mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Etienne Perot
c2beb05272
This avoids an expensive RCU stall during the Sentry boot process, when
the Linux-side FD table needs to be expanded to accommodate the Sentry's
512-sized FD table.
The kernel imposes an RCU stall when this occurs for
multithreaded programs (which all Go programs are), but not
single-threaded ones. Hence the introduction of a minimal C binary that
does the magic. There is some storytime explanation in the C source
file itself.
Even though this is an extra `exec` in the hot startup path, the
benefits are obvious:
```
runsc do /bin/true:
│ A (baseline) │ B (prewarmer) │
RunscDo 202.8m ± 3% 147.1m ± 5% -27.45% (n=100)
docker run --rm alpine true:
│ A (baseline) │ B (prewarmer) │
DockerRunStartup 778.9m ± 2% 738.0m ± 2% -5.25% (p=0.000 n=100)
OCi operations ("total" = create + start + wait + delete):
│ A (baseline) │ B (prewarmer) │
OCICreate 145.6m ± 5% 102.3m ± 8% -29.71% (n=100)
OCIReady 165.8m ± 4% 122.6m ± 6% -26.10% (n=100)
OCITotal 178.6m ± 3% 138.3m ± 5% -22.59% (n=100)
```
I also reduced the Sentry's FD table to 256 rather than 512, which saves
one or two pages of host kernel memory per sandbox instance.
Also threw in a test to make sure the C program remains
single-page-sized to avoid potential unintended bloating down the line.
40 lines
1.2 KiB
Go
40 lines
1.2 KiB
Go
// Copyright 2026 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
// Binary `fdtable_expander` successively forces the kernel to expand this
|
|
// process's FD table through the sizes that `gvisor-sentry-prewarmer` is
|
|
// meant to have already paid for:
|
|
// - 64 slots (the kernel default, should be a no-op but who knows)
|
|
// - 128
|
|
// - 256
|
|
// See `prewarmer.c` for the underlying kernel details that make this worth
|
|
// testing.
|
|
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
func main() {
|
|
for _, target := range []int{63, 127, 255} {
|
|
if err := unix.Dup3(0, target, unix.O_CLOEXEC); err != nil {
|
|
fmt.Fprintf(os.Stderr, "fdtable_expander: dup3(0, %d) failed: %v\n", target, err)
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
}
|