mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Etienne Perot
c2beb05272
This avoids an expensive RCU stall during the Sentry boot process, when
the Linux-side FD table needs to be expanded to accommodate the Sentry's
512-sized FD table.
The kernel imposes an RCU stall when this occurs for
multithreaded programs (which all Go programs are), but not
single-threaded ones. Hence the introduction of a minimal C binary that
does the magic. There is some storytime explanation in the C source
file itself.
Even though this is an extra `exec` in the hot startup path, the
benefits are obvious:
```
runsc do /bin/true:
│ A (baseline) │ B (prewarmer) │
RunscDo 202.8m ± 3% 147.1m ± 5% -27.45% (n=100)
docker run --rm alpine true:
│ A (baseline) │ B (prewarmer) │
DockerRunStartup 778.9m ± 2% 738.0m ± 2% -5.25% (p=0.000 n=100)
OCi operations ("total" = create + start + wait + delete):
│ A (baseline) │ B (prewarmer) │
OCICreate 145.6m ± 5% 102.3m ± 8% -29.71% (n=100)
OCIReady 165.8m ± 4% 122.6m ± 6% -26.10% (n=100)
OCITotal 178.6m ± 3% 138.3m ± 5% -22.59% (n=100)
```
I also reduced the Sentry's FD table to 256 rather than 512, which saves
one or two pages of host kernel memory per sandbox instance.
Also threw in a test to make sure the C program remains
single-page-sized to avoid potential unintended bloating down the line.
45 lines
1.5 KiB
Go
45 lines
1.5 KiB
Go
// Copyright 2026 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
// Package prewarmer_test verifies size constraints on the gvisor-sentry-prewarmer
|
|
// sidecar binary.
|
|
package prewarmer_test
|
|
|
|
import (
|
|
"os"
|
|
"testing"
|
|
|
|
"gvisor.dev/gvisor/pkg/test/testutil"
|
|
)
|
|
|
|
// TestPrewarmerFitsInOnePage verifies that the compiled gvisor-sentry-prewarmer
|
|
// binary fits in a single 4KiB page.
|
|
// This ensures its faulting cost remains as small as we can make it,
|
|
// given its trivial nature and the fact that it's on the hot-path
|
|
// of gVisor startup.
|
|
func TestPrewarmerFitsInOnePage(t *testing.T) {
|
|
const maxSize = 4096
|
|
path, err := testutil.FindFile("runsc/prewarmer/gvisor-sentry-prewarmer")
|
|
if err != nil {
|
|
t.Fatalf("cannot find gvisor-sentry-prewarmer binary: %v", err)
|
|
}
|
|
st, err := os.Stat(path)
|
|
if err != nil {
|
|
t.Fatalf("cannot stat %q: %v", path, err)
|
|
}
|
|
if st.Size() > maxSize {
|
|
t.Errorf("gvisor-sentry-prewarmer is %d bytes, which does not fit in a single %d-byte page", st.Size(), maxSize)
|
|
}
|
|
}
|