Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support --writable-tmpfs for --oci mode #1621

Closed
Tracked by #1467
dtrudg opened this issue May 2, 2023 · 0 comments · Fixed by #1622
Closed
Tracked by #1467

Support --writable-tmpfs for --oci mode #1621

dtrudg opened this issue May 2, 2023 · 0 comments · Fixed by #1622
Assignees
@dtrudg
Milestone
SingularityCE 4.0.0

Comments

@dtrudg
Copy link
Member

dtrudg commented May 2, 2023 •
edited
Loading

The --oci mode is currently aiming to offer similar sematics as the native runtime used with its --compat option.

One of the options that is enabled by the --compat flag is --writable-tmpfs, where the container rootfs is made writable by overlaying a writable tmpfs.

The --oci mode should support this tmpfs overlay, and it should be enabled by default to match the --compat behaviour in the native runtime.

Because the tmpfs mount and overlay must be setup within a user namespace, for non-root users, this will require wrapping the incovation of runc/crun with prep / cleanup code.

Let's do this in a naive manner at this point. We'll tidy things up once additional prep / cleanup steps have been identified and scoped.
@dtrudg dtrudg mentioned this issue May 2, 2023
Closed
19 tasks
@dtrudg dtrudg self-assigned this May 2, 2023
@dtrudg dtrudg added this to the SingularityCE 4.0 milestone May 2, 2023
dtrudg added a commit to dtrudg/singularity that referenced this issue May 2, 2023
@dtrudg
oci: Enable --writable-tmpfs behaviour by default
2fcd872 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to callin `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs#1621
@dtrudg dtrudg mentioned this issue May 2, 2023
Merged
dtrudg added a commit to dtrudg/singularity that referenced this issue May 2, 2023
@dtrudg
oci: Enable --writable-tmpfs behaviour by default
660bfad 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs#1621
dtrudg added a commit to dtrudg/singularity that referenced this issue May 2, 2023
@dtrudg
oci: Enable --writable-tmpfs behaviour by default
ed954b9 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs#1621
dtrudg added a commit to dtrudg/singularity that referenced this issue May 2, 2023
@dtrudg
oci: Enable --writable-tmpfs behaviour by default
9b97d65 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs#1621
dtrudg added a commit to dtrudg/singularity that referenced this issue May 3, 2023
@dtrudg
oci: Enable --writable-tmpfs behaviour by default (release-3.11)
9e8fd5d 
Pick sylabs#1622

The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs#1621
@dtrudg dtrudg mentioned this issue May 3, 2023
Merged
edytuk pushed a commit to vzokay/apptainer that referenced this issue May 10, 2023
@dtrudg @edytuk
oci: Enable --writable-tmpfs behaviour by default
ec1c416 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs/singularity#1621

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue May 10, 2023
@dtrudg @edytuk
oci: Enable --writable-tmpfs behaviour by default
6a29d5d 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs/singularity#1621

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue May 24, 2023
@dtrudg @edytuk
oci: Enable --writable-tmpfs behaviour by default
e3b882e 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs/singularity#1621

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
@edytuk edytuk mentioned this issue May 24, 2023
Closed
edytuk pushed a commit to vzokay/apptainer that referenced this issue May 24, 2023
@dtrudg @edytuk
oci: Enable --writable-tmpfs behaviour by default
6371d6f 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs/singularity#1621

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue May 25, 2023
@dtrudg @edytuk
oci: Enable --writable-tmpfs behaviour by default
4b46dcb 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs/singularity#1621

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jun 14, 2023
@dtrudg @edytuk
oci: Enable --writable-tmpfs behaviour by default
b6c3f45 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs/singularity#1621

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jun 14, 2023
@dtrudg @edytuk
oci: Enable --writable-tmpfs behaviour by default
762cb6c 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs/singularity#1621

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jun 14, 2023
@dtrudg @edytuk
oci: Enable --writable-tmpfs behaviour by default
5bb073a 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs/singularity#1621

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jun 16, 2023
@dtrudg @edytuk
oci: Enable --writable-tmpfs behaviour by default
72f51ba 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs/singularity#1621

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jul 4, 2023
@dtrudg @edytuk
oci: Enable --writable-tmpfs behaviour by default
d78657a 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs/singularity#1621

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jul 11, 2023
@dtrudg @edytuk
oci: Enable --writable-tmpfs behaviour by default
9165c3b 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs/singularity#1621

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jul 21, 2023
@dtrudg @edytuk
oci: Enable --writable-tmpfs behaviour by default
78cf1c8 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs/singularity#1621

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
edytuk pushed a commit to vzokay/apptainer that referenced this issue Jul 24, 2023
@dtrudg @edytuk
oci: Enable --writable-tmpfs behaviour by default
a33fadd 
The `--oci` mode intends to follow behaviour that the native runtime
implements when run with `--compat`.

One missing aspect is that `--compat` sets `--writable-tmpfs`, where
the container rootfs is made writable with a tmpfs backed overlay.

This PR:

- Introduces a simple wrapping of the `oci run` sub-command as `oci
  run-wrapped`. This hidden command implements prep / cleanup steps
  that must take place in a userns for non-root `--oci` execution.
- Switches the oci launcher to calling `oci run-wrapped` instead of
  `oci-run`.
- Adds a tmpfs based overlay creation function for OCI
  bundles.
- Includes the tmpfs overlay creation in the `oci run-wrapped` flow.
- Copies the native runtime `--compat` e2e tests to OCI mode.

Fixes sylabs/singularity#1621

Signed-off-by: Edita Kizinevic <edita.kizinevic@cern.ch>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@dtrudg dtrudg

Labels
None yet
Projects
None yet
Milestone
SingularityCE 4.0.0
Development

Successfully merging a pull request may close this issue.

oci: Enable --writable-tmpfs behaviour by default dtrudg/singularity
1 participant
@dtrudg