packaging/osbuilder: allow to pull and unpack pause image #9031

ChengyuZhu6 · 2024-02-06T12:09:29Z

For Confidential containers stack, the pause image is managed by host side, then it may configure a malicious pause image, we need package a pause image inside the rootfs and don't the pause image from host. So the pause image will be part of the Kata Containers rootfs that's used by the Confidential Containers usecase.

Fixes: #9032

fidencio

@ChengyuZhu6, I've left a few comments.
Thanks!

fidencio · 2024-02-06T17:33:34Z

.github/workflows/build-kata-static-tarball-amd64.yaml

@@ -44,6 +44,7 @@ jobs:
          - nydus
          - ovmf
          - ovmf-sev
+          - pause


This must be pause-image

fidencio · 2024-02-06T17:33:48Z

.github/workflows/build-kata-static-tarball-s390x.yaml

@@ -30,6 +30,7 @@ jobs:
          - agent
          - coco-guest-components
          - kernel
+          - pause


This must be pauise-image.

fidencio · 2024-02-06T17:34:32Z

tools/osbuilder/rootfs-builder/rootfs.sh

@@ -176,6 +177,12 @@ KERNEL_MODULES_DIR  Path to a directory containing kernel modules to include in
 LIBC                libc the agent is built against (gnu or musl).
                    Default value: ${LIBC} (varies with architecture)

+PAUSE_IMAGE_TARBALL Path to the kata-pause-image.tar.xz tarball to be unpacked inside the


kata-pause-image.tar.xz -> kata-static-pause-image.tar.xz

fidencio · 2024-02-06T17:35:51Z

tools/packaging/static-build/pause-image/Dockerfile

+    ca-certificates \
+    curl \
+    umoci \
+    skopeo


Please, ident those correcly.

fidencio · 2024-02-06T17:40:27Z

tools/packaging/static-build/pause-image/build-static-pause-image.sh

+	echo "pull pause image from remote"
+
+	skopeo copy "${pause_image_repo}":"${pause_image_version}" oci:pause:"${pause_image_version}"
+	umoci unpack --image pause:"${pause_image_version}"  "${DESTDIR}/pause_bundle"


When taking a look at the resulting tarball, I see:

⋊> kata-containers on guest-pull-rootfs ≡ tar tf build/kata-static-pause-image.tar.xz ./ ./pause_bundle/ ./pause_bundle/rootfs/ ./pause_bundle/rootfs/pause ./pause_bundle/config.json ./pause_bundle/sha256_b42c514302e917881d20666a5990795df507ec14b2d79fdb1e41a619e66b77b6.mtree ./pause_bundle/umoci.json

I assume the /pause_bundle/umoci.json file comes from the umoci unpack command. Is it the case? If so, is it okay to remove the file?

Very good point, @fidencio. I have removed umoci.json in pause_bundle. Thank you!

fidencio

lgtm, thanks @ChengyuZhu6!

stevenhorsman

One query here, but otherwise it looks good to me

stevenhorsman · 2024-02-07T08:55:52Z

tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh

@@ -847,6 +849,23 @@ install_coco_guest_components() {
 	DESTDIR="${destdir}" "${coco_guest_components_builder}"
 }

+install_pause_image() {
+	latest_artefact="$(get_from_kata_deps "externals.pause.version")"


I wonder if we should include the container image name, just in case we ever change it in this? ie:

latest_artefact="$(get_from_kata_deps "externals.pause.repo")-$(get_from_kata_deps "externals.pause.version")"

?

Yeah, I agree. :-)
Thanks @stevenhorsman

fidencio · 2024-02-07T10:07:53Z

/test

ChengyuZhu6 · 2024-02-07T11:38:10Z

/test

For Confidential containers stack, the pause image is managed by host side, then it may configure a malicious pause image, we need package a pause image inside the rootfs and don't the pause image from host. But the installation of skopeo is not included in 20.04 release, so we can not directly install skopeo in rootfs and pull pause image. So I plan to let the task as a static build stuff, which would not be influenced by the system version in rootfs. And the pause image will be part of the Kata Containers rootfs that's used by the Confidential Containers usecase. This commit enables the component to be built both locally and in our CI environment with the command: make pause-image-tarball. Fixes: kata-containers#9032 Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com> Co-authored-by: Fabiano Fidêncio <fabiano.fidencio@intel.com> Co-authored-by: Wang, Arron <arron.wang@intel.com> Co-authored-by: stevenhorsman <steven@uk.ibm.com> Co-authored-by: Jakob Naucke <jakob.naucke@ibm.com>

Enable to build pause image static tarball for confidential containers casesi in ci environment. Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>

This env ver will serve us to pass the pause image tarball to the rootfs builder, which will then just unpack the content into the rootfs. Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com> Co-authored-by: Fabiano Fidêncio <fabiano.fidencio@intel.com> Co-authored-by: Wang, Arron <arron.wang@intel.com> Co-authored-by: stevenhorsman <steven@uk.ibm.com> Co-authored-by: Jakob Naucke <jakob.naucke@ibm.com>

ChengyuZhu6 · 2024-02-08T08:31:26Z

/test

Install the pause image into the confidential rootfs image and initrd. Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>

ChengyuZhu6 · 2024-02-08T09:39:22Z

/test

ChengyuZhu6 · 2024-02-08T10:35:10Z

@fidencio @stevenhorsman I don’t think the failures are caused by the PR, but I’m not sure what the reason is. Do you have any suggestions? 😥

stevenhorsman · 2024-02-08T10:40:26Z

@fidencio @stevenhorsman I don’t think the failures are caused by the PR, but I’m not sure what the reason is. Do you have any suggestions? 😥

Unfortunately my first attempt is normally to re-run the failed tests, so I'll try that now and see if things improve. Leave it to us and don't worry about it yourself for now.

ChengyuZhu6 force-pushed the guest-pull-rootfs branch from 9572c2e to 3fbe68c Compare February 6, 2024 12:14

ChengyuZhu6 added the no-backport-needed label Feb 6, 2024

ChengyuZhu6 force-pushed the guest-pull-rootfs branch from 3fbe68c to 65d65d2 Compare February 6, 2024 12:16

katacontainersbot added the size/large Task of significant size label Feb 6, 2024

fidencio reviewed Feb 6, 2024

View reviewed changes

ChengyuZhu6 force-pushed the guest-pull-rootfs branch 3 times, most recently from 351f567 to 124aaa7 Compare February 7, 2024 04:23

ChengyuZhu6 requested a review from fidencio February 7, 2024 04:25

fidencio approved these changes Feb 7, 2024

View reviewed changes

stevenhorsman approved these changes Feb 7, 2024

View reviewed changes

ChengyuZhu6 force-pushed the guest-pull-rootfs branch from 124aaa7 to b10f5ba Compare February 7, 2024 10:04

ChengyuZhu6 added the ok-to-test label Feb 7, 2024

ChengyuZhu6 force-pushed the guest-pull-rootfs branch from b10f5ba to 9699a00 Compare February 7, 2024 10:51

ChengyuZhu6 force-pushed the guest-pull-rootfs branch from 9699a00 to 548b62d Compare February 8, 2024 01:12

ChengyuZhu6 self-assigned this Feb 8, 2024

ChengyuZhu6 and others added 2 commits February 8, 2024 11:23

workflow: Enable to build pause image in ci

53183cb

Enable to build pause image static tarball for confidential containers casesi in ci environment. Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>

ChengyuZhu6 force-pushed the guest-pull-rootfs branch 3 times, most recently from df155e1 to 931641c Compare February 8, 2024 07:09

rootfs: Install pause image into rootfs

a43edd0

Install the pause image into the confidential rootfs image and initrd. Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>

ChengyuZhu6 force-pushed the guest-pull-rootfs branch from 931641c to a43edd0 Compare February 8, 2024 08:51

ChengyuZhu6 mentioned this pull request Feb 8, 2024

Merge basic guest pull image code to main #8484

Merged

ChengyuZhu6 added the merge-to-main PRs relating to merging CCv0 content to main label Feb 8, 2024

fidencio merged commit 5557842 into kata-containers:main Feb 8, 2024
317 of 471 checks passed

ChengyuZhu6 deleted the guest-pull-rootfs branch February 8, 2024 23:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

packaging/osbuilder: allow to pull and unpack pause image #9031

packaging/osbuilder: allow to pull and unpack pause image #9031

ChengyuZhu6 commented Feb 6, 2024 •

edited

fidencio left a comment

fidencio Feb 6, 2024

ChengyuZhu6 Feb 7, 2024

fidencio Feb 6, 2024

ChengyuZhu6 Feb 7, 2024

fidencio Feb 6, 2024

ChengyuZhu6 Feb 7, 2024

fidencio Feb 6, 2024

ChengyuZhu6 Feb 7, 2024

fidencio Feb 6, 2024

ChengyuZhu6 Feb 7, 2024

fidencio left a comment

stevenhorsman left a comment

stevenhorsman Feb 7, 2024

fidencio Feb 7, 2024

ChengyuZhu6 Feb 7, 2024

fidencio commented Feb 7, 2024

ChengyuZhu6 commented Feb 7, 2024

ChengyuZhu6 commented Feb 8, 2024

ChengyuZhu6 commented Feb 8, 2024

ChengyuZhu6 commented Feb 8, 2024

stevenhorsman commented Feb 8, 2024

packaging/osbuilder: allow to pull and unpack pause image #9031

packaging/osbuilder: allow to pull and unpack pause image #9031

Conversation

ChengyuZhu6 commented Feb 6, 2024 • edited

fidencio left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fidencio left a comment

Choose a reason for hiding this comment

stevenhorsman left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fidencio commented Feb 7, 2024

ChengyuZhu6 commented Feb 7, 2024

ChengyuZhu6 commented Feb 8, 2024

ChengyuZhu6 commented Feb 8, 2024

ChengyuZhu6 commented Feb 8, 2024

stevenhorsman commented Feb 8, 2024

ChengyuZhu6 commented Feb 6, 2024 •

edited