zoukankan      html  css  js  c++  java
  • Kata runc privileged

    There is another question related with '--privileged' in Kata:
    In runc, '--privileged' will translate capabilities of host dev into container.
    In Kata, '--privileged' will mean containers in Kata VM can access all the device in Kata guest VM(kata limitation: https://github.com/kata-containers/documentation/blob/master/Limitations.md#docker-run---privileged ).
    Per my understanding, we should translate the capabilities of guest VM device into kata container instead of host device.
    Host resource sharing
    docker run --privileged
    Privileged support in Kata is essentially different from runc containers. Kata does support docker run --privileged command, but in this case full access to the guest VM is provided in addition to some host access.
    
    The container runs with elevated capabilities within the guest and is granted access to guest devices instead of the host devices. This is also true with using securityContext privileged=true with Kubernetes.
    
    The container may also be granted full access to a subset of host devices (https://github.com/kata-containers/runtime/issues/1568).
    
    See Privileged Kata Containers for how to configure some of this behavior.
    Containerd and CRI
    The Containerd CRI allows configuring the privileged host devices behavior for each runtime in the CRI config. This is done with the privileged_without_host_devices option. Setting this to true will disable hot plugging of the host devices into the guest, even when privileged is enabled.
    
    Support for configuring privileged host devices behaviour was added in containerd 1.3.0 version.
    
    See below example config:
    
    [plugins]
      [plugins.cri]
        [plugins.cri.containerd]
           [plugins.cri.containerd.runtimes.runc]
             runtime_type = "io.containerd.runc.v1"
             privileged_without_host_devices = false
           [plugins.cri.containerd.runtimes.kata]
             runtime_type = "io.containerd.kata.v2"
             privileged_without_host_devices = true
             [plugins.cri.containerd.runtimes.kata.options]
               ConfigPath = "/opt/kata/share/defaults/kata-containers/configuration.toml"
    Kata Containers with Containerd and CRI documentation
    Containerd CRI config documentation
  • 相关阅读:
    1.5 判断是奇数还是偶数(比较运算符 & if...else)
    1.4计算器 (数字类型 & 算术运算符 &赋值运算符)
    1.3hello 张三(终端交互 & 字符串)
    1.2python语言环境 & python IDE(集成开发环境)搭建
    Centos 7 下安装jdk 7
    Centos 7 安装redis
    git 学习笔记
    git 基础操作
    git 获取远程分支的代码
    redis基础操作
  • 原文地址:https://www.cnblogs.com/dream397/p/14000303.html
Copyright © 2011-2022 走看看