-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support rootless containerd worker #2660
Conversation
// These compression types aren't supported by containerd differ. So try to compute diff on buildkit side. | ||
// This case can be happen on containerd worker + non-overlayfs snapshotter (e.g. native). | ||
// See also: https://github.com/containerd/containerd/issues/4263 | ||
desc, err = walking.NewWalkingDiff(sr.cm.ContentStore).Compare(ctx, lower, upper, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe this should be in a separate commit
docs/rootless.md
Outdated
Run containerd in rootless mode using rootlesskit following [containerd's document](https://github.com/containerd/containerd/blob/main/docs/rootless.md). | ||
|
||
``` | ||
$ rootlesskit --copy-up=/run --state-dir=/path/to/rootlesskit-state-dir containerd -c config.toml |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is a "hard way".
I'd recommend using containerd-rootless.sh
docs/rootless.md
Outdated
``` | ||
$ nsenter -U --preserve-credentials -m -t $(cat /path/to/rootlesskit-state-dir/child_pid) \ | ||
buildkitd --oci-worker=false --containerd-worker=true --containerd-worker-snapshotter=native \ | ||
--containerd-worker-addr=/run/user/1001/containerd/containerd.sock |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
containerd-rootless-setuptool.sh nsenter -- buildkitd ...
is easier.
docs/rootless.md
Outdated
@@ -65,6 +92,8 @@ See https://rootlesscontaine.rs/getting-started/common/subuid/ | |||
|
|||
## Containerized deployment | |||
|
|||
* Only supported by OCI worker |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why?
if cfg.Rootless { | ||
logrus.Debugf("running in rootless mode") | ||
if common.config.Workers.Containerd.NetworkConfig.Mode == "auto" { | ||
common.config.Workers.Containerd.NetworkConfig.Mode = "host" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You can use CNI when you have CAP_NET_ADMIN
in the current namespace, e.g., when RootlessKit is running with slirp4netns/VPNkit/lxc-user-nic/whatever.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
(OCI worker should be updated to support CNI too, so it can be a separate commit/PR)
Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
…napshotter Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
44e64e3
to
393bc5b
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks
@@ -99,6 +99,8 @@ type ContainerdConfig struct { | |||
ApparmorProfile string `toml:"apparmor-profile"` | |||
|
|||
MaxParallelism int `toml:"max-parallelism"` | |||
|
|||
Rootless bool `toml:"rootless"` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shouldn't containerd expose if it is running in rootless mode?
Fixes #1325
This commit adds support for rootless containerd worker.
This also enables integration tests for rootless containerd worker configuration.
Example configuration
Rootless containerd can run using rootlesskit following containerd's document.
Example
config.toml
:Then buildkitd can join the same namespace as containerd.