Introducing Solaris in OCI #411
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,116 @@ | ||
| # Solaris Application Container Configuration | ||
|
|
||
| Solaris application containers can be configured using the following properties, all of the below properties have mappings to properties specified under zonecfg(1M) man page, except milestone. | ||
| The Solaris specification is entirely optional. | ||
|
|
||
| ## milestone | ||
| The SMF(Service Management Facility) FMRI which should go to "online" state before we start the desired process within the container. | ||
|
|
||
| **`milestone`** *(string, optional)* | ||
|
|
||
| ### Example | ||
| ```json | ||
| "milestone": "svc:/milestone/container:default" | ||
| ``` | ||
|
|
||
| ## limitpriv | ||
| The maximum set of privileges any process in this container can obtain. | ||
| The property should consist of a comma-separated privilege set specification as described in priv_str_to_set(3C) man page for the respective release of Solaris. | ||
|
|
||
| **`limitpriv`** *(string, optional)* | ||
|
|
||
| ### Example | ||
| ```json | ||
| "limitpriv": "default" | ||
| ``` | ||
|
|
||
| ## maxShmMemory | ||
| The maximum amount of shared memory allowed for this application container. | ||
| A scale (K, M, G, T) can be applied to the value for each of these numbers (for example, 1M is one megabyte). | ||
| Mapped to max-shm-memory in zonecfg(1M) man page. | ||
|
|
||
| **`maxShmMemory`** *(string, optional)* | ||
|
|
||
| ### Example | ||
| ```json | ||
| "maxShmMemory": "512m" | ||
| ``` | ||
|
|
||
| ## cappedCPU | ||
| Sets a limit on the amount of CPU time that can be used by a container. | ||
| The unit used translates to the percentage of a single CPU that can be used by all user threads in a container, expressed as a fraction (for example, .75) or a mixed number (whole number and fraction, for example, 1.25). | ||
| An ncpu value of 1 means 100% of a CPU, a value of 1.25 means 125%, .75 mean 75%, and so forth. | ||
| When projects within a capped container have their own caps, the minimum value takes precedence. | ||
| cappedCPU is mapped to capped-cpu in zonecfg(1M) man page. | ||
|
|
||
| * **`ncpus`** *(string, optional)* | ||
|
|
||
| ### Example | ||
| ```json | ||
| "cappedCPU": { | ||
| "ncpus": "8" | ||
| } | ||
| ``` | ||
|
|
||
| ## cappedMemory | ||
| The physical and swap caps on the memory that can be used by this application container. | ||
| A scale (K, M, G, T) can be applied to the value for each of these numbers (for example, 1M is one megabyte). | ||
| cappedMemory is mapped to capped-memory in zonecfg(1M) man page. | ||
|
|
||
| * **`physical`** *(string, optional)* | ||
| * **`swap`** *(string, optional)* | ||
|
|
||
| ### Example | ||
| ```json | ||
| "cappedMemory": { | ||
| "physical": "512m", | ||
| "swap": "512m" | ||
| } | ||
| ``` | ||
|
|
||
| ## Network | ||
|
|
||
| ### Automatic Network (anet) | ||
| anet is specified as an array that is used to setup networking for Solaris application containers. | ||
| The anet resource represents the automatic creation of a network resource for an application container. | ||
| The zones administration daemon, zoneadmd, is the primary process for managing the container's virtual platform. | ||
| One of the daemons is responsibilities is creation and teardown of the networks for the container. | ||
| For more information on the daemon check the zoneadmd(1M) man page. | ||
| When such a container is started, a temporary VNIC(Virtual NIC) is automatically created for the container. | ||
| The VNIC is deleted when the container is torn down. | ||
| The following properties can be used to setup automatic networks. | ||
| For additional information on properties check zonecfg(1M) man page for the respective release of Solaris. | ||
|
|
||
| * **`linkname`** *(string, optional)* Specify a name for the automatically created VNIC datalink. | ||
| * **`lowerLink`** *(string, optional)* Specify the link over which the VNIC will be created. | ||
| Mapped to lower-link in the zonecfg(1M) man page. | ||
| * **`allowedAddress`** *(string, optional)* The set of IP addresses that the container can use might be constrained by specifying the allowedAddress property. | ||
| If allowedAddress has not been specified, then they can use any IP address on the associated physical interface for the network resource. | ||
| Otherwise, when allowedAddress is specified, the container cannot use IP addresses that are not in the allowedAddress list for the physical address. | ||
| Mapped to allowed-address in the zonecfg(1M) man page. | ||
| * **`configureAllowedAddress`** *(string, optional)* If configureAllowedAddress is set to true, the addresses specified by allowedAddress are automatically configured on the interface each time the container starts. | ||
| When it is set to false, the allowedAddress will not be configured on container start. | ||
| Mapped to configure-allowed-address in the zonecfg(1M) man page. | ||
| * **`defrouter`** *(string, optional)* The value for the optional default router. | ||
| * **`macAddress`** *(string, optional)* Set the VNIC's MAC addresses based on the specified value or keyword. | ||
| If not a keyword, it is interpreted as a unicast MAC address. | ||
| For a list of the supported keywords please refer to the zonecfg(1M) man page of the respective Solaris release. | ||
| Mapped to mac-address in the zonecfg(1M) man page. | ||
| * **`linkProtection`** *(string, optional)* Enables one or more types of link protection using comma-separated values. | ||
| See the protection property in dladm(8) for supported values in respective release of Solaris. | ||
| Mapped to link-protection in the zonecfg(1M) man page. | ||
|
|
||
| #### Example | ||
| ```json | ||
| "anet": [ | ||
| { | ||
| "allowedAddress": "172.17.0.2/16", | ||
| "configureAllowedAddress": "true", | ||
| "defrouter": "172.17.0.1/16", | ||
| "linkProtection": "mac-nospoof, ip-nospoof", | ||
| "linkname": "net0", | ||
| "lowerLink": "net2", | ||
| "macAddress": "02:42:f8:52:c7:16" | ||
| } | ||
| ] | ||
| ``` | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -108,16 +108,18 @@ For more information about SELinux, see [Selinux documentation](http://selinuxp | |
|
|
||
| The user for the process is a platform-specific structure that allows specific control over which user the process runs as. | ||
|
|
||
| #### Linux and Solaris User | ||
|
|
||
| For Linux and Solaris based systems the user structure has the following fields: | ||
|
|
||
| * **`uid`** (int, required) specifies the user id. | ||
| * **`gid`** (int, required) specifies the group id. | ||
| * **`additionalGids`** (array of ints, optional) specifies additional group ids to be added to the process. | ||
|
|
||
| _Note: symbolic name for uid and gid, such as uname and gname respectively, are left to upper levels to derive (i.e. `/etc/passwd` parsing, NSS, etc)_ | ||
|
|
||
| _Note: For Solaris, uid and gid specify the uid and gid of the process inside the container and need not be same as in the host._ | ||
|
There was a problem hiding this comment. This is also true for Linux. Instead of this note, I've filed #412 to make this explicit for both platforms. |
||
|
|
||
| ### Example (Linux) | ||
|
|
||
| ```json | ||
|
|
@@ -153,6 +155,26 @@ _Note: symbolic name for uid and gid, such as uname and gname respectively, are | |
| ] | ||
| } | ||
| ``` | ||
| ### Example (Solaris) | ||
|
|
||
| ```json | ||
| "process": { | ||
| "terminal": true, | ||
| "user": { | ||
| "uid": 1, | ||
| "gid": 1, | ||
| "additionalGids": [2, 8] | ||
| }, | ||
| "env": [ | ||
| "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", | ||
| "TERM=xterm" | ||
| ], | ||
| "cwd": "/root", | ||
| "args": [ | ||
| "/usr/bin/bash" | ||
| ], | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
| ## Hostname | ||
|
|
@@ -608,6 +630,29 @@ Here is a full example `config.json` for reference. | |
| ], | ||
| "mountLabel": "system_u:object_r:svirt_sandbox_file_t:s0:c715,c811" | ||
| }, | ||
| "solaris": { | ||
|
There was a problem hiding this comment. We need a better way to handle this, because putting a There was a problem hiding this comment. I was under the impression that we could have all platform specified as such in config.json . The runtime would only parse the required fields based on image and/or the platform section of the config.json. There was a problem hiding this comment. On Fri, Apr 29, 2016 at 11:19:26AM -0700, Abhijeeth Nuthan wrote:
For previous multi-platform config discussion, see #73, #74, and #76. |
||
| "anet": [ | ||
| { | ||
| "allowedAddress": "172.17.0.2/16", | ||
| "configureAllowedAddress": "true", | ||
| "defrouter": "172.17.0.1/16", | ||
| "linkProtection": "mac-nospoof, ip-nospoof", | ||
| "linkname": "net0", | ||
| "lowerLink": "net2", | ||
| "macAddress": "02:42:f8:52:c7:16" | ||
| } | ||
| ], | ||
| "cappedCPU": { | ||
| "ncpus": "0.8" | ||
| }, | ||
| "cappedMemory": { | ||
| "physical": "1G", | ||
| "swap": "512m" | ||
| }, | ||
| "maxShmMemory": "256m", | ||
| "limitpriv": "default", | ||
| "milestone": "svc:/milestone/container:default" | ||
| }, | ||
| "annotations": { | ||
| "key1": "value1", | ||
| "key2": "value2" | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| { | ||
| "solaris": { | ||
| "description": "Solaris platform-specific configurations", | ||
| "id": "https://opencontainers.org/schema/bundle/solaris", | ||
| "type": "object", | ||
| "properties": { | ||
| "milestone": { | ||
| "id": "https://opencontainers.org/schema/bundle/solaris/milestone", | ||
| "type": "string" | ||
| }, | ||
| "limitpriv": { | ||
| "id": "https://opencontainers.org/schema/bundle/solaris/limitpriv", | ||
| "type": "string" | ||
| }, | ||
| "maxShmMemory": { | ||
| "id": "https://opencontainers.org/schema/bundle/solaris/maxShmMemory", | ||
| "type": "string" | ||
| }, | ||
| "cappedCPU": { | ||
| "id": "https://opencontainers.org/schema/bundle/solaris/cappedCPU", | ||
| "$ref": "defs.json#/definitions/mapStringString" | ||
|
There was a problem hiding this comment. This is accurate, but it could be more specific if you explicitly lists allowed keys. That can happen with a separate definition or inline. There was a problem hiding this comment. This is just the initial PR, we will expand(more properties to come) and make it more structured in the future. For now, I think this would be fine. There was a problem hiding this comment. On Fri, Apr 29, 2016 at 11:15:24AM -0700, Abhijeeth Nuthan wrote:
Sounds good to me. |
||
| }, | ||
| "cappedMemory": { | ||
| "id": "https://opencontainers.org/schema/bundle/solaris/cappedMemory", | ||
| "$ref": "defs.json#/definitions/mapStringString" | ||
| }, | ||
| "anet": { | ||
| "id": "https://opencontainers.org/schema/bundle/solaris/anet", | ||
| "type": "array", | ||
| "items": { | ||
| "$ref": "defs.json#/definitions/mapStringString" | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Docs for
capped-cpu? For an example of this sort of nesting in the Linux docs, see here.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For every property , the documentation is zonecfg(1M) man page for that release of solaris, except "milestone" (which has no other docs apart from the explanation) . Same is mentioned at the top of the file. I did not see a need to call it out for each specific property.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
On Fri, Apr 29, 2016 at 11:09:04AM -0700, Abhijeeth Nuthan wrote:
Right. I just meant “why list ncpus, but not capped-cpu?”.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We want to keep the configuration same for all our flavors of virtualization. It's been this way for eons. So just continuing down that path made logical sense.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
On Fri, Apr 29, 2016 at 11:22:23AM -0700, Abhijeeth Nuthan wrote:
I don't think I'm suggesting anything major, just:
capped-cpu(object, optional) The following properties can be used to cap CPU usage:ncpus(string, optional)There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If renaming is an option, why not just
cpus:) ?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@wking : I'm assuming you are suggesting adding an (object, optional) for capped-cpu and capped-memory, etc. That would require rework for all the properties even in config-linux.md . I prefer not to do that in this PR.
@vishh : Sorry can't change names for legacy reasons.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
On Fri, Apr 29, 2016 at 01:08:38PM -0700, Abhijeeth Nuthan wrote:
I feel like we can work towards that goal in baby steps instead of
shifting everything at once. But yeah, if it doesn't feel right to
you, we can certainly defer until someone is bothered enough to PR the
change.