Read which is not safe for concurrent use.
It caused name conflicts in packetimpact tests when they are run in parallel.
Adding a mutex to protect the Rand.Read operation.
PiperOrigin-RevId: 345360062
Currently, if containerd is installed locally via tools/installers/containerd,
then it will not necessarily be used if containerd is installed in the system
path. This means that the existing containerd tests are all likely broken.
Also, use libbtrfs-dev instead of btrfs-tools, which is not actually required.
PiperOrigin-RevId: 344879109
Docker does not have IPv6 port forwarding as tracked by the following issue:
https://github.com/moby/moby/issues/11518
So when running bazel itself inside a docker container, we can not use the host
port bindings to communicate with sockets inside the container. This was causing
integration tests and image tests to fail when run through our Makefile targets.
PiperOrigin-RevId: 332355051
Use reflection and tags to provide automatic conversion from
Config to flags. This makes adding new flags less error-prone,
skips flags using default values (easier to read), and makes
tests correctly use default flag values for test Configs.
Updates #3494
PiperOrigin-RevId: 328662070
