Use gvisor in kvm platform

[zhang2639]

I use gvisor in kvm platform. The full docker command I ran is sudo docker run --runtime=runsc -it --name test centos /bin/bash.
/etc/docker/daemon.json is as follows:

{
    "runtimes": {
        "runsc": {
            "path": "/usr/local/bin/runsc",
            "runtimeArgs": [
                       "--debug-log-dir=/tmp/runsc",
                       "--debug",
                       "--strace",
                       "--platform=kvm"
            ]
       }
    }
}

I want to know whether this container use kvm platform. Then I use ps -elf | grep qemu . But I didn't see anything.
See create log in /tmp/runsc:

I0704 12:02:22.691966    9504 x:0] ***************************
I0704 12:02:22.692085    9504 x:0] Args: [/usr/local/bin/runsc --debug-log-dir=/tmp/runsc --debug --strace --platform=kvm --root /var/run/docker/runtime-runsc/moby --log /run/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca/log.json --log-format json create --bundle /var/run/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca --pid-file /run/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca/init.pid --console-socket /tmp/pty866709656/pty.sock 7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca]
I0704 12:02:22.692135    9504 x:0] PID: 9504
I0704 12:02:22.692151    9504 x:0] UID: 0, GID: 0
I0704 12:02:22.692164    9504 x:0] Configuration:
I0704 12:02:22.692176    9504 x:0] 		RootDir: /var/run/docker/runtime-runsc/moby
I0704 12:02:22.692190    9504 x:0] 		Platform: kvm
I0704 12:02:22.692212    9504 x:0] 		FileAccess: proxy, overlay: false
I0704 12:02:22.692229    9504 x:0] 		Network: sandbox, logging: false
I0704 12:02:22.692245    9504 x:0] 		Strace: true, max size: 1024, syscalls: []
I0704 12:02:22.692260    9504 x:0] ***************************
D0704 12:02:22.694536    9504 x:0] Spec: &{Version:1.0.1 Process:0xc4201dc4e0 Root:0xc4201e24e0 Hostname:7b605f35389d Mounts:[{Destination:/proc Type:proc Source:proc Options:[nosuid noexec nodev]} {Destination:/dev Type:tmpfs Source:tmpfs Options:[nosuid strictatime mode=755 size=65536k]} {Destination:/dev/pts Type:devpts Source:devpts Options:[nosuid noexec newinstance ptmxmode=0666 mode=0620 gid=5]} {Destination:/sys Type:sysfs Source:sysfs Options:[nosuid noexec nodev ro]} {Destination:/sys/fs/cgroup Type:cgroup Source:cgroup Options:[ro nosuid noexec nodev]} {Destination:/dev/mqueue Type:mqueue Source:mqueue Options:[nosuid noexec nodev]} {Destination:/etc/resolv.conf Type:bind Source:/home/docker/containers/7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca/resolv.conf Options:[rbind rprivate]} {Destination:/etc/hostname Type:bind Source:/home/docker/containers/7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca/hostname Options:[rbind rprivate]} {Destination:/etc/hosts Type:bind Source:/home/docker/containers/7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca/hosts Options:[rbind rprivate]} {Destination:/dev/shm Type:bind Source:/home/docker/containers/7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca/mounts/shm Options:[rbind rprivate]}] Hooks:0xc4200ba550 Annotations:map[] Linux:0xc420200000 Solaris:<nil> Windows:<nil>}
D0704 12:02:22.694655    9504 x:0] Spec.Hooks: &{Prestart:[{Path:/proc/9243/exe Args:[libnetwork-setkey 7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca db2706454c904cf29d852c3fd7f02925d9ad3fa5feb848af72957b2dc62963f6] Env:[] Timeout:<nil>}] Poststart:[] Poststop:[]}
D0704 12:02:22.694692    9504 x:0] Spec.Linux: &{UIDMappings:[] GIDMappings:[] Sysctl:map[] Resources:0xc420096f60 CgroupsPath:/docker/7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca Namespaces:[{Type:mount Path:} {Type:network Path:} {Type:uts Path:} {Type:pid Path:} {Type:ipc Path:}] Devices:[] Seccomp:0xc420092d00 RootfsPropagation: MaskedPaths:[/proc/kcore /proc/keys /proc/latency_stats /proc/timer_list /proc/timer_stats /proc/sched_debug /proc/scsi /sys/firmware] ReadonlyPaths:[/proc/asound /proc/bus /proc/fs /proc/irq /proc/sys /proc/sysrq-trigger] MountLabel: IntelRdt:<nil>}
D0704 12:02:22.694748    9504 x:0] Spec.Process: &{Terminal:true ConsoleSize:<nil> User:{UID:0 GID:0 AdditionalGids:[] Username:} Args:[/bin/bash] Env:[PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=7b605f35389d TERM=xterm container=docker] Cwd:/ Capabilities:0xc4201aa200 Rlimits:[] NoNewPrivileges:false ApparmorProfile: OOMScoreAdj:0xc4201f64e0 SelinuxLabel:}
D0704 12:02:22.694863    9504 x:0] Spec.Root: &{Path:/home/docker/overlay/08f0f7eab71d93c0229a53e432426c8c9f2382953568751506729f3af6b1bc9a/merged Readonly:false}
D0704 12:02:22.694899    9504 x:0] Create sandbox "7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca" in root dir: /var/run/docker/runtime-runsc/moby
D0704 12:02:22.695031    9504 x:0] Starting gofer: /usr/local/bin/runsc [--debug=true --debug-log-dir=/tmp/runsc --log=/run/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca/log.json --log-format=json --platform=kvm --root=/var/run/docker/runtime-runsc/moby --strace=true gofer --bundle /var/run/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca --io-fds=3 --io-fds=4 --io-fds=5 --io-fds=6]
I0704 12:02:22.703415    9504 x:0] Gofer started, pid: 9510
I0704 12:02:22.703871    9504 x:0] Sandbox will be started in empty IPC and UTS namespaces
I0704 12:02:22.703898    9504 x:0] Sandbox will be started in empty PID namespace
I0704 12:02:22.703912    9504 x:0] Sandbox will be started in empty mount namespace
I0704 12:02:22.703926    9504 x:0] Sandbox will be started in the container's network namespace: {Type:network Path:}
I0704 12:02:22.703944    9504 x:0] Sandbox will be started in empty user namespace
D0704 12:02:22.703958    9504 x:0] Starting sandbox: /usr/local/bin/runsc [/usr/local/bin/runsc --debug=true --debug-log-dir=/tmp/runsc --log=/run/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca/log.json --log-format=json --platform=kvm --root=/var/run/docker/runtime-runsc/moby --strace=true boot --bundle /var/run/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca --controller-fd=3 --console=true --io-fds=4 --io-fds=5 --io-fds=6 --io-fds=7]
I0704 12:02:22.706186    9504 x:0] Sandbox started, pid: 9515
D0704 12:02:22.706248    9504 x:0] Waiting for sandbox "7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca" creation
D0704 12:02:22.743994    9504 x:0] Save sandbox "7b605f35389d5766d0b56daa51fc8b1b20a2cc7375d3ef8f6ddc71881be0e9ca"
I0704 12:02:22.746578    9504 x:0] Exiting with status: 0

These means I succeed ? Or I cann't use ps -elf | grep qemu to verify it"?
Thank you for helping me.

[prattmic]

Our kvm platform doesn't use qemu (or any other traditional vmm). The log you pasted shows the configuration: Platform: kvm.

Is there something more specific you are looking for?

[zhang2639]

@prattmic Thank you.
The configuration: Platform: kvm means I succeed to use gvisor in kvm platform？
If so. I don't have any other questions.

[prattmic]

Yup!

[zhang2639]

I succeed to start container in kvm platform before. But I failed in another machine. Something strange errors.
I'm running the following:

sudo docker run --runtime=runsc hello-world

Something strange:

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/engine/userguide/

SIGSEGV: segmentation violation
PC=0x81c933 m=13 sigcode=1

goroutine 150 [syscall, locked to thread]:
gvisor.googlesource.com/gvisor/pkg/sentry/platform/kvm.(*vCPU).SwitchToUser(0xc42038ac00, 0xc4206ec6c0, 0xc4206c1300, 0xc4206e0040, 0x0, 0x4001c0, 0x32c, 0xb, 0x40488a)
        pkg/sentry/platform/kvm/machine_amd64.go:109 +0x29 fp=0xc420881d70 sp=0xc420881ce8 pc=0x828bf9
gvisor.googlesource.com/gvisor/pkg/sentry/platform/kvm.(*context).Switch(0xc42067d980, 0xbd6fe0, 0xc420762480, 0xbdc540, 0xc4206ec6c0, 0x7f7fffffffff, 0x0, 0x0, 0x0, 0x0)
        pkg/sentry/platform/kvm/context.go:68 +0x1aa fp=0xc420881e10 sp=0xc420881d70 pc=0x81ea0a
gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*runApp).execute(0x0, 0xc42019c000, 0xbccca0, 0x0)
        pkg/sentry/kernel/task_run.go:207 +0x17d fp=0xc420881f88 sp=0xc420881e10 pc=0x7046ed
gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*Task).run(0xc42019c000, 0x1)
        pkg/sentry/kernel/task_run.go:95 +0x174 fp=0xc420881fd0 sp=0xc420881f88 pc=0x704204
runtime.goexit()
        bazel-out/k8-fastbuild/bin/external/io_bazel_rules_go/linux_amd64_pure_stripped/stdlib~/src/runtime/asm_amd64.s:2361 +0x1 fp=0xc420881fd8 sp=0xc420881fd0 pc=0x455f11
created by gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*Task).Start
        pkg/sentry/kernel/task_start.go:251 +0x100

goroutine 1 [semacquire]:
sync.runtime_Semacquire(0xc4203680a0)
        GOROOT/src/runtime/sema.go:56 +0x39
sync.(*WaitGroup).Wait(0xc420368094)
        GOROOT/src/sync/waitgroup.go:129 +0x72
gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*Kernel).WaitExited(0xc420176120)
        pkg/sentry/kernel/kernel.go:728 +0x35
gvisor.googlesource.com/gvisor/runsc/boot.(*Loader).WaitExit(0xc42018a780, 0x0, 0x0)
        runsc/boot/loader.go:337 +0x2e
gvisor.googlesource.com/gvisor/runsc/cmd.(*Boot).Execute(0xc4201826c0, 0xbd2d60, 0xc420170010, 0xc420160d20, 0xc4202f00c0, 0x2, 0x2, 0x0)
        runsc/cmd/boot.go:128 +0x51e
github.com/google/subcommands.(*Commander).Execute(0xc42017e000, 0xbd2d60, 0xc420170010, 0xc4202f00c0, 0x2, 0x2, 0xc4202f00c0)
        external/com_github_google_subcommands/subcommands.go:141 +0x29f
github.com/google/subcommands.Execute(0xbd2d60, 0xc420170010, 0xc4202f00c0, 0x2, 0x2, 0x0)
        external/com_github_google_subcommands/subcommands.go:371 +0x5f
main.main()
        runsc/main.go:178 +0xebb

goroutine 19 [syscall]:
os/signal.signal_recv(0x0)
        GOROOT/src/runtime/sigqueue.go:139 +0xa6
os/signal.loop()
        GOROOT/src/os/signal/signal_unix.go:22 +0x22
created by os/signal.init.0
        GOROOT/src/os/signal/signal_unix.go:28 +0x41

goroutine 20 [semacquire]:
sync.runtime_notifyListWait(0xc42018ff10, 0xc400000000)
        GOROOT/src/runtime/sema.go:510 +0x10b
sync.(*Cond).Wait(0xc42018ff00)
        GOROOT/src/sync/cond.go:56 +0x80
gvisor.googlesource.com/gvisor/pkg/sentry/platform/filemem.(*FileMem).findReclaimable(0xc42018fb00, 0x0, 0x0, 0x0)
        pkg/sentry/platform/filemem/filemem.go:427 +0x83
gvisor.googlesource.com/gvisor/pkg/sentry/platform/filemem.(*FileMem).runReclaim(0xc42018fb00)
        pkg/sentry/platform/filemem/filemem.go:371 +0x67
created by gvisor.googlesource.com/gvisor/pkg/sentry/platform/filemem.newFromFile
        pkg/sentry/platform/filemem/filemem.go:189 +0x16d

goroutine 91 [select]:
gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*Timekeeper).startUpdater.func1(0xc420160180, 0xc420174370)
        pkg/sentry/kernel/timekeeper.go:208 +0x18f
created by gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*Timekeeper).startUpdater
        pkg/sentry/kernel/timekeeper.go:176 +0xcb

goroutine 92 [syscall]:
syscall.Syscall(0x7, 0xc4204a76d8, 0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0)
        bazel-out/k8-fastbuild/bin/external/io_bazel_rules_go/linux_amd64_pure_stripped/stdlib~/src/syscall/asm_linux_amd64.s:18 +0x5
gvisor.googlesource.com/gvisor/pkg/unet.(*Socket).wait(0xc42030e3f0, 0xffffffffffffff00, 0x0, 0x0)
        pkg/unet/unet_unsafe.go:56 +0x8c
gvisor.googlesource.com/gvisor/pkg/unet.(*ServerSocket).Accept(0xc42000c030, 0x0, 0x0, 0x0)
        pkg/unet/unet.go:539 +0x10c
gvisor.googlesource.com/gvisor/pkg/control/server.(*Server).serve(0xc4202f0260)
        pkg/control/server/server.go:99 +0x32
gvisor.googlesource.com/gvisor/pkg/control/server.(*Server).StartServing.func1(0xc4202f0260)
        pkg/control/server/server.go:87 +0x2b
created by gvisor.googlesource.com/gvisor/pkg/control/server.(*Server).StartServing
        pkg/control/server/server.go:86 +0x92

goroutine 93 [syscall]:
syscall.Syscall6(0x119, 0x79, 0xc4204b9b00, 0x64, 0xffffffffffffffff, 0x0, 0x0, 0x55b8cb, 0xc420168480, 0x74)
        bazel-out/k8-fastbuild/bin/external/io_bazel_rules_go/linux_amd64_pure_stripped/stdlib~/src/syscall/asm_linux_amd64.s:44 +0x5
gvisor.googlesource.com/gvisor/pkg/waiter/fdnotifier.epollWait(0x79, 0xc4204b9b00, 0x64, 0x64, 0xffffffffffffffff, 0x1, 0x74, 0x1)
        pkg/waiter/fdnotifier/poll_unsafe.go:69 +0x77
gvisor.googlesource.com/gvisor/pkg/waiter/fdnotifier.(*notifier).waitAndNotify(0xc420333020, 0x0, 0xc42002e000)
        pkg/waiter/fdnotifier/fdnotifier.go:146 +0x7a
created by gvisor.googlesource.com/gvisor/pkg/waiter/fdnotifier.newNotifier
        pkg/waiter/fdnotifier/fdnotifier.go:61 +0xaf

goroutine 94 [select, locked to thread]:
runtime.gopark(0xb467f0, 0x0, 0xb24008, 0x6, 0x18, 0x1)
        GOROOT/src/runtime/proc.go:291 +0x11a
runtime.selectgo(0xc4204a8f50, 0xc4201985a0)
        GOROOT/src/runtime/select.go:392 +0xe50
runtime.ensureSigM.func1()
        GOROOT/src/runtime/signal_unix.go:549 +0x1f4
runtime.goexit()
        bazel-out/k8-fastbuild/bin/external/io_bazel_rules_go/linux_amd64_pure_stripped/stdlib~/src/runtime/asm_amd64.s:2361 +0x1

goroutine 95 [select]:
reflect.rselect(0xc42018e480, 0x22, 0x22, 0xc420652900, 0x22)
        GOROOT/src/runtime/select.go:624 +0x17d
reflect.Select(0xc420656000, 0x22, 0x49, 0xc420652900, 0x12, 0xc420656000, 0x20, 0x49)
        GOROOT/src/reflect/value.go:2065 +0x5c0
gvisor.googlesource.com/gvisor/pkg/sentry/sighandling.forwardSignals(0xc420176120, 0xc4202e4400, 0x21, 0x40, 0xc4201984e0)
        pkg/sentry/sighandling/sighandling.go:43 +0x284
created by gvisor.googlesource.com/gvisor/pkg/sentry/sighandling.StartForwarding
        pkg/sentry/sighandling/sighandling.go:112 +0x20e

goroutine 27 [chan receive]:
gvisor.googlesource.com/gvisor/pkg/tcpip/network/ipv4.(*endpoint).echoReplier(0xc420668050)
        pkg/tcpip/network/ipv4/icmp.go:97 +0xfb
created by gvisor.googlesource.com/gvisor/pkg/tcpip/network/ipv4.newEndpoint
        pkg/tcpip/network/ipv4/ipv4.go:62 +0x1ce

goroutine 28 [syscall]:
gvisor.googlesource.com/gvisor/pkg/tcpip/link/rawfile.blockingPoll(0xc4204f1ec0, 0x1, 0xffffffffffffffff, 0xa, 0xffffffffffffffff)
        pkg/tcpip/link/rawfile/blockingpoll_amd64.s:13 +0x5
gvisor.googlesource.com/gvisor/pkg/tcpip/link/rawfile.BlockingReadv(0x7f, 0xc4202a21e0, 0xa, 0xa, 0x101, 0xc4204f1ec8)
        pkg/tcpip/link/rawfile/rawfile_unsafe.go:156 +0xa9
gvisor.googlesource.com/gvisor/pkg/tcpip/link/fdbased.(*endpoint).dispatch(0xc420314770, 0xbcd440, 0xc42067c000, 0xc420680000, 0x1004f, 0x1004f, 0x0, 0x0)
        pkg/tcpip/link/fdbased/endpoint.go:174 +0x7f
gvisor.googlesource.com/gvisor/pkg/tcpip/link/fdbased.(*endpoint).dispatchLoop(0xc420314770, 0xbcd440, 0xc42067c000, 0x80)
        pkg/tcpip/link/fdbased/endpoint.go:222 +0xa6
created by gvisor.googlesource.com/gvisor/pkg/tcpip/link/fdbased.(*endpoint).Attach
        pkg/tcpip/link/fdbased/endpoint.go:99 +0x53

goroutine 29 [chan receive]:
gvisor.googlesource.com/gvisor/pkg/tcpip/network/ipv4.(*endpoint).echoReplier(0xc4206680a0)
        pkg/tcpip/network/ipv4/icmp.go:97 +0xfb
created by gvisor.googlesource.com/gvisor/pkg/tcpip/network/ipv4.newEndpoint
        pkg/tcpip/network/ipv4/ipv4.go:62 +0x1ce

goroutine 31 [select]:
gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).runGoroutine(0xc4202a23c0)
        pkg/sentry/kernel/time/time.go:476 +0xf5
created by gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).init
        pkg/sentry/kernel/time/time.go:455 +0x225

goroutine 32 [select]:
gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).runGoroutine(0xc4202a28c0)
        pkg/sentry/kernel/time/time.go:476 +0xf5
created by gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).init
        pkg/sentry/kernel/time/time.go:455 +0x225

goroutine 145 [select]:
gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).runGoroutine(0xc4202a2960)
        pkg/sentry/kernel/time/time.go:476 +0xf5
created by gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).init
        pkg/sentry/kernel/time/time.go:455 +0x225

goroutine 146 [select]:
gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).runGoroutine(0xc4202a2a00)
        pkg/sentry/kernel/time/time.go:476 +0xf5
created by gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).init
        pkg/sentry/kernel/time/time.go:455 +0x225

goroutine 147 [select]:
gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).runGoroutine(0xc4202a2aa0)
        pkg/sentry/kernel/time/time.go:476 +0xf5
created by gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).init
        pkg/sentry/kernel/time/time.go:455 +0x225

goroutine 148 [select]:
gvisor.googlesource.com/gvisor/pkg/sentry/watchdog.(*Watchdog).loop(0xc42017e770)
        pkg/sentry/watchdog/watchdog.go:181 +0xf1
created by gvisor.googlesource.com/gvisor/pkg/sentry/watchdog.(*Watchdog).Start
        pkg/sentry/watchdog/watchdog.go:155 +0x1e8

goroutine 149 [select]:
gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).runGoroutine(0xc4202a2d20)
        pkg/sentry/kernel/time/time.go:476 +0xf5
created by gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).init
        pkg/sentry/kernel/time/time.go:455 +0x225

goroutine 161 [select]:
gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).runGoroutine(0xc420702000)
        pkg/sentry/kernel/time/time.go:476 +0xf5
created by gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time.(*Timer).init
        pkg/sentry/kernel/time/time.go:455 +0x225

It seems that I have created the container. But why is goroutine happening?
Then I add -d to start a centos container. The centos container cannot be started and run.

/etc/docker/daemon.json:

    "runtimes": {
        "runsc": {
            "path": "/usr/local/bin/runsc",
            "runtimeArgs": [
                       "--debug-log-dir=/tmp/runsc",
                       "--debug",
                       "--strace",
                       "--platform=kvm"
            ]
       }
    }
}

docker info:

Containers: 2
 Running: 0
 Paused: 0
 Stopped: 2
Images: 1
Server Version: 18.03.1-ce
Storage Driver: overlay
 Backing Filesystem: extfs
 Supports d_type: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc runsc
Default Runtime: runc
Init Binary: docker-init
containerd version: 773c489c9c1b21a6d78b5c538cd395416ec50f88
runc version: 4fc53a81fb7c994640722ac585fa9ca548971871
init version: 949e6fa
Security Options:
 seccomp
  Profile: default
Kernel Version: 4.9.79-009+
Operating System: CentOS Linux 7 (Core)
OSType: linux
Architecture: x86_64
CPUs: 96
Total Memory: 376.1GiB
Name: izuf65nf8wcjt73srsaudaz
ID: HRB4:NDKA:5RKM:YQUQ:ZVMU:EIGS:DCBW:WPJ5:DNZO:O2EW:QOE5:XQQR
Docker Root Dir: /home/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: true

cat /proc/cpuinfo:

processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 85
model name      : Intel(R) Xeon(R) Platinum 8163 CPU @ 2.50GHz
stepping        : 4
microcode       : 0x2000043
cpu MHz         : 2501.000
cache size      : 33792 KB
physical id     : 0
siblings        : 48
core id         : 0
cpu cores       : 24
apicid          : 0
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 22
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch epb invpcid_single cdp_l3 retpoline mba rsb_ctxsw kaiser tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm mpx rdt_a avx512f avx512dq rdseed adx smap clflushopt clwb intel_pt avx512cd avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts pku ospke
bugs            : cpu_meltdown spectre_v1 spectre_v2
bogomips        : 5000.00
clflush size    : 64
cache_alignment : 64
address sizes   : 46 bits physical, 48 bits virtual
power management:

processor       : 1
vendor_id       : GenuineIntel
cpu family      : 6
model           : 85
model name      : Intel(R) Xeon(R) Platinum 8163 CPU @ 2.50GHz
stepping        : 4
microcode       : 0x2000043
cpu MHz         : 2501.000
cache size      : 33792 KB
physical id     : 0
siblings        : 48
core id         : 1
cpu cores       : 24
apicid          : 2
initial apicid  : 2
fpu             : yes
fpu_exception   : yes
cpuid level     : 22
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch epb invpcid_single cdp_l3 retpoline mba rsb_ctxsw kaiser tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm mpx rdt_a avx512f avx512dq rdseed adx smap clflushopt clwb intel_pt avx512cd avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts pku ospke
bugs            : cpu_meltdown spectre_v1 spectre_v2
bogomips        : 5000.00
clflush size    : 64
cache_alignment : 64
address sizes   : 46 bits physical, 48 bits virtual
power management:

uname -a:

Linux izuf65nf8wcjt73srsaudaz 4.9.79-009+ #3 SMP Thu Jul 5 14:26:02 CST 2018 x86_64 x86_64 x86_64 GNU/Linux

Here the logs files:

logs.zip
@prattmic Can we reopen this issue？

[plehdeen]

Is that a virtual machine, which you have problem with running gvisor(kvm) ? ( actually, I cannot get the gvisor(kvm platform) work on a nested virtualization)

[amscanne]

@zhang2639 Can we pull your comment above into a separate issue? I believe it's unrelated but still needs to be looked at.

@plehdeen Can you provide more details? I've tested with nested virtualization in the past.

[zhang2639]

Thank you for helping me.
@plehdeen No, I run in a physical machine.
@amscanne Yeah, of course you can.

[plehdeen]

@amscanne , I still can't get gvisor kvm platform work under nested virtualization.

The runsc is nightly-build version (download in 2018-7-14). The docker version is Docker version 18.03.1-ce, build 9ee9f40. And I just test it with the hello-world docker image. Here's the log I got.

Log.tar.gz

[amscanne]

It looks like initial vCPU entry failed. There must be some feature that the nested hypervisor does not support that is being set unilaterally. I'm not sure what would be triggering it. What is the underlying hypervisor?

KVM trace events might spit out more meaningful information that it's pretty easy to get:
https://www.linux-kvm.org/page/Perf_events