zoukankan      html  css  js  c++  java
  • Kata runc privileged

    There is another question related with '--privileged' in Kata:
    In runc, '--privileged' will translate capabilities of host dev into container.
    In Kata, '--privileged' will mean containers in Kata VM can access all the device in Kata guest VM(kata limitation: https://github.com/kata-containers/documentation/blob/master/Limitations.md#docker-run---privileged ).
    Per my understanding, we should translate the capabilities of guest VM device into kata container instead of host device.
    Host resource sharing
    docker run --privileged
    Privileged support in Kata is essentially different from runc containers. Kata does support docker run --privileged command, but in this case full access to the guest VM is provided in addition to some host access.
    
    The container runs with elevated capabilities within the guest and is granted access to guest devices instead of the host devices. This is also true with using securityContext privileged=true with Kubernetes.
    
    The container may also be granted full access to a subset of host devices (https://github.com/kata-containers/runtime/issues/1568).
    
    See Privileged Kata Containers for how to configure some of this behavior.
    Containerd and CRI
    The Containerd CRI allows configuring the privileged host devices behavior for each runtime in the CRI config. This is done with the privileged_without_host_devices option. Setting this to true will disable hot plugging of the host devices into the guest, even when privileged is enabled.
    
    Support for configuring privileged host devices behaviour was added in containerd 1.3.0 version.
    
    See below example config:
    
    [plugins]
      [plugins.cri]
        [plugins.cri.containerd]
           [plugins.cri.containerd.runtimes.runc]
             runtime_type = "io.containerd.runc.v1"
             privileged_without_host_devices = false
           [plugins.cri.containerd.runtimes.kata]
             runtime_type = "io.containerd.kata.v2"
             privileged_without_host_devices = true
             [plugins.cri.containerd.runtimes.kata.options]
               ConfigPath = "/opt/kata/share/defaults/kata-containers/configuration.toml"
    Kata Containers with Containerd and CRI documentation
    Containerd CRI config documentation
  • 相关阅读:
    UNIX网络编程--学习日记
    VC下ffmpeg例程调试报错处理
    Cholesky Decomposition
    [置顶] ORM框架Hibernate (二) 对象到关系多对一映射
    [置顶] rails2 升级到 rails3 过程详细记录
    python 连接MYSQL数据库(入门帖)
    【PAT】1005 Spell It Right
    Eclipse & MyEclipse下常用快捷键介绍
    HDU 2544
    你如何只用一个数组实现三个栈?
  • 原文地址:https://www.cnblogs.com/dream397/p/14000303.html
Copyright © 2011-2022 走看看