-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Provide urpc alternative to OCI #238
Comments
I agree that it'd be cleaner for gvisor-containerd-shim to talk via its own interface to the sandbox, and to clean up the gVisor-specific annotations in runsc. I have two questions:
|
|
I think it's worth while to have commands that are accessible via the command line so I don't think those should be removed, but it does make sense for the shim to use an rpc interface to talk to the sandbox directly without having to rely on various satellite invocations of runsc (which are effectively rpc proxies to the sandbox anyway). |
Some operations like creating and deleting sandboxes have sandbox-wide logic. One example is calculating the sandbox process' OOMScore which looks at each container's oom_score_adj on creation or deletion of a container in the sandbox. gvisor/runsc/container/container.go Line 1090 in ca90dad
Synchronization will need to be done on the urpc client side since the sandbox process won't have permissions to perform operations like setting the gofer's oom_score_adj. |
Using OCI to create and manage containers require many process invocations to start a Pod. It also requires many satellite processes to be running: one
runsc wait
process for every container, anotherrunsc exec
for every exec invocation,runsc events --stats
to capture stats. Using processes also makes it hard to distinguish between command errors and errors coming from the container, e.g.runsc exec
may fail because there is an invalid parameter, or because the application being executed failed with an invalid parameter.Many of these problems go away if we had an RPC interface that gvisor-containerd-shim can call directly. The proposal is to create a client library that talks directly to the sandbox using the urpc endpoint that is already exposed. This would be a full replacement of OCI, requiring no extra process invocation to create and manage pod, including terminal support.
gvisor-containerd-shim would use this new API exclusively, leaving the OCI implementation to be used by docker and other users of runsc. Multi-container support, and gVisor specific annotations can be removed from the command-line interface.
The text was updated successfully, but these errors were encountered: