mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Etienne Perot
c2beb05272
This avoids an expensive RCU stall during the Sentry boot process, when
the Linux-side FD table needs to be expanded to accommodate the Sentry's
512-sized FD table.
The kernel imposes an RCU stall when this occurs for
multithreaded programs (which all Go programs are), but not
single-threaded ones. Hence the introduction of a minimal C binary that
does the magic. There is some storytime explanation in the C source
file itself.
Even though this is an extra `exec` in the hot startup path, the
benefits are obvious:
```
runsc do /bin/true:
│ A (baseline) │ B (prewarmer) │
RunscDo 202.8m ± 3% 147.1m ± 5% -27.45% (n=100)
docker run --rm alpine true:
│ A (baseline) │ B (prewarmer) │
DockerRunStartup 778.9m ± 2% 738.0m ± 2% -5.25% (p=0.000 n=100)
OCi operations ("total" = create + start + wait + delete):
│ A (baseline) │ B (prewarmer) │
OCICreate 145.6m ± 5% 102.3m ± 8% -29.71% (n=100)
OCIReady 165.8m ± 4% 122.6m ± 6% -26.10% (n=100)
OCITotal 178.6m ± 3% 138.3m ± 5% -22.59% (n=100)
```
I also reduced the Sentry's FD table to 256 rather than 512, which saves
one or two pages of host kernel memory per sandbox instance.
Also threw in a test to make sure the C program remains
single-page-sized to avoid potential unintended bloating down the line.
72 lines
2.4 KiB
Python
72 lines
2.4 KiB
Python
"""Rule assembling the gVisor release binaries in their installed layout."""
|
|
|
|
# SIDECARS maps each sidecar binary target to the filename that runsc expects
|
|
# to find under the `gvisor-bin/` directory next to its own binary.
|
|
SIDECARS = {
|
|
"//runsc/checkpointgofer:checkpointgofer_binary": "checkpointgofer",
|
|
"//runsc/cmd/metricserver:runsc-metric-server": "runsc-metric-server",
|
|
"//runsc/cmd/sentry:gvisor_sentry": "gvisor_sentry",
|
|
"//runsc/prewarmer:gvisor-sentry-prewarmer": "gvisor-sentry-prewarmer",
|
|
}
|
|
|
|
def _single_file(target):
|
|
files = target[DefaultInfo].files.to_list()
|
|
if len(files) != 1:
|
|
fail("expected exactly one file in %s, got %d" % (target.label, len(files)))
|
|
return files[0]
|
|
|
|
def _release_files_impl(ctx):
|
|
outputs = []
|
|
inputs = []
|
|
commands = []
|
|
|
|
# Top-level binaries
|
|
for target in ctx.attr.bins:
|
|
src = _single_file(target)
|
|
out = ctx.actions.declare_file("%s/%s" % (ctx.label.name, src.basename))
|
|
inputs.append(src)
|
|
outputs.append(out)
|
|
commands.append('cp -f "%s" "%s"' % (src.path, out.path))
|
|
|
|
# Sidecar binaries
|
|
for target, name in ctx.attr.sidecars.items():
|
|
src = _single_file(target)
|
|
out = ctx.actions.declare_file("%s/gvisor-bin/%s" % (ctx.label.name, name))
|
|
inputs.append(src)
|
|
outputs.append(out)
|
|
commands.append('mkdir -p "$(dirname "%s")" && cp -f "%s" "%s"' % (out.path, src.path, out.path))
|
|
|
|
ctx.actions.run_shell(
|
|
inputs = inputs,
|
|
outputs = outputs,
|
|
command = "\n".join(commands),
|
|
mnemonic = "ReleaseFiles",
|
|
)
|
|
|
|
runfiles = ctx.runfiles(files = outputs)
|
|
return [DefaultInfo(
|
|
files = depset(outputs),
|
|
default_runfiles = runfiles,
|
|
data_runfiles = runfiles,
|
|
)]
|
|
|
|
release_files = rule(
|
|
implementation = _release_files_impl,
|
|
attrs = {
|
|
"bins": attr.label_list(
|
|
doc = "Binaries placed at the top level of the layout.",
|
|
allow_files = True,
|
|
mandatory = True,
|
|
),
|
|
"sidecars": attr.label_keyed_string_dict(
|
|
doc = "Binaries placed under gvisor-bin/, keyed by target with " +
|
|
"the in-directory filename as value.",
|
|
allow_files = True,
|
|
mandatory = True,
|
|
),
|
|
},
|
|
doc = "Assembles release binaries in the layout they are installed in: " +
|
|
"each of `bins` at the top level and `sidecars` under a " +
|
|
"`gvisor-bin/` directory.",
|
|
)
|