TipsAndTricks/BuildingAndRunningClearContainersonTarget - Revision history

Bavery: /* DEPRECATED */

2017-10-19T22:25:15Z

DEPRECATED

← Older revision		Revision as of 22:25, 19 October 2017
Line 1:		Line 1:
	= <strong>DEPRECATED</strong> =		= <strong>DEPRECATED</strong> =
	<strong><p> There is now a http://git.yoctoproject.org/cgit/cgit.cgi/meta-intel-clear-containers/ layer that can be built as part of a standard YP build. </p></strong>		<strong><p> There is now a http://git.yoctoproject.org/cgit/cgit.cgi/meta-intel-clear-containers/ layer that can be built as part of a standard YP build. </p></strong>
			<br>
			<br>
			<br>
			<br>

			<br>

			= Historical value only =
	== What & Why ==		== What & Why ==
	Clear containers (CC) offer a hybrid solution that encompasses the advantages of hypervisor security and container deployment. So, we wanted to see if they could be used in a YP environment. This was done for Clear Containers 2.2 based on YP master around the time of 2.4 RC1/2.		Clear containers (CC) offer a hybrid solution that encompasses the advantages of hypervisor security and container deployment. So, we wanted to see if they could be used in a YP environment. This was done for Clear Containers 2.2 based on YP master around the time of 2.4 RC1/2.

Bavery: /* DEPRECATED */

2017-10-19T22:24:43Z

DEPRECATED

← Older revision		Revision as of 22:24, 19 October 2017
Line 1:		Line 1:
	= <strong>DEPRECATED<strong> =		= <strong>DEPRECATED</strong> =
	<strong><p> There is now a http://git.yoctoproject.org/cgit/cgit.cgi/meta-intel-clear-containers/ layer that can be built as part of a standard YP build. </p></strong>		<strong><p> There is now a http://git.yoctoproject.org/cgit/cgit.cgi/meta-intel-clear-containers/ layer that can be built as part of a standard YP build. </p></strong>

Bavery at 22:24, 19 October 2017

2017-10-19T22:24:33Z

← Older revision		Revision as of 22:24, 19 October 2017
Line 1:		Line 1:
			= <strong>DEPRECATED<strong> =
			<strong><p> There is now a http://git.yoctoproject.org/cgit/cgit.cgi/meta-intel-clear-containers/ layer that can be built as part of a standard YP build. </p></strong>

	== What & Why ==		== What & Why ==
	Clear containers (CC) offer a hybrid solution that encompasses the advantages of hypervisor security and container deployment. So, we wanted to see if they could be used in a YP environment. This was done for Clear Containers 2.2 based on YP master around the time of 2.4 RC1/2.		Clear containers (CC) offer a hybrid solution that encompasses the advantages of hypervisor security and container deployment. So, we wanted to see if they could be used in a YP environment. This was done for Clear Containers 2.2 based on YP master around the time of 2.4 RC1/2.

Todor Minchev: /* Configuring It */

2017-07-26T21:12:51Z

Configuring It

← Older revision		Revision as of 21:12, 26 July 2017
Line 126:		Line 126:
	{		{
	"vm": {		"vm": {
	"path": "/usr~~/local~~/bin/qemu-system-x86_64",		"path": "/usr/bin/qemu-system-x86_64",
	"image": "/usr/share/clear-containers/clear-containers.img",		"image": "/usr/share/clear-containers/clear-containers.img",
	"kernel": {		"kernel": {
Line 143:		Line 143:
	systemd.show_status=false cryptomgr.notests net.ifnames=0		systemd.show_status=false cryptomgr.notests net.ifnames=0
	* hypervisor.args defines how we start up the qemu hypervisor		* hypervisor.args defines how we start up the qemu hypervisor
	/usr~~/local~~/bin/qemu-system-x86_64		/usr/bin/qemu-system-x86_64
	-name		-name
	@NAME@		@NAME@

Todor Minchev: /* Building It */

2017-07-26T21:11:34Z

Building It

← Older revision		Revision as of 21:11, 26 July 2017
Line 185:		Line 185:
	mkdir build		mkdir build
	cd build		cd build
	../configure '--disable-tools' '--disable-libssh2' '--disable-tcmalloc' '--disable-glusterfs' '--disable-seccomp' '--disable-bzip2' '--disable-snappy' '--disable-lzo' '--disable-usb-redir' '--disable-libusb' '--disable-libnfs' '--disable-tcg-interpreter' '--disable-debug-tcg' '--disable-libiscsi' '--disable-rbd' '--disable-spice' '--disable-attr' '--disable-cap-ng' '--disable-linux-aio' '--disable-brlapi' '--disable-vnc-jpeg' '--disable-vnc-png' '--disable-vnc-sasl' '--disable-rdma' '--disable-bluez' '--disable-fdt' '--disable-curl' '--disable-curses' '--disable-sdl' '--disable-gtk' '--disable-tpm' '--disable-vte' '--disable-vnc' '--disable-xen' '--disable-opengl' '--disable-slirp' '--enable-trace-backend=nop' '--enable-virtfs' '--enable-attr' '--enable-cap-ng' '--extra-cflags=-Wno-format-truncation' '--target-list=x86_64-softmmu' "$@"		../configure '--prefix=/usr' '--disable-tools' '--disable-libssh2' '--disable-tcmalloc' '--disable-glusterfs' '--disable-seccomp' '--disable-bzip2' '--disable-snappy' '--disable-lzo' '--disable-usb-redir' '--disable-libusb' '--disable-libnfs' '--disable-tcg-interpreter' '--disable-debug-tcg' '--disable-libiscsi' '--disable-rbd' '--disable-spice' '--disable-attr' '--disable-cap-ng' '--disable-linux-aio' '--disable-brlapi' '--disable-vnc-jpeg' '--disable-vnc-png' '--disable-vnc-sasl' '--disable-rdma' '--disable-bluez' '--disable-fdt' '--disable-curl' '--disable-curses' '--disable-sdl' '--disable-gtk' '--disable-tpm' '--disable-vte' '--disable-vnc' '--disable-xen' '--disable-opengl' '--disable-slirp' '--enable-trace-backend=nop' '--enable-virtfs' '--enable-attr' '--enable-cap-ng' '--extra-cflags=-Wno-format-truncation' '--target-list=x86_64-softmmu' "$@"

	<!--		<!--

Todor Minchev: /* Building It */

2017-07-26T21:08:53Z

Building It

← Older revision		Revision as of 21:08, 26 July 2017
Line 185:		Line 185:
	mkdir build		mkdir build
	cd build		cd build
	../configure '--disable-tools' '--disable-libssh2' '--disable-tcmalloc' '--disable-glusterfs' '--disable-seccomp' '--disable-bzip2' '--disable-snappy' '--disable-lzo' '--disable-usb-redir' '--disable-libusb' '--disable-libnfs' '--disable-tcg-interpreter' '--disable-debug-tcg' '--disable-libiscsi' '--disable-rbd' '--disable-spice' '--disable-attr' '--disable-cap-ng' '--disable-linux-aio' '--disable-brlapi' '--disable-vnc-jpeg' '--disable-vnc-png' '--disable-vnc-sasl' '--disable-rdma' '--disable-bluez' '--disable-fdt' '--disable-curl' '--disable-curses' '--disable-sdl' '--disable-gtk' '--disable-tpm' '--disable-vte' '--disable-vnc' '--disable-xen' '--disable-opengl' '--disable-slirp' '--enable-trace-backend=nop' '--enable-virtfs' '--enable-attr' '--enable-cap-ng' '--target-list=x86_64-softmmu' "$@"		../configure '--disable-tools' '--disable-libssh2' '--disable-tcmalloc' '--disable-glusterfs' '--disable-seccomp' '--disable-bzip2' '--disable-snappy' '--disable-lzo' '--disable-usb-redir' '--disable-libusb' '--disable-libnfs' '--disable-tcg-interpreter' '--disable-debug-tcg' '--disable-libiscsi' '--disable-rbd' '--disable-spice' '--disable-attr' '--disable-cap-ng' '--disable-linux-aio' '--disable-brlapi' '--disable-vnc-jpeg' '--disable-vnc-png' '--disable-vnc-sasl' '--disable-rdma' '--disable-bluez' '--disable-fdt' '--disable-curl' '--disable-curses' '--disable-sdl' '--disable-gtk' '--disable-tpm' '--disable-vte' '--disable-vnc' '--disable-xen' '--disable-opengl' '--disable-slirp' '--enable-trace-backend=nop' '--enable-virtfs' '--enable-attr' '--enable-cap-ng' '--extra-cflags=-Wno-format-truncation' '--target-list=x86_64-softmmu' "$@"

			<!--
	In order to build it with gcc-7 (current YP compiler which is ahead of most/all std distros, I needed to <strong> HACK </strong> the following files:		In order to build it with gcc-7 (current YP compiler which is ahead of most/all std distros, I needed to <strong> HACK </strong> the following files:
	modified: ../block/blkdebug.c		modified: ../block/blkdebug.c
Line 260:		Line 261:
	snprintf(downstream->path, sizeof(downstream->path), "%d", portnr);		snprintf(downstream->path, sizeof(downstream->path), "%d", portnr);

	I verified with fprintf(stderr....) that these are not hit in typical usage. I also expect they will be upstream patched soon. Now we can do:		I verified with fprintf(stderr....) that these are not hit in typical usage. I also expect they will be upstream patched soon.
			-->
			Now we can do:
	make		make
	make install		make install
Line 273:		Line 276:

	The last line shows we can run qemu and have the machine available.		The last line shows we can run qemu and have the machine available.




	== Running Clear Containers ==		== Running Clear Containers ==

Todor Minchev: /* Configuring It */

2017-07-25T23:38:58Z

Configuring It

← Older revision		Revision as of 23:38, 25 July 2017
Line 143:		Line 143:
	systemd.show_status=false cryptomgr.notests net.ifnames=0		systemd.show_status=false cryptomgr.notests net.ifnames=0
	* hypervisor.args defines how we start up the qemu hypervisor		* hypervisor.args defines how we start up the qemu hypervisor
	/usr/bin/qemu-system-x86_64		/usr/local/bin/qemu-system-x86_64
	-name		-name
	@NAME@		@NAME@

Todor Minchev: /* Configuring It */

2017-07-25T23:38:30Z

Configuring It

← Older revision		Revision as of 23:38, 25 July 2017
Line 126:		Line 126:
	{		{
	"vm": {		"vm": {
	"path": "/usr/bin/qemu-system-x86_64",		"path": "/usr/local/bin/qemu-system-x86_64",
	"image": "/usr/share/clear-containers/clear-containers.img",		"image": "/usr/share/clear-containers/clear-containers.img",
	"kernel": {		"kernel": {
Line 175:		Line 175:

	I capped it at 1G for now. This setting would definitely need to be tweaked depending on needs/usage...		I capped it at 1G for now. This setting would definitely need to be tweaked depending on needs/usage...

	===The Qemu Hypervisor ===		===The Qemu Hypervisor ===
	==== Getting the Source Code ====		==== Getting the Source Code ====

Bavery: /* Additional Dependencies to Bitbake */

2017-07-13T22:01:13Z

Additional Dependencies to Bitbake

← Older revision		Revision as of 22:01, 13 July 2017
Line 47:		Line 47:

	=== Additional Dependencies to Bitbake ===		=== Additional Dependencies to Bitbake ===
	These are the additional recipes I built in addition to the base I outlined above. They could be added all at once in the local.conf, if you want.		These are the additional recipes I built in addition to the base I outlined above. They could be added all at once in the local.conf, if you want by doing a
			IMAGE_INSTALL_append += libcheck mdadm psmisc json-glib libmnl ossp-uuid autoconf-archive python-setuptools libcap-ng tunctl go wget sudo
	bitbake libcheck mdadm psmisc json-glib libmnl ossp-uuid autoconf-archive python-setuptools libcap-ng tunctl go wget sudo		bitbake libcheck mdadm psmisc json-glib libmnl ossp-uuid autoconf-archive python-setuptools libcap-ng tunctl go wget sudo
	These are additional packages I built for convenience, but they are not required:		These are additional packages I built for convenience, but they are not required:

Bavery: /* Debugging */

2017-07-08T18:06:57Z

Debugging

← Older revision		Revision as of 18:06, 8 July 2017
Line 348:		Line 348:
	=== Debugging ===		=== Debugging ===
	There is a lot of debugging information on the CC site, so I won't repeat it here. I used 3 main things when I was debugging this:		There is a lot of debugging information on the CC site, so I won't repeat it here. I used 3 main things when I was debugging this:
	* the stderr/stdout for the proxy.		* the stderr/stdout for the proxy.
	* the CC runtime log /run/cc-oci-runtime/cc-oci-runtime.log		* the CC runtime log /run/cc-oci-runtime/cc-oci-runtime.log
	* I also added an additional debug to the /usr/bin/cc-oci-runtime.sh. I added debugging for the hypervisor itself.		* I also added an additional debug to the /usr/bin/cc-oci-runtime.sh. I added debugging for the hypervisor itself.
	# mkdir /tmp/hypervisor		# mkdir /tmp/hypervisor
	# diff /usr/bin/cc-oci-runtime.sh /usr/bin/cc-oci-runtime.sh.orig		# diff /usr/bin/cc-oci-runtime.sh /usr/bin/cc-oci-runtime.sh.orig