Repository navigation
feat (linux): Argo Workflows on Linux guests with a shared-fs rootfs - #1203
Draft
indrajithek wants to merge 11 commits into
Draft
indrajithek wants to merge 11 commits into
indrajithek wants to merge 11 commits into
Conversation
The Linux kernel command line cannot carry an arbitrary argument list: an empty argument disappears, a literal `--` cuts off the rest, the list is truncated at 2048 bytes and more than 32 arguments panic the kernel. When urunit is the init, write the application command in the urunit configuration as `ARC`/`ARV` entries, as FreeBSD guests already do, and stop passing it on the kernel command line. Also return a clear error when an argument contains a newline. This fix requires a urunit that reads `ARC`/`ARV`. Fixes: urunc-dev#1067 Signed-off-by: Indrajith <29561593+indrajithek@users.noreply.github.com>
Signed-off-by: Indrajith <29561593+indrajithek@users.noreply.github.com>
Add the `ARC`/`ARV` entries to the documented urunit configuration format and update the list of actions urunit performs. Ref: urunc-dev#1067 Signed-off-by: Indrajith <29561593+indrajithek@users.noreply.github.com>
Noticed urunc-dev#1068 is also addressing arguments containing a newline. Removing it from this PR to avoid conflicts. Signed-off-by: Indrajith <29561593+indrajithek@users.noreply.github.com>
Remove the test cases created for urunc-dev#1136. Signed-off-by: Indrajith <29561593+indrajithek@users.noreply.github.com>
Add the `com.urunc.unikernel.init` annotation, also read from `urunc.json`, with the absolute path of an init inside the container rootfs. When it is set, urunc boots that init and passes the container command to it as arguments, unless the command already starts urunit. Signed-off-by: Indrajith <29561593+indrajithek@users.noreply.github.com>
When urunc gets `/dev/null` as stdin from the shim, add `STDIN:0` to the urunit configuration, so urunit gives the application `/dev/null` instead of the console. A container with stdin attached keeps the console. This requires a urunit that reads `STDIN` (nubificus/urunit#18). Older urunit versions ignore the entry. Signed-off-by: Indrajith <29561593+indrajithek@users.noreply.github.com>
Add an exec command to urunc. For a container that urunc handed over to runc, it execs runc with the same arguments, as kill, start and delete already do. For a urunc guest it returns an error, since exec into a guest is not supported. Ref: urunc-dev#573 Signed-off-by: Indrajith <29561593+indrajithek@users.noreply.github.com>
With the dynamic network, every packet that reaches eth0 is redirected to the tap, so the other containers of the pod lose the replies to their own connections while a guest runs. For a Linux guest, if the pod sets net.ipv4.ip_local_port_range above the range of the guest (61000 or higher), keep ARP and the TCP and UDP packets to the ports of that range for the pod, and redirect the rest to the guest as before. Ref: urunc-dev#573 Signed-off-by: Indrajith <29561593+indrajithek@users.noreply.github.com>
👷 Deploy request for urunc pending review.Visit the deploys page to approve it
|
indrajithek
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This is a working draft on Argo Workflows on Linux guests with a shared-fs rootfs. Do not merge the draft; PRs will be broken down from this in the coming days.
Related issues and fixes
ARC/ARVentries in the urunit config instead of the kernel command line.com.urunc.unikernel.initannotation names an init inside the rootfs./dev/nullas stdin when the container has none. urunc writesSTDIN:0to the urunit config when its own stdin is/dev/null, and urunit then gives the application/dev/nullinstead of the console. Otherwise emissary sees a terminal and fails to start the script withopen /dev/ptmx. Needs feat: give the application /dev/null as stdin when it has none nubificus/urunit#18.execfor containers handed over to runc. urunc has noexeccommand, so exec into runc containers of a urunc pod fails. The new command hands them over torunc execlikekill,startanddeletedo.eth0ingress goes to the guest, so the other containers of the pod lose ARP and the replies to their connections while the guest runs. Opt-in: if the pod setsnet.ipv4.ip_local_port_rangeabove the Linux guest range (61000 or higher), urunc keeps ARP and TCP/UDP to that range for the pod and redirects the rest as before.How was this tested?
Tests were done manual in UbuntuVM, Virtiofsd 1.13.0 was used with urunit from nubificus/urunit#18. The e2e targets (
make test_*) were not run as they first need to rebuilt with latest urunit with ARC/ARVLLM usage
Only claude Code Opus 5.5 with XHigh effort is used (manual mode). Decision-making or architecture is not by AI. If code generation was used, it's reviewed manually line by line (The network relaxation is advised by the AI, so that part is not ready for merge; I'm currently investigating on it about better approaches)
Checklist
make lint). Linter fails on some old files which I didnt touched in this PR. So doesnt matter I guessmake test_ctr,make test_nerdctl,make test_docker,make test_crictl). Before running this all linux images need to rebuild with latest urunit withARC/ARV