Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CC: Integrate pause image into rootfs #9032

Closed
ChengyuZhu6 opened this issue Feb 6, 2024 · 1 comment · Fixed by #9031, #9080 or #9180
Closed

CC: Integrate pause image into rootfs #9032

ChengyuZhu6 opened this issue Feb 6, 2024 · 1 comment · Fixed by #9031, #9080 or #9180
Labels
enhancement Improvement to an existing feature needs-review Needs to be assessed by the team.
Projects
Issue backlog

Comments

@ChengyuZhu6
Copy link
Member

Which feature do you think can be improved?

For Confidential containers stack, the pause image is managed by host side, then it may configure a malicious pause image, we need package a pause image inside the rootfs and don't the pause image from host. So the pause image will be part of the Kata Containers rootfs that's used by the Confidential Containers usecase.
@ChengyuZhu6 ChengyuZhu6 added enhancement Improvement to an existing feature needs-review Needs to be assessed by the team. labels Feb 6, 2024
ChengyuZhu6 added a commit to ChengyuZhu6/kata-containers that referenced this issue Feb 6, 2024
@ChengyuZhu6 @fidencio
@arronwy @stevenhorsman @Jakob-Naucke
packaging: allow to pull and unpack pause image
97b3195 
For Confidential containers stack, the pause image is managed by host side,
then it may configure a malicious pause image, we need package
a pause image inside the rootfs and don't the pause image from host.

But the installation of skopeo is not included in 20.04 release, so we
can not directly install skopeo in rootfs and pull pause image.

So I plan to let the task as a static build stuff, which would not be influenced
by the system version in rootfs. And the pause image will be part of the Kata Containers rootfs
that's used by the Confidential Containers usecase. This commit enables the component to be built
both locally and in our CI environment with the command: make pause-image-tarball.

Fixes: kata-containers#9032

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>
Co-authored-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Co-authored-by: Wang, Arron <arron.wang@intel.com>
Co-authored-by: stevenhorsman <steven@uk.ibm.com>
Co-authored-by: Jakob Naucke <jakob.naucke@ibm.com>
ChengyuZhu6 added a commit to ChengyuZhu6/kata-containers that referenced this issue Feb 6, 2024
@ChengyuZhu6 @fidencio
@arronwy @stevenhorsman @Jakob-Naucke
packaging: allow to pull and unpack pause image
ee5e557 
For Confidential containers stack, the pause image is managed by host side,
then it may configure a malicious pause image, we need package
a pause image inside the rootfs and don't the pause image from host.

But the installation of skopeo is not included in 20.04 release, so we
can not directly install skopeo in rootfs and pull pause image.

So I plan to let the task as a static build stuff, which would not be influenced
by the system version in rootfs. And the pause image will be part of the Kata Containers rootfs
that's used by the Confidential Containers usecase. This commit enables the component to be built
both locally and in our CI environment with the command: make pause-image-tarball.

Fixes: kata-containers#9032

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>
Co-authored-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Co-authored-by: Wang, Arron <arron.wang@intel.com>
Co-authored-by: stevenhorsman <steven@uk.ibm.com>
Co-authored-by: Jakob Naucke <jakob.naucke@ibm.com>
@danmihai1
Copy link
Member

I hope there is an option to keep some of these components out of the Guest rootfs.

Updating the Guest rootfs is expensive in a Production environment so ideally the pause container, the Attestation client, etc. should be pulled from a container image repository rather than cramming all of them into the Guest rootfs.

ChengyuZhu6 added a commit to ChengyuZhu6/kata-containers that referenced this issue Feb 7, 2024
@ChengyuZhu6 @fidencio
@arronwy @stevenhorsman @Jakob-Naucke
packaging: allow to pull and unpack pause image
de9863a 
For Confidential containers stack, the pause image is managed by host side,
then it may configure a malicious pause image, we need package
a pause image inside the rootfs and don't the pause image from host.

But the installation of skopeo is not included in 20.04 release, so we
can not directly install skopeo in rootfs and pull pause image.

So I plan to let the task as a static build stuff, which would not be influenced
by the system version in rootfs. And the pause image will be part of the Kata Containers rootfs
that's used by the Confidential Containers usecase. This commit enables the component to be built
both locally and in our CI environment with the command: make pause-image-tarball.

Fixes: kata-containers#9032

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>
Co-authored-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Co-authored-by: Wang, Arron <arron.wang@intel.com>
Co-authored-by: stevenhorsman <steven@uk.ibm.com>
Co-authored-by: Jakob Naucke <jakob.naucke@ibm.com>
ChengyuZhu6 added a commit to ChengyuZhu6/kata-containers that referenced this issue Feb 7, 2024
@ChengyuZhu6 @fidencio
@arronwy @stevenhorsman @Jakob-Naucke
packaging: allow to pull and unpack pause image
18eab4a 
For Confidential containers stack, the pause image is managed by host side,
then it may configure a malicious pause image, we need package
a pause image inside the rootfs and don't the pause image from host.

But the installation of skopeo is not included in 20.04 release, so we
can not directly install skopeo in rootfs and pull pause image.

So I plan to let the task as a static build stuff, which would not be influenced
by the system version in rootfs. And the pause image will be part of the Kata Containers rootfs
that's used by the Confidential Containers usecase. This commit enables the component to be built
both locally and in our CI environment with the command: make pause-image-tarball.

Fixes: kata-containers#9032

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>
Co-authored-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Co-authored-by: Wang, Arron <arron.wang@intel.com>
Co-authored-by: stevenhorsman <steven@uk.ibm.com>
Co-authored-by: Jakob Naucke <jakob.naucke@ibm.com>
ChengyuZhu6 added a commit to ChengyuZhu6/kata-containers that referenced this issue Feb 7, 2024
@ChengyuZhu6 @fidencio
@arronwy @stevenhorsman @Jakob-Naucke
packaging: allow to pull and unpack pause image
db50549 
For Confidential containers stack, the pause image is managed by host side,
then it may configure a malicious pause image, we need package
a pause image inside the rootfs and don't the pause image from host.

But the installation of skopeo is not included in 20.04 release, so we
can not directly install skopeo in rootfs and pull pause image.

So I plan to let the task as a static build stuff, which would not be influenced
by the system version in rootfs. And the pause image will be part of the Kata Containers rootfs
that's used by the Confidential Containers usecase. This commit enables the component to be built
both locally and in our CI environment with the command: make pause-image-tarball.

Fixes: kata-containers#9032

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>
Co-authored-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Co-authored-by: Wang, Arron <arron.wang@intel.com>
Co-authored-by: stevenhorsman <steven@uk.ibm.com>
Co-authored-by: Jakob Naucke <jakob.naucke@ibm.com>
@ChengyuZhu6 ChengyuZhu6 mentioned this issue Feb 7, 2024
Merged
ChengyuZhu6 added a commit to ChengyuZhu6/kata-containers that referenced this issue Feb 8, 2024
@ChengyuZhu6 @fidencio
@arronwy @stevenhorsman @Jakob-Naucke
packaging: allow to pull and unpack pause image
cf5fc8e 
For Confidential containers stack, the pause image is managed by host side,
then it may configure a malicious pause image, we need package
a pause image inside the rootfs and don't the pause image from host.

But the installation of skopeo is not included in 20.04 release, so we
can not directly install skopeo in rootfs and pull pause image.

So I plan to let the task as a static build stuff, which would not be influenced
by the system version in rootfs. And the pause image will be part of the Kata Containers rootfs
that's used by the Confidential Containers usecase. This commit enables the component to be built
both locally and in our CI environment with the command: make pause-image-tarball.

Fixes: kata-containers#9032

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>
Co-authored-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Co-authored-by: Wang, Arron <arron.wang@intel.com>
Co-authored-by: stevenhorsman <steven@uk.ibm.com>
Co-authored-by: Jakob Naucke <jakob.naucke@ibm.com>
ChengyuZhu6 added a commit to ChengyuZhu6/kata-containers that referenced this issue Feb 8, 2024
@ChengyuZhu6 @fidencio
@arronwy @stevenhorsman @Jakob-Naucke
packaging: allow to pull and unpack pause image
70a84ec 
For Confidential containers stack, the pause image is managed by host side,
then it may configure a malicious pause image, we need package
a pause image inside the rootfs and don't the pause image from host.

But the installation of skopeo is not included in 20.04 release, so we
can not directly install skopeo in rootfs and pull pause image.

So I plan to let the task as a static build stuff, which would not be influenced
by the system version in rootfs. And the pause image will be part of the Kata Containers rootfs
that's used by the Confidential Containers usecase. This commit enables the component to be built
both locally and in our CI environment with the command: make pause-image-tarball.

Fixes: kata-containers#9032

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>
Co-authored-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Co-authored-by: Wang, Arron <arron.wang@intel.com>
Co-authored-by: stevenhorsman <steven@uk.ibm.com>
Co-authored-by: Jakob Naucke <jakob.naucke@ibm.com>
fidencio added a commit to fidencio/kata-containers that referenced this issue Feb 13, 2024
@fidencio
release: Don't ship the pause-image
0462b33 
It doesn't make sense to ship the pause-image itself as an release
artefact.

The reason we build it and cache it is in order to use it inside the
rootfs, and that's it, there's not need to ship it as part of the
release, at all.

Fixes: kata-containers#9032 -- part II

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
@fidencio fidencio mentioned this issue Feb 13, 2024
Merged
@katacontainersbot katacontainersbot moved this from To do to In progress in Issue backlog Feb 13, 2024
c3d pushed a commit to c3d/kata-containers that referenced this issue Feb 23, 2024
@ChengyuZhu6 @fidencio
@arronwy @stevenhorsman @Jakob-Naucke @c3d
packaging: allow to pull and unpack pause image
7aede3c 
For Confidential containers stack, the pause image is managed by host side,
then it may configure a malicious pause image, we need package
a pause image inside the rootfs and don't the pause image from host.

But the installation of skopeo is not included in 20.04 release, so we
can not directly install skopeo in rootfs and pull pause image.

So I plan to let the task as a static build stuff, which would not be influenced
by the system version in rootfs. And the pause image will be part of the Kata Containers rootfs
that's used by the Confidential Containers usecase. This commit enables the component to be built
both locally and in our CI environment with the command: make pause-image-tarball.

Fixes: kata-containers#9032

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>
Co-authored-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Co-authored-by: Wang, Arron <arron.wang@intel.com>
Co-authored-by: stevenhorsman <steven@uk.ibm.com>
Co-authored-by: Jakob Naucke <jakob.naucke@ibm.com>
c3d pushed a commit to c3d/kata-containers that referenced this issue Feb 23, 2024
@fidencio @c3d
release: Don't ship the pause-image
a675286 
It doesn't make sense to ship the pause-image itself as an release
artefact.

The reason we build it and cache it is in order to use it inside the
rootfs, and that's it, there's not need to ship it as part of the
release, at all.

Fixes: kata-containers#9032 -- part II

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
fidencio added a commit to fidencio/kata-containers that referenced this issue Feb 28, 2024
@fidencio
rootfs: Fix PAUSE_IMAGE_TARBALL addition to the rootfs
66e4bd4 
We were never passing the arguments to add the PAUSE_IMAGE to the
rootfs, leading to it never being present in the confidential image /
initrd.

Fixes: kata-containers#9032 -- part II

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
@fidencio fidencio mentioned this issue Feb 28, 2024
Merged
fidencio added a commit to fidencio/kata-containers that referenced this issue Feb 28, 2024
@fidencio
rootfs: Fix PAUSE_IMAGE_TARBALL addition to the rootfs
30cbcea 
We were never passing the arguments to add the PAUSE_IMAGE to the
rootfs, leading to it never being present in the confidential image /
initrd.

Fixes: kata-containers#9032 -- part II

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
fidencio added a commit to fidencio/kata-containers that referenced this issue Feb 28, 2024
@fidencio
rootfs: Fix PAUSE_IMAGE_TARBALL addition to the rootfs
0022474 
We were never passing the arguments to add the PAUSE_IMAGE to the
rootfs, leading to it never being present in the confidential image /
initrd.

Fixes: kata-containers#9032 -- part II

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement Improvement to an existing feature needs-review Needs to be assessed by the team.
Projects
Issue backlog
  
In progress
Milestone
No milestone
2 participants
@danmihai1 @ChengyuZhu6