Separate runc binary version from libcontainer version, and remove obsolete build-tags #5036

thaJeztah · 2021-02-15T18:45:56Z

Remove references to apparmor and selinux buildtags for runc

From the runc v1.0.0-rc93 release notes:

The "selinux" and "apparmor" buildtags have been removed, and now all runc
builds will have SELinux and AppArmor support enabled. Note that "seccomp"
is still optional (though we very highly recommend you enable it).

Separate runc binary version from libcontainer version

Now that the dependency on runc (libcontaienr) code has been reduced
considerably, it is probbaly ok to cut the version dependency between
libcontainer and the runc binary that is supported.

This patch separates the runc binary version from the version of
libcontainer that is defined in go.mod, and updates the documentation
accordingly.

The RUNC_COMMIT variable in the install-runc script is renamed to
RUNC_VERSION to encourage using tagged versions, and the Dockerfile
in contrib is updated to allow building with a custom version.

move runc version to a separate file for easier consumption

This moves the runc version to build to scripts/setup/runc-version,
which makes it easier for packagers to find the default version
to use.

The RUNC_VERSION environment variable can still be used to override
the version, which can be used (e.g.) to test against different versions
in our CI.

theopenlab-ci · 2021-02-15T18:46:18Z

Build succeeded.

containerd-build-arm64 : NODE_FAILURE in 0s (non-voting)

thaJeztah · 2021-02-15T18:48:03Z

This was brought up as consideration by @AkihiroSuda in #4717 (comment)

estesp

LGTM

mikebrow · 2021-02-15T21:27:16Z

BUILDING.md

@@ -209,7 +209,7 @@ Next, let's build `runc`:

 ```sh
 cd /go/src/github.com/opencontainers/runc
-make BUILDTAGS='seccomp apparmor selinux' && make install
+make BUILDTAGS='seccomp' && make install


maybe add:

The "selinux" and "apparmor" buildtags have been removed, and now all runc builds will have SELinux and AppArmor support enabled. Note that "seccomp" is still optional (though we very highly recommend you enable it).

BUILDTAGS=seccomp is specified by default, so just make && make install should work

The default runc BUILDTAGS gets overwritten if passing any BUILDTAGS to make cri-cni-release, because it passes the same value through to the runc Makefile if it isn't explicitly set here.

I've been building with make BUILDTAGS=no_btrfs cri-cni-release and containerd started failing in my test k8s clusters after pulling this change into master.

(in script/setup/install-runc) HEAD is now at 12644e61 VERSION: release 1.0.0~rc93 make[1]: Entering directory '/tmp/tmp.ZJzc2KtI0A/runc' go build -trimpath "-mod=vendor" "-buildmode=pie" -tags "no_btrfs" -ldflags "-X main.gitCommit="12644e614e25b05da6fd08a38ffa0cfe1903fdec" -X main.version=1.0.0-rc93 " -o runc . ^^^^^^^^^^^^^^^^

Maybe this should be documented somewhere, or if the runc build tags aren't intended to be changed from the default then go back to setting it here again?

Hmm... good one; that's because both containerd and runc use the same variable name. Also wondering if runc looks at environment variables, or make variables 🤔

I guess we can add the BUILDTAGS back here, because we always build with the same options in our script

opened #5184

mikebrow · 2021-02-15T21:28:45Z

docs/RUNC.md

 ```bash
-make BUILDTAGS='seccomp selinux' && sudo make install
+make BUILDTAGS='seccomp' && sudo make install


same as above..

mikebrow

see comment around leaving some historical reference so people will know why it's no longer there...

dims · 2021-02-16T00:04:37Z

script/setup/install-runc

@@ -21,13 +21,15 @@
 set -eu -o pipefail

 function install_runc() {
-	RUNC_COMMIT=$(grep opencontainers/runc "$GOPATH"/src/github.com/containerd/containerd/go.mod | awk '{print $2}')
+	# When updating RUNC_COMMIT, consider updating the runc module as well
+	: ${RUNC_COMMIT:=12644e614e25b05da6fd08a38ffa0cfe1903fdec} # v1.0.0-rc93


what is a good way to publicize this? we want to highlight this well enough for folks who have now been used to picking up SHA from the go.mod

chase it down with hound and push commits ? :-)

chase it down with hound and push commits ? :-)

Hehehe!

Should we change the name of the variable to RUNC_VERSION to encourage using tagged releases (and default to using a tag)?

theopenlab-ci · 2021-03-08T18:13:09Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 5m 39s (non-voting)

From the runc v1.0.0-rc93 release notes: > The "selinux" and "apparmor" buildtags have been removed, and now all runc > builds will have SELinux and AppArmor support enabled. Note that "seccomp" > is still optional (though we very highly recommend you enable it). Also adding a note about kmem support. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

theopenlab-ci · 2021-03-10T12:33:57Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 6m 24s (non-voting)

dims · 2021-03-10T12:34:59Z

script/setup/install-runc

@@ -21,13 +21,14 @@
 set -eu -o pipefail

 function install_runc() {
-	RUNC_COMMIT=$(grep opencontainers/runc "$GOPATH"/src/github.com/containerd/containerd/go.mod | awk '{print $2}')
+	# When updating RUNC_VERSION, consider updating the runc module in go.mod as well
+	: "${RUNC_VERSION:=v1.0.0-rc93}"


could we please pick up the RUNC_VERSION from a file? ( we could have a file name RUNC_VERSION with the contents of v1.0.0-rc93 ) So it will then be easy to curl the version from a branch or master (directly from github raw url) easily for automation (in downstream or other CI in other projects).

So; pick from file, but allow the RUNC_VERSION env-var to override, correct? Yes I guess we can do that. Let me have a look

works! thanks!

Now that the dependency on runc (libcontaienr) code has been reduced considerably, it is probbaly ok to cut the version dependency between libcontainer and the runc binary that is supported. This patch separates the runc binary version from the version of libcontainer that is defined in go.mod, and updates the documentation accordingly. The RUNC_COMMIT variable in the install-runc script is renamed to RUNC_VERSION to encourage using tagged versions, and the Dockerfile in contrib is updated to allow building with a custom version. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

theopenlab-ci · 2021-03-10T12:49:12Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 6m 18s (non-voting)

thaJeztah · 2021-03-10T13:02:47Z

@dims updated; pushed a commit that moves the version to a separate file

thaJeztah · 2021-03-10T13:04:13Z

README.md

@@ -49,7 +49,8 @@ Please be aware: nightly builds might have critical bugs, it's not recommended f

 Runtime requirements for containerd are very minimal. Most interactions with
 the Linux and Windows container feature sets are handled via [runc](https://github.com/opencontainers/runc) and/or
-OS-specific libraries (e.g. [hcsshim](https://github.com/Microsoft/hcsshim) for Microsoft). The current required version of `runc` is always listed in [RUNC.md](/docs/RUNC.md).
+OS-specific libraries (e.g. [hcsshim](https://github.com/Microsoft/hcsshim) for Microsoft).
+The current required version of `runc` is described in [RUNC.md](docs/RUNC.md).


keeping RUNC.md as the "canonical" place to describe what version to use instead of pointing to the runs-version file (I think it's useful for readers to get the additional context that the RUNC.md document provides

thaJeztah · 2021-03-10T13:05:54Z

Arf.. that didn't work; probably needs abs-path (relative to the script)

cat: ./runc-version: No such file or directory

theopenlab-ci · 2021-03-10T13:16:37Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 5m 47s (non-voting)

dims

LGTM

thanks @thaJeztah !

thaJeztah · 2021-03-10T13:25:56Z

Hmm.. looks like a commit message is not passing validation;

f39ea1f6 "Merge 7d18415109f7a6378d8fa296b1a2096980a07535 into 17ab5dd08cc06b6f15af66918c4740795087355e" ... FAIL
    - FAIL - has whitespace errors. See `git show --check f39ea1f6a8bec1cce3cae0e305c6e5fe2f84a246`.
    - PASS - merge commits do not require DCO
    - PASS - merge commits do not require length check
   * 7d184151 "move runc version to a separate file for easier consumption" ... FAIL
    - FAIL - has whitespace errors. See `git show --check 7d18415109f7a6378d8fa296b1a2096980a07535`.
    - PASS - has a valid DCO
    - PASS - commit subject is 72 characters or less! *yay*

let me check

ah! shell script formatting; looks I left a stray space;

script/setup/install-runc:24: space before tab in indent.
+       script_dir="$(cd -- "$(dirname -- "$0")" > /dev/null 2>&1; pwd -P)"

This moves the runc version to build to scripts/setup/runc-version, which makes it easier for packagers to find the default version to use. The RUNC_VERSION environment variable can still be used to override the version, which can be used (e.g.) to test against different versions in our CI. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

theopenlab-ci · 2021-03-10T13:36:18Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 5m 57s (non-voting)

thaJeztah · 2021-03-10T22:55:37Z

@mikebrow ptal; hope the latest changes LGTY

mikebrow

LGTM

- bump docker-proxy dep to 0.8.0_p20210525 - unfortunately tests require priveleges and fetching from network - ESYSROOT should be used to locate headers and libraries. - Remove CONFIG_RT_GROUP_SCHED - drop the dependency on runc since this is pulled in by containerd - set a lower limit for the dependency oncontainerd but do not pin it to a specific version. For more information, see the below upstream issue. moby/moby#42117 containerd/containerd#5036

Zyqsempai approved these changes Feb 15, 2021

View reviewed changes

estesp approved these changes Feb 15, 2021

View reviewed changes

mikebrow reviewed Feb 15, 2021

View reviewed changes

mikebrow mentioned this pull request Feb 15, 2021

Add a development doc for cri #5037

Closed

dims reviewed Feb 16, 2021

View reviewed changes

dims mentioned this pull request Feb 20, 2021

bump runc to v1.0.0-rc93 google/cadvisor#2809

Merged

This was referenced Mar 7, 2021

docker 20.10.4 and 20.10.5 have a dependency conflict moby/moby#42117

Closed

Fix detection of default runc version due upstream to switch to go.mod docker/containerd-packaging#224

Merged

thaJeztah force-pushed the split_runc_binary branch from bb48350 to b9320aa Compare March 8, 2021 18:06

thaJeztah force-pushed the split_runc_binary branch from b9320aa to 60c0300 Compare March 10, 2021 12:25

dims reviewed Mar 10, 2021

View reviewed changes

thaJeztah force-pushed the split_runc_binary branch from 60c0300 to 8325ba5 Compare March 10, 2021 12:41

thaJeztah commented Mar 10, 2021

View reviewed changes

thaJeztah force-pushed the split_runc_binary branch from 6412df6 to 7d18415 Compare March 10, 2021 13:09

dims approved these changes Mar 10, 2021

View reviewed changes

thaJeztah force-pushed the split_runc_binary branch from 7d18415 to 79a51cd Compare March 10, 2021 13:28

AkihiroSuda approved these changes Mar 10, 2021

View reviewed changes

mikebrow approved these changes Mar 11, 2021

View reviewed changes

mikebrow merged commit ce8e8e8 into containerd:master Mar 11, 2021

thaJeztah deleted the split_runc_binary branch March 11, 2021 15:52

This was referenced Mar 11, 2021

[release/1.4] update to runc binary to v1.0.0-rc93, and decouple version from vendor.conf #5166

Merged

Prevent runc inheriting BUILDTAGS from containerd #5184

Merged

thaJeztah mentioned this pull request Apr 22, 2021

Update docker 20.10.6 linuxkit/linuxkit#3554

Merged

thaJeztah mentioned this pull request Feb 8, 2023

Don't check for apparmor_parser to be present #5519

Merged

thaJeztah mentioned this pull request Aug 1, 2023

[release/1.7] Update hcsshim tag to v0.10.0 #8903

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Separate runc binary version from libcontainer version, and remove obsolete build-tags #5036

Separate runc binary version from libcontainer version, and remove obsolete build-tags #5036

thaJeztah commented Feb 15, 2021 •

edited

Loading

theopenlab-ci bot commented Feb 15, 2021

thaJeztah commented Feb 15, 2021

estesp left a comment

mikebrow Feb 15, 2021

AkihiroSuda Feb 16, 2021

tghartland Mar 12, 2021

thaJeztah Mar 12, 2021

thaJeztah Mar 12, 2021

mikebrow Feb 15, 2021

mikebrow left a comment

dims Feb 16, 2021

mikebrow Feb 16, 2021

dims Feb 16, 2021

thaJeztah Mar 4, 2021

theopenlab-ci bot commented Mar 8, 2021

theopenlab-ci bot commented Mar 10, 2021

dims Mar 10, 2021

thaJeztah Mar 10, 2021

dims Mar 10, 2021

theopenlab-ci bot commented Mar 10, 2021

thaJeztah commented Mar 10, 2021

thaJeztah Mar 10, 2021

thaJeztah commented Mar 10, 2021

theopenlab-ci bot commented Mar 10, 2021

dims left a comment

thaJeztah commented Mar 10, 2021 •

edited

Loading

theopenlab-ci bot commented Mar 10, 2021

thaJeztah commented Mar 10, 2021

mikebrow left a comment

Separate runc binary version from libcontainer version, and remove obsolete build-tags #5036

Separate runc binary version from libcontainer version, and remove obsolete build-tags #5036

Conversation

thaJeztah commented Feb 15, 2021 • edited Loading

Remove references to apparmor and selinux buildtags for runc

Separate runc binary version from libcontainer version

move runc version to a separate file for easier consumption

theopenlab-ci bot commented Feb 15, 2021

thaJeztah commented Feb 15, 2021

estesp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mikebrow left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

theopenlab-ci bot commented Mar 8, 2021

theopenlab-ci bot commented Mar 10, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

theopenlab-ci bot commented Mar 10, 2021

thaJeztah commented Mar 10, 2021

Choose a reason for hiding this comment

thaJeztah commented Mar 10, 2021

theopenlab-ci bot commented Mar 10, 2021

dims left a comment

Choose a reason for hiding this comment

thaJeztah commented Mar 10, 2021 • edited Loading

theopenlab-ci bot commented Mar 10, 2021

thaJeztah commented Mar 10, 2021

mikebrow left a comment

Choose a reason for hiding this comment

thaJeztah commented Feb 15, 2021 •

edited

Loading

thaJeztah commented Mar 10, 2021 •

edited

Loading