Support feature subcommand #2837

musaprg · 2024-06-29T15:46:14Z

derived from #2395, and fixes #815

This PR introduces a new youki features subcommand, which returns the Features Structure¹ defined in the OCI runtime spec. Features Structure is written in JSON format and contains runtime features supported by the youki.

TODO

Add seccomp support information based on the feature flags
- Waiting for the response of Add seccomp into feature flags of youki to be compiled in #2924

https://github.com/opencontainers/runtime-spec/blob/main/features.md ↩

crates/youki/Cargo.toml

YJDoc2 · 2024-09-20T04:57:36Z

Hey @musaprg , just wanted to confirm if you are following up on this, or might be busy with something else. No worries if you can't continue, but let us know. Thanks!

musaprg · 2024-09-21T09:02:30Z

@YJDoc2 Hi. sorry I have been a bit busy these days, but I'm still working on it. I'll update the dependency and add missing implementations.

codecov-commenter · 2024-09-22T15:23:58Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

Attention: Patch coverage is 95.56962% with 7 lines in your changes missing coverage. Please review.

Project coverage is 67.04%. Comparing base (ea96160) to head (e28d8ac).
Report is 14 commits behind head on main.

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2837      +/-   ##
==========================================
+ Coverage   66.76%   67.04%   +0.28%     
==========================================
  Files         131      131              
  Lines       16673    16831     +158     
==========================================
+ Hits        11131    11285     +154     
- Misses       5542     5546       +4

crates/youki/Cargo.toml

Signed-off-by: Darrell Tang <darrelltang@gmail.com> change struct name to resolve conflict Signed-off-by: Darrell Tang <darrelltang@gmail.com> fix annotation references Signed-off-by: Darrell Tang <darrelltang@gmail.com> set as Strings Signed-off-by: Darrell Tang <darrelltang@gmail.com> use serde Signed-off-by: Darrell Tang <darrelltang@gmail.com> pretty print Signed-off-by: Darrell Tang <darrelltang@gmail.com> clean up names to match runc features output Signed-off-by: Darrell Tang <darrelltang@gmail.com> rearrange structs and constants Signed-off-by: Darrell Tang <darrelltang@gmail.com> fix lint issues Signed-off-by: Darrell Tang <darrelltang@gmail.com> try to source caps dynamically Signed-off-by: Darrell Tang <darrelltang@gmail.com> try to source namespaces dynamically Signed-off-by: Darrell Tang <darrelltang@gmail.com> fix query_caps Signed-off-by: Darrell Tang <darrelltang@gmail.com> fix match statements Signed-off-by: Darrell Tang <darrelltang@gmail.com> fix linting issues Signed-off-by: Darrell Tang <darrelltang@gmail.com> fix extra line for linting Signed-off-by: Darrell Tang <darrelltang@gmail.com> Fix format Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

musaprg · 2024-09-28T15:19:34Z

@YJDoc2 @utam0k Hi, this PR is ready for review now. Could you check it at your convenience?
I don't think supporting seccomp support information in this PR would be necessary. I can implement it in another PR once #2924 gets merged. Thanks!

YJDoc2

Couple of comments.

crates/youki/src/commands/features.rs

Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

crates/youki/src/commands/features.rs

Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

YJDoc2 · 2024-09-30T04:43:38Z

Hey @musaprg , I ran this on my system and compared with runc's output, and there are some differences -

youki's output

`./youki features`

{ "ociVersionMin": "1.0.0", "ociVersionMax": "1.0.2", "hooks": [ "prestart", "createRuntime", "createContainer", "startContainer", "poststart", "poststop" ], "mountOptions": [ "async", "atime", "bind", "defaults", "dev", "diratime", "dirsync", "exec", "mand", "noatime", "nodev", "nodiratime", "noexec", "nomand", "norelatime", "nosuid", "nostrictatime", "private", "rbind", "rdev", "relatime", "remount", "rnoatime", "rnodev", "rnodiratime", "rnoexec", "rnorelatime", "rnosuid", "rnostrictatime", "ro", "rprivate", "rrw", "rshared", "rsuid", "rsymfollow", "rslave", "rstrictatime", "runbindable", "rw", "shared", "slave", "strictatime", "suid", "sync", "unbindable" ], "linux": { "namespaces": [ "pid", "network", "uts", "ipc", "mount", "user", "cgroup", "time" ], "capabilities": [], "cgroup": { "v1": false, "v2": false, "systemd": false, "systemdUser": false, "rdma": false }, "seccomp": null, "apparmor": { "enabled": true }, "selinux": { "enabled": false }, "intelRdt": { "enabled": true }, "mountExtensions": { "idmap": { "enabled": false } } }, "annotations": null, "potentiallyUnsafeConfigAnnotations": null }

runc's output

`runc features`

{ "ociVersionMin": "1.0.0", "ociVersionMax": "1.0.2-dev", "hooks": [ "prestart", "createRuntime", "createContainer", "startContainer", "poststart", "poststop" ], "mountOptions": [ "acl", "async", "atime", "bind", "defaults", "dev", "diratime", "dirsync", "exec", "iversion", "lazytime", "loud", "mand", "noacl", "noatime", "nodev", "nodiratime", "noexec", "noiversion", "nolazytime", "nomand", "norelatime", "nostrictatime", "nosuid", "nosymfollow", "private", "ratime", "rbind", "rdev", "rdiratime", "relatime", "remount", "rexec", "rnoatime", "rnodev", "rnodiratime", "rnoexec", "rnorelatime", "rnostrictatime", "rnosuid", "rnosymfollow", "ro", "rprivate", "rrelatime", "rro", "rrw", "rshared", "rslave", "rstrictatime", "rsuid", "rsymfollow", "runbindable", "rw", "shared", "silent", "slave", "strictatime", "suid", "symfollow", "sync", "tmpcopyup", "unbindable" ], "linux": { "namespaces": [ "cgroup", "ipc", "mount", "network", "pid", "user", "uts" ], "capabilities": [ "CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_DAC_READ_SEARCH", "CAP_FOWNER", "CAP_FSETID", "CAP_KILL", "CAP_SETGID", "CAP_SETUID", "CAP_SETPCAP", "CAP_LINUX_IMMUTABLE", "CAP_NET_BIND_SERVICE", "CAP_NET_BROADCAST", "CAP_NET_ADMIN", "CAP_NET_RAW", "CAP_IPC_LOCK", "CAP_IPC_OWNER", "CAP_SYS_MODULE", "CAP_SYS_RAWIO", "CAP_SYS_CHROOT", "CAP_SYS_PTRACE", "CAP_SYS_PACCT", "CAP_SYS_ADMIN", "CAP_SYS_BOOT", "CAP_SYS_NICE", "CAP_SYS_RESOURCE", "CAP_SYS_TIME", "CAP_SYS_TTY_CONFIG", "CAP_MKNOD", "CAP_LEASE", "CAP_AUDIT_WRITE", "CAP_AUDIT_CONTROL", "CAP_SETFCAP", "CAP_MAC_OVERRIDE", "CAP_MAC_ADMIN", "CAP_SYSLOG", "CAP_WAKE_ALARM", "CAP_BLOCK_SUSPEND", "CAP_AUDIT_READ", "CAP_PERFMON", "CAP_BPF", "CAP_CHECKPOINT_RESTORE" ], "cgroup": { "v1": true, "v2": true, "systemd": true, "systemdUser": true }, "seccomp": { "enabled": true, "actions": [ "SCMP_ACT_ALLOW", "SCMP_ACT_ERRNO", "SCMP_ACT_KILL", "SCMP_ACT_KILL_PROCESS", "SCMP_ACT_KILL_THREAD", "SCMP_ACT_LOG", "SCMP_ACT_NOTIFY", "SCMP_ACT_TRACE", "SCMP_ACT_TRAP" ], "operators": [ "SCMP_CMP_EQ", "SCMP_CMP_GE", "SCMP_CMP_GT", "SCMP_CMP_LE", "SCMP_CMP_LT", "SCMP_CMP_MASKED_EQ", "SCMP_CMP_NE" ], "archs": [ "SCMP_ARCH_AARCH64", "SCMP_ARCH_ARM", "SCMP_ARCH_MIPS", "SCMP_ARCH_MIPS64", "SCMP_ARCH_MIPS64N32", "SCMP_ARCH_MIPSEL", "SCMP_ARCH_MIPSEL64", "SCMP_ARCH_MIPSEL64N32", "SCMP_ARCH_PPC", "SCMP_ARCH_PPC64", "SCMP_ARCH_PPC64LE", "SCMP_ARCH_RISCV64", "SCMP_ARCH_S390", "SCMP_ARCH_S390X", "SCMP_ARCH_X32", "SCMP_ARCH_X86", "SCMP_ARCH_X86_64" ] }, "apparmor": { "enabled": true }, "selinux": { "enabled": true } }, "annotations": { "io.github.seccomp.libseccomp.version": "2.5.3", "org.opencontainers.runc.checkpoint.enabled": "true", "org.opencontainers.runc.commit": "v1.1.13-0-g58aa920", "org.opencontainers.runc.version": "1.1.13" } }

The major differences I see here are capabilities list, cgroup and systemd info, also seccomp info. Can you take a look?

musaprg · 2024-10-03T15:56:35Z

@YJDoc2 IIUC, as for the systemd-related fields, it depends on the youki's feature flags indicating which feature should be compiled in. I guess executing cargo build without any feature flags won't include any cgroup features such as v1, v2, systemd, systemd-user. Could you try scripts/build.sh -o $PWD -c youki -f v2 for example?

musaprg · 2024-10-03T15:57:58Z

As for the seccomp information, #2924 is required to be merged, so I've just left it as null, which means unknown about seccomp support.

musaprg · 2024-10-03T16:01:03Z

As for capabilities, I probably misunderstood the spec. The capabilities listed there don't have to be actually supported on the kernel running youki. I've fixed it in b8f902a.

The recognized names of the capabilities, including capabilities that might not be supported by the host operating system. The runtime MUST recognize the elements in this array in the process.capabilities object of config.json.
https://github.com/opencontainers/runtime-spec/blob/main/features-linux.md#capabilities

Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

musaprg · 2024-10-03T16:10:10Z

I noticed that namespaces also should include all possible namespaces regardless of whether it's supported on the kernel. I've fixed it in a73d957.

The recognized names of the namespaces, including namespaces that might not be supported by the host operating system. The runtime MUST recognize the elements in this array as the type of linux.namespaces objects in config.json.

Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

utam0k · 2024-10-09T02:46:52Z

crates/youki/src/commands/features.rs

+}
+
+// Return a list of known mount options supported by youki
+fn known_mount_options() -> Vec<String> {


This may be slightly beyond the scope of this PR, but I'm considering methods to ensure this list is regularly updated. WDYT?

OK, I'll try.

Hey, unless either of you have done implementation of the updation, I think we should go ahead with hard-coded parts in this PR and merge once reviewed, and the dynamic values can be done in #2937 or so. WDYT?

Sorry, I have been a bit busy recently. Separating PR sounds good to me, but either would be fine. I'll continue working on #2937 in that case.

utam0k added the kind/feature label Jul 1, 2024

musaprg force-pushed the issue-815-support-feature-subcommand branch 2 times, most recently from 64ebe28 to 804e48b Compare July 7, 2024 03:23

musaprg mentioned this pull request Jul 7, 2024

Add features structure type youki-dev/oci-spec-rs#184

Merged

2 tasks

utam0k mentioned this pull request Jul 11, 2024

Support feature subcommand #2395

Closed

musaprg mentioned this pull request Aug 24, 2024

Derive strum's EnumIter trait for enums youki-dev/oci-spec-rs#197

Closed

musaprg force-pushed the issue-815-support-feature-subcommand branch from c4a0450 to 6646793 Compare September 9, 2024 16:12

musaprg commented Sep 9, 2024

View reviewed changes

crates/youki/Cargo.toml Outdated Show resolved Hide resolved

musaprg mentioned this pull request Sep 11, 2024

Release v0.7.0 youki-dev/oci-spec-rs#210

Closed

musaprg force-pushed the issue-815-support-feature-subcommand branch from 4fda17a to f6f7ee8 Compare September 22, 2024 10:17

musaprg force-pushed the issue-815-support-feature-subcommand branch 2 times, most recently from e28d8ac to 491e79d Compare September 22, 2024 16:19

musaprg commented Sep 22, 2024

View reviewed changes

crates/youki/Cargo.toml Outdated Show resolved Hide resolved

YJDoc2 mentioned this pull request Sep 26, 2024

Bump oci-spec from 0.6.8 to 0.7.0 #2920

Closed

DarrellTang and others added 2 commits September 28, 2024 23:53

Support feature subcommand

96a4557

Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

musaprg force-pushed the issue-815-support-feature-subcommand branch from 491e79d to 96a4557 Compare September 28, 2024 15:07

musaprg marked this pull request as ready for review September 28, 2024 15:11

musaprg requested a review from YJDoc2 September 28, 2024 15:18

YJDoc2 reviewed Sep 29, 2024

View reviewed changes

crates/youki/src/commands/features.rs Outdated Show resolved Hide resolved

crates/youki/src/commands/features.rs Outdated Show resolved Hide resolved

musaprg added 2 commits September 29, 2024 16:39

fixup! Support feature subcommand

eb5cd7e

Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

fixup! Support feature subcommand

79f389e

Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

musaprg commented Sep 29, 2024

View reviewed changes

crates/youki/src/commands/features.rs Show resolved Hide resolved

musaprg added 2 commits September 29, 2024 17:16

fixup! Support feature subcommand

964755c

Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

fixup! Support feature subcommand

1898fdb

Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

musaprg requested a review from YJDoc2 September 29, 2024 13:46

musaprg added 2 commits October 4, 2024 01:06

fixup! Support feature subcommand

b8f902a

Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

fixup! Support feature subcommand

a73d957

Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

fixup! Support feature subcommand

e68e977

Signed-off-by: Kotaro Inoue <k.musaino@gmail.com>

utam0k reviewed Oct 9, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support feature subcommand #2837

Support feature subcommand #2837

musaprg commented Jun 29, 2024 •

edited

Loading

YJDoc2 commented Sep 20, 2024

musaprg commented Sep 21, 2024

codecov-commenter commented Sep 22, 2024

musaprg commented Sep 28, 2024

YJDoc2 left a comment

YJDoc2 commented Sep 30, 2024

musaprg commented Oct 3, 2024

musaprg commented Oct 3, 2024

musaprg commented Oct 3, 2024 •

edited

Loading

musaprg commented Oct 3, 2024 •

edited

Loading

utam0k Oct 9, 2024

musaprg Oct 14, 2024

YJDoc2 Oct 22, 2024

musaprg Nov 5, 2024

Support feature subcommand #2837

Are you sure you want to change the base?

Support feature subcommand #2837

Conversation

musaprg commented Jun 29, 2024 • edited Loading

TODO

Footnotes

YJDoc2 commented Sep 20, 2024

musaprg commented Sep 21, 2024

codecov-commenter commented Sep 22, 2024

Codecov Report

musaprg commented Sep 28, 2024

YJDoc2 left a comment

Choose a reason for hiding this comment

YJDoc2 commented Sep 30, 2024

musaprg commented Oct 3, 2024

musaprg commented Oct 3, 2024

musaprg commented Oct 3, 2024 • edited Loading

musaprg commented Oct 3, 2024 • edited Loading

utam0k Oct 9, 2024

Choose a reason for hiding this comment

musaprg Oct 14, 2024

Choose a reason for hiding this comment

YJDoc2 Oct 22, 2024

Choose a reason for hiding this comment

musaprg Nov 5, 2024

Choose a reason for hiding this comment

musaprg commented Jun 29, 2024 •

edited

Loading

musaprg commented Oct 3, 2024 •

edited

Loading

musaprg commented Oct 3, 2024 •

edited

Loading