Comments (2)
Sysbox always uses the Linux user-ns in the containers/pods it creates. It's a must-have for proper functionality & isolation.
In order for K8s to create pods with Sysbox, the user-ns associated with the pod must be created before the network ns (and all other namespaces too) associated with that pod.
This can't be done by Sysbox itself, because per the K8s CRI spec, it's the CRI implementation (e.g., dockershim, containerd, or cri-o) that sequences this.
I've done some research and found that the CRI-O runtime manager has initial support for enabling the user-ns in pods. That is, upstream versions of CRI-O are capable of creating the user-ns for a pod first, then create the remaining ns as required.
At a high level, the way this will works is:
- The user creates a pod with an annotation indicating use of the "user-ns" and sets runtimeClass to the Sysbox runtime.
- k8s deploys that pod on a node
- The k8s kubelet on that node talks to cri-o to create the pod with user-ns and sysbox
- CRI-O creates the user-ns and network-ns, then tells sysbox to create the containers for the pod
- Sysbox creates the containers with inside the pod
Other than CRI-O, I don't believe the other CRI implementations (dockershim and containerd) support user-ns functionality. dockershim is in fact out of the question because it does not even support the runtimeClass spec required for K8s to deploy containers with Sysbox. There is work happening in Containerd to support user-ns too, but it's unlikely to come before mid 2021 (per talking to the containerd maintainers at KubeCon).
Thus, it looks like an initial implementation of K8s + Sysbox will require CRI-O on the K8s node(s).
I am working on this right now.
from sysbox.
This task is now complete.
As of Sysbox v0.4.0 (released on 07/14/21), it's now possible to use Kubernetes + Sysbox to deploy secure (rootless) pods capable of running microservices or VM-workloads (e.g., systemd, Docker, even K8s itself inside the pod).
Installation is done via a daemonset called sysbox-deploy-k8s. See here for instructions.
Currently, Sysbox requires CRI-O as the container manager on each worker node (i.e., it does not yet work with containerd, see prior comment).
The sysbox-deploy-k8s daemonset installs CRI-O on the worker node and configures the Kubelet to use CRI-O instead of the existing container manager (typically Docker or containerd).
Once containerd is updated to support pods with user-ns (expected in 2022), Sysbox will be adjusted to work with containerd too (at which point CRI-O won't be a requirement).
Closing!
from sysbox.
Related Issues (20)
- sysbox k8s directory mounted as nobody HOT 9
- ingress networking in docker swarm in dind not working.. it's working fine on the docker host HOT 1
- Docker Desktop Compatibility (Windows 11) HOT 2
- Missing packages cmp, slices with 4a266da HOT 2
- sysbox-fs high cpu usage, infinite unmount calls on shared device HOT 11
- sysbox download links in github releases do not work HOT 2
- Unable to Start Docker Daemon in Sysbox Container with NFS Mount HOT 2
- ID mapping problem inside container HOT 10
- ubuntu 24.04 release date? HOT 7
- Kubernetes 1.30 support HOT 2
- sysbox-in-docker does not work on ubuntu-focal without some Dockerfile changes
- AKS - Error while updating taint on the cluster HOT 3
- sysbox deploy got error on `v1.29.6+k3s2` HOT 3
- Fix installation instructions for RHEL-based distros HOT 3
- how to switch runtime in swarm mode? Or connect Docker daemon at unix:///var/run/docker.sock HOT 4
- Create Pod failed on AWS EKS HOT 2
- How to get /sys/fs/cgroup filesystem mounted in rw if sysbox enabled "system" container is started by kubernetes with read-only root-fs? HOT 3
- Add support for sysbox-deploy-k8s on Ubuntu Noble (24.04)
- Can not install QEMU for set multi arch on Pod
- /proc/sys/net issues
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sysbox.