<div id="readability-page-1" class="page"><div>
	      

<p><span>May 13, 2021</span>

<span>v1.0</span></p><p>CLI tool for spawning and running containers according to the OCI specification</p>

<ul>
  <li>CLI (Command Line Interface) tool : runc는 커맨드라인툴 이구나</li>
  <li>spawning (산란하다) : 왜 spawn이라는 표현을 썼을까?
    <ul>
      <li>process가 child를 만드는 전통적인 방법은 fork  : 부모의 모든 것을 복제해서 만드는 방법</li>
      <li>fork의 단점은 모든 것을 물려주려다 보니 무겁다는 것 (오버헤드)
        <ul>
          <li>그리고 바로 exec 하는 경우(fork-exec) 복제한 걸 쓰지도 않아 너무도 아깝다는 것 (비효율)</li>
        </ul>
      </li>
      <li>그래서 fork-exec 보다 세밀한 조작과 선택적 복제를 지원하는 방법을 고안</li>
      <li>posix_spawn : fork-exec + 선택적 복제를 지원</li>
      <li>Container Spawning : 컨테이너를 (새로) “생성”의 의미
        <ul>
          <li>Forking은 “복제”의 의미</li>
        </ul>
      </li>
    </ul>
  </li>
  <li>OCI (Open Container Initiative) Runtime Spec.
    <ul>
      <li>컨테이너 포맷과 런타임에 대한 개방형 산업 표준</li>
      <li><a href="https://opencontainers.org/about/overview/">https://opencontainers.org/about/overview/</a></li>
      <li>runtime-spec : how to run  a “filesystem bundle”
        <ul>
          <li>OCI implementation —(download) —&gt; OCI Image</li>
          <li>OCI Image —(unpack)—&gt; OCI Runtime filesystem bundle</li>
          <li>OCI Runtime —(run)—&gt; OCI Runtime filesystem bundle</li>
          <li>this entire workflow should support the UX users have come to expect from container engines (docker, rkt)</li>
        </ul>
      </li>
      <li>image-spec</li>
    </ul>
  </li>
</ul>

<p>Release:  <a href="https://github.com/opencontainers/runc/releases">https://github.com/opencontainers/runc/releases</a></p>

<p>Goal</p>

<ul>
  <li>The goal of runc is to make standard containers available everywhere.
    <ul>
      <li>runc의 목표는 어디서나 사용가능한 표준 컨테이너를 만드는 것이다.</li>
    </ul>
  </li>
</ul>

<p>Features</p>

<ul>
  <li>Full support Linux namespaces including user namespaces</li>
  <li>Native support for all security features available in Linux —&gt; If linux can do it, runc can do it
    <ul>
      <li>Selinux</li>
      <li>Apparmor</li>
      <li>seccomp</li>
      <li>control groups</li>
      <li>capability drop</li>
      <li>pivot_root</li>
      <li>uid/gid dropping</li>
    </ul>
  </li>
  <li>Native support for live migration, /w the help of the <strong>CRIU</strong> team at Parallels</li>
  <li>Native support for Windows 10 containers is being contributed directly by MS engineers</li>
  <li>Planned native support for Arm, Power, Sparc /w direct participation and support from Arm, Intel, Qualcomm, IBM, and the entire hardware manufacturers ecosystem.</li>
  <li>Planned native support for bleeding edge hardware features - DPDK, sr-iov, tpm, secure enclave, etc.</li>
  <li>Portable performance profiles, contributed by Google engineers based on their experience deploying containers in production.</li>
  <li>A formally specified configuration format, governed by the Open Container Project under the auspices of the Linux Foundation. In other words: it’s a real standard.</li>
</ul>

<h2 id="실습-준비">실습 준비</h2>

<p>git 참고: <a href="https://github.com/opencontainers/runc">https://github.com/opencontainers/runc</a></p>

<h3 id="pre-requisite-ubuntu-1804-기준">Pre-requisite (ubuntu 18.04 기준)</h3>

<p>Golang 설치 (golang-go 13+)</p>

<div><pre><code>curl <span>-O</span> https://storage.googleapis.com/golang/go1.15.7.linux-amd64.tar.gz <span>&gt;</span> /dev/null 2&gt;&amp;1
<span>tar </span>xf go1.15.7.linux-amd64.tar.gz
<span>sudo mv </span>go /usr/local/
<span>echo</span> <span>"PATH=</span><span>$PATH</span><span>:/usr/local/go/bin"</span> | <span>tee</span> ~/.bash_profile
<span>source</span> ~/.bash_profile
</code></pre></div>

<h3 id="gcc-설치">gcc 설치</h3>

<div><pre><code><span>sudo </span>apt update <span>&amp;&amp;</span> <span>sudo </span>apt <span>install </span>gcc
</code></pre></div>

<h3 id="make-설치">make 설치</h3>



<h3 id="pkg-config-설치">pkg-config 설치</h3>

<div><pre><code><span>sudo </span>apt <span>install </span>pkg-config

pkg-config: <span>exec</span>: <span>"pkg-config"</span>: executable file not found <span>in</span> <span>$PATH</span>
</code></pre></div>

<h3 id="libseccomp-dev-설치">libseccomp-dev 설치</h3>

<div><pre><code><span>sudo </span>apt <span>install </span>libseccomp-dev
</code></pre></div>

<p>seccomp (secure computing mode) ? 리눅스 보안 메커니즘. linux sandbox 기반 “시스템콜 허용/차단”</p>

<h3 id="git-clone-runc">git clone (runc)</h3>

<div><pre><code>git clone https://github.com/opencontainers/runc
</code></pre></div>

<h3 id="build">Build</h3>

<div><pre><code><span>sudo</span> <span>-Es</span>
<span>cd </span>runc
make
make <span>install</span>
</code></pre></div>

<h3 id="test">Test</h3>



<ul>
  <li>test 를 돌리려면 docker 설치 필요</li>
  <li>일반 계정에서 수행하려면 docker 그룹 권한 필요</li>
</ul>

<hr>

<h2 id="실습">실습</h2>

<h3 id="creating-an-oci-bundles">Creating an OCI Bundles</h3>

<div><pre><code><span>mkdir</span> /mycontainer
<span>cd</span> /mycontainer
<span>mkdir </span>rootfs
docker <span>export</span> <span>$(</span>docker create busybox<span>)</span> | <span>tar</span> <span>-C</span> rootfs <span>-xvf</span> -
runc spec
<span>cat </span>config.json
</code></pre></div>

<ul>
  <li>docker export <container></container></li>
  <li>docker create </li>
  <li>runc spec : create a new “specification file” : The spec command creates the new specification file named “config.json” for the bundle.</li>
</ul>

<h3 id="running-containers">Running Containers</h3>

<div><pre><code><span>cd</span> /mycontainer
runc run mycontainerid
</code></pre></div>

<ul>
  <li>runc run : create and start a container</li>
</ul>

<h3 id="w-lifecycle-operations">/w lifecycle operations</h3>

<div><pre><code>vi config.json
<span>### . . .</span>
  <span>"terminal"</span>: <span>false</span>,
<span>### . . .</span>
  <span>"args"</span>: <span>[</span>
    <span>"sleep"</span>, <span>"5"</span>
  <span>]</span>
<span>### . . .</span>

<span>cd</span> /mycontainer
runc create mycontainerid
runc list
runc start mycontainerid
runc list
runc delete mycontainerid
</code></pre></div>

<ul>
  <li>create, start, stop, delete 등 lifecycle 단계를 구분: 상위 시스템에서 쉽게 각 단계 사이에 로직 삽입 가능</li>
  <li>예) 네트웍 셋업을 컨테이너의 생성과 기동 사이에 처리</li>
</ul>

<h3 id="rootless-containers">Rootless containers</h3>

<p>root 권한 없이도 “일반 계정으로 컨테이너를 생성”</p>

<div><pre><code><span>mkdir</span> ~/mycontainer
<span>cd</span> ~/mycontainer
<span>mkdir </span>rootfs
docker <span>export</span> <span>$(</span>docker create busybox<span>)</span> | <span>tar</span> <span>-C</span> rootfs <span>-xvf</span> -
runc spec <span>--rootless</span>
runc <span>--root</span> /tmp/runc run mycontainerid
</code></pre></div>

<p>확인</p>

<div><pre><code><span>cat</span> /proc/sys/kernel/unprivileged_userns_clone
<span>echo </span>1 <span>&gt;</span> /proc/sys/kernel/unprivileged_userns_clone
</code></pre></div>

<h3 id="supervisor">supervisor</h3>

<div><pre><code>vi /etc/systemd/system/runc.service

<span>[</span>Unit]
<span>Description</span><span>=</span>Start my container

<span>[</span>Service]
<span>Type</span><span>=</span>forking
<span>ExecStart</span><span>=</span>/usr/local/sbin/runc run <span>-d</span> <span>--pid-file</span> /run/mycontainerid.pid mycontainerid
<span>ExecStopPost</span><span>=</span>/usr/local/sbin/runc delete mycontainerid
<span>WorkingDirectory</span><span>=</span>/mycontainer
<span>PIDFile</span><span>=</span>/run/mycontainerid.pid
<span>Restart</span><span>=</span>always
<span>RestartSec</span><span>=</span>10

<span>[</span>Install]
<span>WantedBy</span><span>=</span>multi-user.target

<span>### 적용 및 리스타트</span>
systemctl daemon-reload
systemctl start runc.service
</code></pre></div>

<ul>
  <li>config.json: terminal mode를 false 해줄 것</li>
</ul>

<div><pre><code>vi config.json

<span>### . . .</span>
<span>"process"</span>: <span>{</span>
  <span>"terminal"</span> : <span>false</span> 
<span>}</span>
<span>### . . .</span>
</code></pre></div>











	
              

               
           </div></div>

netpple

CLI tool for spawning and running containers according to the OCI specification
CLI (Command Line Interface) tool : runc는 커맨드라인툴 이구나
spawning (산란하다) : 왜 spawn이라는 표현을 썼을까?
    
process가 child를 만드는 전통적인 방법은 fork  : 부모의 모든 것을 복제해서 만드는 방법
fork의 단점은 모든 것을 물려주려다 보니 무겁다는 것 (오버헤드)
        
그리고 바로 exec 하는 경우(fork-exec) 복제한 걸 쓰지도 않아 너무도 아깝다는 것 (비효율)
그래서 fork-exec 보다 세밀한 조작과 선택적 복제를 지원하는 방법을 고안
posix_spawn : fork-exec + 선택적 복제를 지원
Container Spawning : 컨테이너를 (새로) “생성”의 의미
        
Forking은 “복제”의 의미
OCI (Open Container Initiative) Runtime Spec.
    
컨테이너 포맷과 런타임에 대한 개방형 산업 표준
https://opencontainers.org/about/overview/
runtime-spec : how to run  a “filesystem bundle”
        
OCI implementation —(download) —> OCI Image
OCI Image —(unpack)—> OCI Runtime filesystem bundle
OCI Runtime —(run)—> OCI Runtime filesystem bundle
this entire workflow should support the UX users have come to expect from container engines (docker, rkt)
image-spec
Release:  https://github.com/opencontainers/runc/releases
Goal
The goal of runc is to make standard containers available everywhere.
    
runc의 목표는 어디서나 사용가능한 표준 컨테이너를 만드는 것이다.
Features
Full support Linux namespaces including user namespaces
Native support for all security features available in Linux —> If linux can do it, runc can do it
    
Selinux
Apparmor
seccomp
control groups
capability drop
pivot_root
uid/gid dropping
Native support for live migration, /w the help of the CRIU team at Parallels
Native support for Windows 10 containers is being contributed directly by MS engineers
Planned native support for Arm, Power, Sparc /w direct participation and support from Arm, Intel, Qualcomm, IBM, and the entire hardware manufacturers ecosystem.
Planned native support for bleeding edge hardware features - DPDK, sr-iov, tpm, secure enclave, etc.
Portable performance profiles, contributed by Google engineers based on their experience deploying containers in production.
A formally specified configuration format, governed by the Open Container Project under the auspices of the Linux Foundation. In other words: it’s a real standard.
실습 준비
git 참고: https://github.com/opencontainers/runc
Pre-requisite (ubuntu 18.04 기준)
Golang 설치 (golang-go 13+)
curl -O https://storage.googleapis.com/golang/go1.15.7.linux-amd64.tar.gz > /dev/null 2>&1
tar xf go1.15.7.linux-amd64.tar.gz
sudo mv go /usr/local/
echo "PATH=$PATH:/usr/local/go/bin" | tee ~/.bash_profile
source ~/.bash_profile
gcc 설치
sudo apt update && sudo apt install gcc
make 설치
sudo apt install make
pkg-config 설치
sudo apt install pkg-config
pkg-config: exec: "pkg-config": executable file not found in $PATH
libseccomp-dev 설치
sudo apt install libseccomp-dev
seccomp (secure computing mode) ? 리눅스 보안 메커니즘. linux sandbox 기반 “시스템콜 허용/차단”
git clone (runc)
git clone https://github.com/opencontainers/runc
Build
sudo -Es
cd runc
make
make install
Test
make test
test 를 돌리려면 docker 설치 필요
일반 계정에서 수행하려면 docker 그룹 권한 필요
실습
Creating an OCI Bundles
mkdir /mycontainer
cd /mycontainer
mkdir rootfs
docker export $(docker create busybox) | tar -C rootfs -xvf -
runc spec
cat config.json
docker export 
docker create 
runc spec : create a new “specification file” : The spec command creates the new specification file named “config.json” for the bundle.
Running Containers
cd /mycontainer
runc run mycontainerid
runc run : create and start a container
/w lifecycle operations
vi config.json
### . . .
  "terminal": false,
### . . .
  "args": [
    "sleep", "5"
  ]
### . . .
cd /mycontainer
runc create mycontainerid
runc list
runc start mycontainerid
runc list
runc delete mycontainerid
create, start, stop, delete 등 lifecycle 단계를 구분: 상위 시스템에서 쉽게 각 단계 사이에 로직 삽입 가능
예) 네트웍 셋업을 컨테이너의 생성과 기동 사이에 처리
Rootless containers
root 권한 없이도 “일반 계정으로 컨테이너를 생성”
mkdir ~/mycontainer
cd ~/mycontainer
mkdir rootfs
docker export $(docker create busybox) | tar -C rootfs -xvf -
runc spec --rootless
runc --root /tmp/runc run mycontainerid
확인
cat /proc/sys/kernel/unprivileged_userns_clone
echo 1 > /proc/sys/kernel/unprivileged_userns_clone
supervisor
vi /etc/systemd/system/runc.service
[Unit]
Description=Start my container
[Service]
Type=forking
ExecStart=/usr/local/sbin/runc run -d --pid-file /run/mycontainerid.pid mycontainerid
ExecStopPost=/usr/local/sbin/runc delete mycontainerid
WorkingDirectory=/mycontainer
PIDFile=/run/mycontainerid.pid
Restart=always
RestartSec=10
[Install]
WantedBy=multi-user.target
### 적용 및 리스타트
systemctl daemon-reload
systemctl start runc.service
config.json: terminal mode를 false 해줄 것
vi config.json
### . . .
"process": {
  "terminal" : false 
}
### . . .

RunC

댓글