pax_global_header 0000666 0000000 0000000 00000000064 14533742372 0014524 g ustar 00root root 0000000 0000000 52 comment=28cd41e73158295e0698dea8f07b5860768a8ec1
nydus-snapshotter-0.13.4/ 0000775 0000000 0000000 00000000000 14533742372 0015323 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/.github/ 0000775 0000000 0000000 00000000000 14533742372 0016663 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/.github/codecov.yml 0000664 0000000 0000000 00000001216 14533742372 0021030 0 ustar 00root root 0000000 0000000 coverage:
status:
patch: off
project:
default:
enabled: yes
target: auto # auto compares coverage to the previous base commit
# adjust accordingly based on how flaky your tests are
# this allows a 0.3% drop from the previous base commit coverage
threshold: 0.3%
comment:
layout: "reach, diff, flags, files"
behavior: default
require_changes: true # if true: only post the comment if coverage changes
codecov:
require_ci_to_pass: false
notify:
wait_for_ci: true
# When modifying this file, please validate using
# curl -X POST --data-binary @codecov.yml https://codecov.io/validate
nydus-snapshotter-0.13.4/.github/workflows/ 0000775 0000000 0000000 00000000000 14533742372 0020720 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/.github/workflows/ci.yml 0000664 0000000 0000000 00000010254 14533742372 0022040 0 ustar 00root root 0000000 0000000 name: CI
on:
push:
branches: ["**", "stable/**"]
pull_request:
branches: ["**", "stable/**"]
env:
CARGO_TERM_COLOR: always
jobs:
build:
name: Build and Lint
timeout-minutes: 10
runs-on: ubuntu-latest
steps:
- name: Set up Go
uses: actions/setup-go@v3
with:
go-version: "1.20.1"
- name: Check out code
uses: actions/checkout@v3
- name: cache go mod
uses: actions/cache@v3
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}
restore-keys: |
${{ runner.os }}-go
- name: Build
run: |
go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.51.2
export PATH=$PATH:$(go env GOPATH)/bin
make
make test
make check
build-optimizer:
name: Build optimizer
timeout-minutes: 10
runs-on: ubuntu-latest
steps:
- name: Set up Go
uses: actions/setup-go@v3
with:
go-version: "1.20.1"
- name: Check out code
uses: actions/checkout@v3
- name: cache go mod
uses: actions/cache@v3
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}
restore-keys: |
${{ runner.os }}-go
- name: Build
run: |
go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.51.2
export PATH=$PATH:$(go env GOPATH)/bin
rustup component add rustfmt clippy
make build-optimizer
smoke:
name: Smoke
timeout-minutes: 10
runs-on: ubuntu-latest
steps:
- name: Set up Go
uses: actions/setup-go@v3
with:
go-version: "1.19.6"
- name: Check out code
uses: actions/checkout@v3
- name: cache go mod
uses: actions/cache@v3
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}
restore-keys: |
${{ runner.os }}-go
- name: Set up containerd
uses: crazy-max/ghaction-setup-containerd@v2
- name: Build
run: |
# Download nydus components
NYDUS_VER=v$(curl --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' -s "https://api.github.com/repos/dragonflyoss/nydus/releases/latest" | jq -r .tag_name | sed 's/^v//')
wget https://github.com/dragonflyoss/nydus/releases/download/$NYDUS_VER/nydus-static-$NYDUS_VER-linux-amd64.tgz
tar xzvf nydus-static-$NYDUS_VER-linux-amd64.tgz
mkdir -p /usr/bin
sudo mv nydus-static/nydus-image nydus-static/nydusd nydus-static/nydusify /usr/bin/
export PATH=$PATH:$(go env GOPATH)/bin
make smoke
cross-build-test:
name: Cross Build Test
timeout-minutes: 10
runs-on: ubuntu-latest
strategy:
matrix:
GOOS: ["linux", "windows", "darwin"]
GOARCH: ["amd64", "arm64"]
steps:
- name: Set up Go
uses: actions/setup-go@v3
with:
go-version: "1.19.6"
- name: Check out code
uses: actions/checkout@v3
- name: cache go mod
uses: actions/cache@v3
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}
restore-keys: |
${{ runner.os }}-go
- name: Build
run: |
make -e GOOS=${{ matrix.GOOS }} GOARCH=${{ matrix.GOARCH }} converter
coverage:
name: Code coverage
timeout-minutes: 10
runs-on: ubuntu-latest
needs: [build]
steps:
- name: Install Go
uses: actions/setup-go@v3
with:
go-version: "1.19.6"
- name: Checkout code
uses: actions/checkout@v3
- name: cache go mod
uses: actions/cache@v3
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}
restore-keys: |
${{ runner.os }}-go
- name: Run unit tests.
run: make cover
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v3
with:
token: ${{ secrets.CODECOV_TOKEN }} # not required for public repos
files: ./coverage.txt
nydus-snapshotter-0.13.4/.github/workflows/e2e.yml 0000664 0000000 0000000 00000004066 14533742372 0022124 0 ustar 00root root 0000000 0000000 name: integration test
on:
push:
branches:
- "main"
tags:
- v[0-9]+.[0-9]+.[0-9]+
pull_request:
branches:
- "main"
schedule:
# Trigger test every day at 00:03 clock UTC
- cron: "3 0 * * *"
workflow_dispatch:
env:
CARGO_TERM_COLOR: always
REGISTRY: ghcr.io
jobs:
run-e2e-for-cgroups-v1:
runs-on: ubuntu-20.04
steps:
- name: Set up Go
uses: actions/setup-go@v3
with:
go-version: "1.19.6"
- name: Checkout repository
uses: actions/checkout@v3
- name: cache go mod
uses: actions/cache@v3
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}
restore-keys: |
${{ runner.os }}-go
- name: Log in to container registry
uses: docker/login-action@v2
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Run e2e test
run: |
TAG=$GITHUB_REF_NAME
[ "$TAG" == "main" ] && TAG="latest"
[ "$GITHUB_EVENT_NAME" == "pull_request" ] && TAG="local"
make integration
run-e2e-for-cgroups-v2:
runs-on: ubuntu-22.04
steps:
- name: Set up Go
uses: actions/setup-go@v3
with:
go-version: "1.19.6"
- name: Checkout repository
uses: actions/checkout@v3
- name: cache go mod
uses: actions/cache@v3
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}
restore-keys: |
${{ runner.os }}-go
- name: Log in to container registry
uses: docker/login-action@v2
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Run e2e test
run: |
TAG=$GITHUB_REF_NAME
[ "$TAG" == "main" ] && TAG="latest"
[ "$GITHUB_EVENT_NAME" == "pull_request" ] && TAG="local"
make integration
nydus-snapshotter-0.13.4/.github/workflows/k8s-e2e-run.yml 0000664 0000000 0000000 00000000522 14533742372 0023422 0 ustar 00root root 0000000 0000000 name: E2E Test With Kubernetes
on:
push:
branches:
- "main"
tags:
- v[0-9]+.[0-9]+.[0-9]+
pull_request:
branches: [main]
jobs:
cri_auth:
uses: ./.github/workflows/k8s-e2e.yml
with:
auth-type: cri
kubeconf_auth:
uses: ./.github/workflows/k8s-e2e.yml
with:
auth-type: kubeconf
nydus-snapshotter-0.13.4/.github/workflows/k8s-e2e.yml 0000664 0000000 0000000 00000015756 14533742372 0022637 0 ustar 00root root 0000000 0000000 name: E2E Test With Kubernetes Template
on:
workflow_call:
inputs:
auth-type:
required: true
type: string
env:
DOCKER_USER: testuser
DOCKER_PASSWORD: testpassword
jobs:
e2e_tests_k8s:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- name: Checkout code
uses: actions/checkout@v3
with:
submodules: recursive
- name: Set up Go
uses: actions/setup-go@v3
with:
go-version: "1.19.6"
- name: Setup Kind
uses: engineerd/setup-kind@v0.5.0
with:
version: v0.16.0
config: tests/e2e/k8s/kind.yaml
- name: Build nydus snapshotter dev image
run: |
make
cp bin/containerd-nydus-grpc ./
cp misc/snapshotter/* ./
ls -tl ./
NYDUS_VER=v$(curl --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' -s "https://api.github.com/repos/dragonflyoss/nydus/releases/latest" | jq -r .tag_name | sed 's/^v//')
docker build --build-arg NYDUS_VER=${NYDUS_VER} -t local-dev:e2e .
## load local test image into kind node
kind load docker-image local-dev:e2e
- name: Setup registry
run: |
mkdir auth
docker run \
--entrypoint htpasswd \
httpd:2 -Bbn ${{ env.DOCKER_USER }} ${{ env.DOCKER_PASSWORD }} > auth/htpasswd
docker run -d \
-p 5000:5000 \
--restart=always \
--name registry \
-v "$(pwd)"/auth:/auth \
-e "REGISTRY_AUTH=htpasswd" \
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
registry:2
- name: Login to GitHub Container Registry
run: |
registry_ip=$(ip addr show eth0 | grep 'inet ' | awk '{print $2}' | cut -d/ -f1)
## sudo cat can't modify daemon.json
sudo chmod a+w /etc/docker/daemon.json
cat << EOF > /etc/docker/daemon.json
{
"exec-opts": ["native.cgroupdriver=cgroupfs"],
"cgroup-parent": "/actions_job",
"insecure-registries" : [ "${registry_ip}:5000" ]
}
EOF
sudo systemctl restart docker
docker login --username=${{ env.DOCKER_USER }} --password=${{ env.DOCKER_PASSWORD }} $registry_ip:5000
- name: Setup nydus snapshotter
run: |
kubectl create -f tests/e2e/k8s/snapshotter-${{ inputs.auth-type }}.yaml
export ns=nydus-system
p=`kubectl -n $ns get pods --no-headers -o custom-columns=NAME:metadata.name`
echo "snapshotter pod name ${p}"
kubectl -n $ns wait po $p --for=condition=ready --timeout=2m
# change snapshotter to nydus after nydus snapshotter started
registry_ip=$(ip addr show eth0 | grep 'inet ' | awk '{print $2}' | cut -d/ -f1)
docker cp kind-control-plane:/etc/containerd/config.toml containerd.config.toml.bak
sed -i -e 's|snapshotter = "overlayfs"|snapshotter = "nydus"|' containerd.config.toml.bak
cat << EOF >> containerd.config.toml.bak
[proxy_plugins]
[proxy_plugins.nydus]
type = "snapshot"
address = "/run/containerd-nydus/containerd-nydus-grpc.sock"
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."${registry_ip}:5000"]
endpoint = ["http://${registry_ip}:5000"]
EOF
docker cp containerd.config.toml.bak kind-control-plane:/etc/containerd/config.toml.bak
docker exec kind-control-plane sh -c "cat /etc/containerd/config.toml.bak > /etc/containerd/config.toml"
docker exec kind-control-plane systemctl restart containerd
- name: Install Nydus binaries and convert nydus image
run: |
NYDUS_VER=v$(curl --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' -s "https://api.github.com/repos/dragonflyoss/nydus/releases/latest" | jq -r .tag_name | sed 's/^v//')
wget -q https://github.com/dragonflyoss/nydus/releases/download/$NYDUS_VER/nydus-static-$NYDUS_VER-linux-amd64.tgz
tar xzf nydus-static-$NYDUS_VER-linux-amd64.tgz
sudo cp nydus-static/nydusify nydus-static/nydus-image /usr/local/bin/
registry_ip=$(ip addr show eth0 | grep 'inet ' | awk '{print $2}' | cut -d/ -f1)
sudo DOCKER_CONFIG=$HOME/.docker nydusify convert \
--source busybox:latest \
--target ${registry_ip}:5000/busybox:nydus-v6-latest \
--fs-version 6
- name: Run E2E test
run: |
registry_ip=$(ip addr show eth0 | grep 'inet ' | awk '{print $2}' | cut -d/ -f1)
kubectl create --namespace nydus-system secret generic regcred \
--from-file=.dockerconfigjson=$HOME/.docker/config.json \
--type=kubernetes.io/dockerconfigjson
sed -e "s|REGISTRY_IP|${registry_ip}|" tests/e2e/k8s/test-pod.yaml.tpl > tests/e2e/k8s/test-pod.yaml
if [[ "${{ inputs.auth-type }}" == "cri" ]]; then
docker exec kind-control-plane sh -c 'echo " --image-service-endpoint=unix:///run/containerd-nydus/containerd-nydus-grpc.sock" >> /etc/default/kubelet'
docker exec kind-control-plane sh -c 'systemctl daemon-reload && systemctl restart kubelet'
fi
kubectl apply -f tests/e2e/k8s/test-pod.yaml
kubectl wait po test-pod -n nydus-system --for=condition=ready --timeout=1m
kubectl delete -f tests/e2e/k8s/test-pod.yaml
- name: Dump logs
if: failure()
continue-on-error: true
run: |
log_dir="/tmp/nydus-log"
mkdir -p $log_dir
export ns=nydus-system
for p in `kubectl -n $ns get pods --no-headers -o custom-columns=NAME:metadata.name`; do
kubectl -n $ns get pod $p -o yaml >> $log_dir/nydus-pods.conf
kubectl -n $ns describe pod $p >> $log_dir/nydus-pods.conf
kubectl -n $ns logs $p -c nydus-snapshotter >> $log_dir/nydus-snapshotter.log || echo "failed to get snapshotter log"
done
kubectl -n $ns get secrets -o yaml >> $log_dir/nydus-secrets.log
docker exec kind-control-plane cat /etc/containerd/config.toml >> $log_dir/containerd-config.toml
docker exec kind-control-plane containerd config dump >> $log_dir/containerd-config-dump.toml
docker exec kind-control-plane journalctl --no-pager -u containerd >> $log_dir/containerd.log
docker exec kind-control-plane journalctl --no-pager -u kubelet >> $log_dir/kubelet.log
docker exec kind-control-plane ps -ef >> $log_dir/psef.log
kubectl get pod test-pod -o yaml >> $log_dir/test-pod.log || echo "test-pod may be deleted or not created"
cat ~/.docker/config.json > $log_dir/docker.config.json || echo "~/.docker/config.json not found"
- name: Upload Logs
uses: actions/upload-artifact@v3
if: failure()
with:
name: k8s-e2e-tests-logs
path: |
/tmp/nydus-log
nydus-snapshotter-0.13.4/.github/workflows/optimizer.yml 0000664 0000000 0000000 00000010421 14533742372 0023463 0 ustar 00root root 0000000 0000000 name: optimizer test
on:
push:
branches:
- "main"
tags:
- v[0-9]+.[0-9]+.[0-9]+
pull_request:
branches:
- "main"
schedule:
# Trigger test every day at 00:03 clock UTC
- cron: "3 0 * * *"
workflow_dispatch:
env:
CARGO_TERM_COLOR: always
jobs:
run_optimizer:
runs-on: ubuntu-latest
steps:
- name: Set up Go
uses: actions/setup-go@v3
with:
go-version: "1.19.6"
- name: Checkout repository
uses: actions/checkout@v3
- name: cache go mod
uses: actions/cache@v3
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}
restore-keys: |
${{ runner.os }}-go
- name: cache cargo
uses: actions/cache@v3
with:
path: |
~/.cargo/bin/
~/.cargo/registry/index/
~/.cargo/registry/cache/
~/.cargo/git/db/
tools/optimizer-server/target/
key: ${{ runner.os }}-cargo-${{ hashFiles('tools/optimizer-server/Cargo.lock') }}
restore-keys: |
${{ runner.os }}-cargo
- name: containerd runc and crictl
run: |
sudo wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.26.0/crictl-v1.26.0-linux-amd64.tar.gz
sudo tar zxvf ./crictl-v1.26.0-linux-amd64.tar.gz -C /usr/local/bin
sudo install -D -m 755 misc/optimizer/crictl.yaml /etc/crictl.yaml
sudo wget https://github.com/containerd/containerd/releases/download/v1.7.0/containerd-static-1.7.0-linux-amd64.tar.gz
sudo systemctl stop containerd
sudo tar -zxf ./containerd-static-1.7.0-linux-amd64.tar.gz -C /usr/
sudo install -D -m 755 misc/optimizer/containerd-config.toml /etc/containerd/config.toml
sudo systemctl restart containerd
sudo wget https://github.com/opencontainers/runc/releases/download/v1.1.5/runc.amd64 -O /usr/bin/runc
sudo chmod +x /usr/bin/runc
- name: Setup CNI
run: |
wget https://github.com/containernetworking/plugins/releases/download/v1.2.0/cni-plugins-linux-amd64-v1.2.0.tgz
sudo mkdir -p /opt/cni/bin
sudo tar xzf cni-plugins-linux-amd64-v1.2.0.tgz -C /opt/cni/bin/
sudo install -D -m 755 misc/example/10-containerd-net.conflist /etc/cni/net.d/10-containerd-net.conflist
- name: Build and install optimizer
run: |
rustup component add rustfmt clippy
make optimizer
sudo chown -R $(id -un):$(id -gn) . ~/.cargo/
pwd
ls -lh bin/*optimizer*
sudo make install-optimizer
sudo install -D -m 755 misc/example/optimizer-nri-plugin.conf /etc/nri/conf.d/02-optimizer-nri-plugin.conf
sudo systemctl restart containerd
systemctl status containerd --no-pager -l
- name: Wait containerd ready
run: |
unset READY
for i in $(seq 30); do
if eval "timeout 180 ls /run/containerd/containerd.sock"; then
READY=true
break
fi
echo "Fail(${i}). Retrying..."
sleep 1
done
if [ "$READY" != "true" ];then
echo "containerd is not ready"
exit 1
fi
- name: Generate accessed files list
run: |
sed -i "s|host_path: script|host_path: $(pwd)/misc/optimizer/script|g" misc/optimizer/nginx.yaml
sudo crictl run misc/optimizer/nginx.yaml misc/optimizer/sandbox.yaml
sleep 20
sudo crictl rmp -f --all
tree /opt/nri/optimizer/results/
count=$(cat /opt/nri/optimizer/results/library/nginx:1.23.3 | wc -l)
expected=$(cat misc/optimizer/script/file_list.txt | wc -l)
echo "count: $count expected minimum value: $expected"
if [ $count -lt $expected ]; then
echo "failed to generate accessed files list for nginx:1.23.3"
cat misc/optimizer/script/file_list.txt
exit 1
fi
cat /opt/nri/optimizer/results/library/nginx:1.23.3.csv
- name: Dump logs
if: failure()
continue-on-error: true
run: |
systemctl status containerd --no-pager -l
journalctl -xeu containerd --no-pager
nydus-snapshotter-0.13.4/.github/workflows/release.yml 0000664 0000000 0000000 00000007525 14533742372 0023074 0 ustar 00root root 0000000 0000000 name: release
on:
push:
tags:
- v[0-9]+.[0-9]+.[0-9]+*
env:
CARGO_TERM_COLOR: always
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-go@v3
with:
go-version: "1.19.6"
- name: cache go mod
uses: actions/cache@v3
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}
restore-keys: |
${{ runner.os }}-go
- name: cache cargo
uses: actions/cache@v3
with:
path: |
~/.cargo/bin/
~/.cargo/registry/index/
~/.cargo/registry/cache/
~/.cargo/git/db/
tools/optimizer-server/target/
key: ${{ runner.os }}-cargo-${{ hashFiles('tools/optimizer-server/Cargo.lock') }}
restore-keys: |
${{ runner.os }}-cargo
- name: build nydus-snapshotter and optimizer
run: |
go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.51.2
export PATH=$PATH:$(go env GOPATH)/bin
make static-release
- name: upload artifacts
uses: actions/upload-artifact@v3
with:
name: nydus-snapshotter_artifacts
path: |
bin/containerd-nydus-grpc
bin/nydus-overlayfs
bin/optimizer-nri-plugin
bin/optimizer-server
upload:
runs-on: ubuntu-latest
needs: [build]
steps:
- uses: actions/checkout@v3
- name: Download Artifacts
uses: actions/download-artifact@v3
with:
name: nydus-snapshotter_artifacts
path: nydus-snapshotter
- name: Upload Artifacts
run: |
tag=$(echo $GITHUB_REF | cut -d/ -f3-)
tarball="nydus-snapshotter-$tag-x86_64.tgz"
chmod +x nydus-snapshotter/*
tar cf - nydus-snapshotter | gzip > ${tarball}
echo "tag=$tag" >> $GITHUB_ENV
echo "tarball=$tarball" >> $GITHUB_ENV
tarball_shasum="$tarball.sha256sum"
sha256sum $tarball > $tarball_shasum
echo "tarball_shasum=$tarball_shasum" >> $GITHUB_ENV
- name: Release
uses: softprops/action-gh-release@v1
with:
name: "Nydus Snapshotter ${{ env.tag }} Release"
generate_release_notes: true
files: |
${{ env.tarball }}
${{ env.tarball_shasum }}
publish-image:
runs-on: ubuntu-latest
needs: [build]
steps:
- name: Checkout repository
uses: actions/checkout@v3
- name: Log in to the container registry
uses: docker/login-action@v2
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: download artifacts
uses: actions/download-artifact@v3
with:
name: nydus-snapshotter_artifacts
path: misc/snapshotter
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
- name: Get the nydusd version
id: step_one
run: |
export NYDUS_STABLE_VER=$(curl https://api.github.com/repos/dragonflyoss/nydus/releases/latest | jq -r .tag_name)
echo "NYDUS_STABLE_VER=$NYDUS_STABLE_VER" >> "$GITHUB_ENV"
printf 'nydus version is: %s\n' "$NYDUS_STABLE_VER"
- name: build and push nydus-snapshotter image
uses: docker/build-push-action@v3
with:
context: misc/snapshotter
file: misc/snapshotter/Dockerfile
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
build-args: NYDUS_VER=${{ env.NYDUS_STABLE_VER }}
nydus-snapshotter-0.13.4/.gitignore 0000664 0000000 0000000 00000000166 14533742372 0017316 0 ustar 00root root 0000000 0000000 bin/
pkg/filesystem/stargz/testdata/db/
coverage.txt
.vscode/
tests/output/
smoke.tests
tools/optimizer-server/target
nydus-snapshotter-0.13.4/.golangci.yml 0000664 0000000 0000000 00000002130 14533742372 0017703 0 ustar 00root root 0000000 0000000 # https://golangci-lint.run/usage/configuration#config-file
run:
concurrency: 4
deadline: 5m
issues-exit-code: 1
tests: true
skip-dirs:
- misc
# The package is ported from containerd project, let's skip it.
- pkg/remote/remotes
linters-settings:
# govet:
# check-shadowing: true
# enable:
# - fieldalignment
funlen:
# Checks the number of lines in a function.
# If lower than 0, disable the check.
# Default: 60
lines: 100
# Checks the number of statements in a function.
# If lower than 0, disable the check.
# Default: 40
statements: 80
nilnil:
checked-types:
- ptr
- func
- iface
- map
- chan
linters:
enable:
- staticcheck
- unconvert
- gofmt
- goimports
- revive
- ineffassign
- vet
- unused
- misspell
- bodyclose
# - cyclop
- dogsled
- nilnil
- unparam
- nilerr
# - goerr113
- exportloopref
# - gosec
- gocritic
- prealloc
- tenv
# - funlen
- exhaustive
- errcheck
disable:
- gosec
nydus-snapshotter-0.13.4/LICENSE 0000664 0000000 0000000 00000026136 14533742372 0016340 0 ustar 00root root 0000000 0000000
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright [yyyy] [name of copyright owner]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
nydus-snapshotter-0.13.4/MAINTAINERS 0000664 0000000 0000000 00000001045 14533742372 0017020 0 ustar 00root root 0000000 0000000 # nydus-snapshotter maintainers
#
# As a containerd sub-project, containerd maintainers are also included from https://github.com/containerd/project/blob/main/MAINTAINERS.
# See https://github.com/containerd/project/blob/main/GOVERNANCE.md for description of maintainer role
#
# COMMITTERS
# GitHub ID, Name, Email address
changweige, Changwei Ge, changweige@gmail.com
eryugey, Eryu Guan, eguan@linux.alibaba.com
imeoer, Yan Song, yansong.ys@antgroup.com
#
# REVIEWERS
# GitHub ID, Name, Email address
sctb512, Bin Tang, tangbin.bin@bytedance.com
nydus-snapshotter-0.13.4/Makefile 0000664 0000000 0000000 00000014764 14533742372 0016777 0 ustar 00root root 0000000 0000000 all: clean build
optimizer: clean-optimizer build-optimizer
PKG = github.com/containerd/nydus-snapshotter
PACKAGES ?= $(shell go list ./... | grep -v /tests)
SUDO = $(shell which sudo)
GO_EXECUTABLE_PATH ?= $(shell which go)
NYDUS_BUILDER ?= /usr/bin/nydus-image
NYDUS_NYDUSD ?= /usr/bin/nydusd
GOOS ?= linux
GOARCH ?= $(shell go env GOARCH)
KERNEL_VER = $(shell uname -r)
# Used to populate variables in version package.
BUILD_TIMESTAMP=$(shell date '+%Y-%m-%dT%H:%M:%S')
VERSION=$(shell git describe --match 'v[0-9]*' --dirty='.m' --always --tags)
REVISION=$(shell git rev-parse HEAD)$(shell if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi)
# Relpace test target images for e2e tests.
ifdef E2E_TEST_TARGET_IMAGES_FILE
ENV_TARGET_IMAGES_FILE = --env-file ${E2E_TEST_TARGET_IMAGES_FILE}
endif
ifdef E2E_DOWNLOADS_MIRROR
BUILD_ARG_E2E_DOWNLOADS_MIRROR = --build-arg DOWNLOADS_MIRROR=${E2E_DOWNLOADS_MIRROR}
endif
ifdef GOPROXY
PROXY := GOPROXY="${GOPROXY}"
endif
ifdef FS_CACHE
FS_DRIVER = fscache
else
FS_DRIVER = fusedev
endif
SNAPSHOTTER_CONFIG=/etc/nydus/config.toml
SOURCE_SNAPSHOTTER_CONFIG=misc/snapshotter/config.toml
NYDUSD_CONFIG=/etc/nydus/nydusd-config.${FS_DRIVER}.json
SOURCE_NYDUSD_CONFIG=misc/snapshotter/nydusd-config.${FS_DRIVER}.json
SNAPSHOTTER_SYSTEMD_UNIT_SERVICE=misc/snapshotter/nydus-snapshotter.${FS_DRIVER}.service
LDFLAGS = -s -w -X ${PKG}/version.Version=${VERSION} -X ${PKG}/version.Revision=$(REVISION) -X ${PKG}/version.BuildTimestamp=$(BUILD_TIMESTAMP)
DEBUG_LDFLAGS = -X ${PKG}/version.Version=${VERSION} -X ${PKG}/version.Revision=$(REVISION) -X ${PKG}/version.BuildTimestamp=$(BUILD_TIMESTAMP)
CARGO ?= $(shell which cargo)
OPTIMIZER_SERVER = tools/optimizer-server
OPTIMIZER_SERVER_TOML = ${OPTIMIZER_SERVER}/Cargo.toml
OPTIMIZER_SERVER_BIN = ${OPTIMIZER_SERVER}/target/release/optimizer-server
STATIC_OPTIMIZER_SERVER_BIN = ${OPTIMIZER_SERVER}/target/x86_64-unknown-linux-gnu/release/optimizer-server
.PHONY: build
build:
GOOS=${GOOS} GOARCH=${GOARCH} ${PROXY} go build -ldflags "$(LDFLAGS)" -v -o bin/containerd-nydus-grpc ./cmd/containerd-nydus-grpc
GOOS=${GOOS} GOARCH=${GOARCH} ${PROXY} go build -ldflags "$(LDFLAGS)" -v -o bin/nydus-overlayfs ./cmd/nydus-overlayfs
debug:
GOOS=${GOOS} GOARCH=${GOARCH} ${PROXY} go build -ldflags "$(DEBUG_LDFLAGS)" -gcflags "-N -l" -v -o bin/containerd-nydus-grpc ./cmd/containerd-nydus-grpc
GOOS=${GOOS} GOARCH=${GOARCH} ${PROXY} go build -ldflags "$(DEBUG_LDFLAGS)" -gcflags "-N -l" -v -o bin/nydus-overlayfs ./cmd/nydus-overlayfs
.PHONY: build-optimizer
build-optimizer:
GOOS=${GOOS} GOARCH=${GOARCH} ${PROXY} go build -ldflags "$(LDFLAGS)" -v -o bin/optimizer-nri-plugin ./cmd/optimizer-nri-plugin
make -C tools/optimizer-server release && cp ${OPTIMIZER_SERVER_BIN} ./bin
static-release:
CGO_ENABLED=0 ${PROXY} GOOS=${GOOS} GOARCH=${GOARCH} go build -ldflags "$(LDFLAGS) -extldflags -static" -v -o bin/containerd-nydus-grpc ./cmd/containerd-nydus-grpc
CGO_ENABLED=0 ${PROXY} GOOS=${GOOS} GOARCH=${GOARCH} go build -ldflags "$(LDFLAGS) -extldflags -static" -v -o bin/nydus-overlayfs ./cmd/nydus-overlayfs
CGO_ENABLED=0 ${PROXY} GOOS=${GOOS} GOARCH=${GOARCH} go build -ldflags "$(LDFLAGS) -extldflags -static" -v -o bin/optimizer-nri-plugin ./cmd/optimizer-nri-plugin
make -C tools/optimizer-server static-release && cp ${STATIC_OPTIMIZER_SERVER_BIN} ./bin
# Majorly for cross build for converter package since it is imported by other projects
converter:
GOOS=${GOOS} GOARCH=${GOARCH} ${PROXY} go build -ldflags "$(LDFLAGS)" -v -o bin/converter ./cmd/converter
.PHONY: clean
clean:
rm -f bin/*
rm -rf _out
.PHONY: clean-optimizer
clean-optimizer:
rm -rf bin/optimizer-nri-plugin bin/optimizer-server
make -C tools/optimizer-server clean
.PHONY: install
install:
@echo "+ $@ bin/containerd-nydus-grpc"
@sudo install -D -m 755 bin/containerd-nydus-grpc /usr/local/bin/containerd-nydus-grpc
@echo "+ $@ bin/nydus-overlayfs"
@sudo install -D -m 755 bin/nydus-overlayfs /usr/local/bin/nydus-overlayfs
@if [ ! -e ${NYDUSD_CONFIG} ]; then echo "+ $@ SOURCE_NYDUSD_CONFIG"; sudo install -D -m 664 ${SOURCE_NYDUSD_CONFIG} ${NYDUSD_CONFIG}; fi
@if [ ! -e ${SNAPSHOTTER_CONFIG} ]; then echo "+ $@ ${SOURCE_SNAPSHOTTER_CONFIG}"; sudo install -D -m 664 ${SOURCE_SNAPSHOTTER_CONFIG} ${SNAPSHOTTER_CONFIG}; fi
@sudo ln -f -s /etc/nydus/nydusd-config.${FS_DRIVER}.json /etc/nydus/nydusd-config.json
@echo "+ $@ ${SNAPSHOTTER_SYSTEMD_UNIT_SERVICE}"
@sudo install -D -m 644 ${SNAPSHOTTER_SYSTEMD_UNIT_SERVICE} /etc/systemd/system/nydus-snapshotter.service
@sudo mkdir -p /etc/nydus/certs.d
@if which systemctl >/dev/null; then sudo systemctl enable /etc/systemd/system/nydus-snapshotter.service; sudo systemctl restart nydus-snapshotter; fi
install-optimizer:
sudo install -D -m 755 bin/optimizer-nri-plugin /opt/nri/plugins/02-optimizer-nri-plugin
sudo install -D -m 755 bin/optimizer-server /usr/local/bin/optimizer-server
sudo install -D -m 755 misc/example/optimizer-nri-plugin.conf /etc/nri/conf.d/02-optimizer-nri-plugin.conf
@sudo mkdir -p /opt/nri/optimizer/results
.PHONY: vet
vet:
go vet $(PACKAGES) ./tests
.PHONY: check
check: vet
golangci-lint run
.PHONY: test
test:
go test -race -v -mod=mod -cover ${PACKAGES}
.PHONY: cover
cover:
go test -v -covermode=atomic -coverprofile=coverage.txt $(PACKAGES)
go tool cover -func=coverage.txt
# make smoke TESTS=TestPack
smoke:
${GO_EXECUTABLE_PATH} test -o smoke.tests -c -race -v -cover ./tests
$(SUDO) -E NYDUS_BUILDER=${NYDUS_BUILDER} NYDUS_NYDUSD=${NYDUS_NYDUSD} ./smoke.tests -test.v -test.timeout 10m -test.parallel=8 -test.run=$(TESTS)
.PHONY: integration
integration:
CGO_ENABLED=1 ${PROXY} GOOS=${GOOS} GOARCH=${GOARCH} go build -ldflags '-X "${PKG}/version.Version=${VERSION}" -extldflags "-static"' -race -v -o bin/containerd-nydus-grpc ./cmd/containerd-nydus-grpc
CGO_ENABLED=1 ${PROXY} GOOS=${GOOS} GOARCH=${GOARCH} go build -ldflags '-X "${PKG}/version.Version=${VERSION}" -extldflags "-static"' -race -v -o bin/nydus-overlayfs ./cmd/nydus-overlayfs
$(SUDO) DOCKER_BUILDKIT=1 docker build ${BUILD_ARG_E2E_DOWNLOADS_MIRROR} -t nydus-snapshotter-e2e:0.1 -f integration/Dockerfile .
$(SUDO) docker run --cap-add SYS_ADMIN --security-opt seccomp=unconfined --cgroup-parent=system.slice --cgroupns private --name nydus-snapshotter_e2e --rm --privileged -v /root/.docker:/root/.docker -v `go env GOMODCACHE`:/go/pkg/mod \
-v `go env GOCACHE`:/root/.cache/go-build -v `pwd`:/nydus-snapshotter \
-v /usr/src/linux-headers-${KERNEL_VER}:/usr/src/linux-headers-${KERNEL_VER} \
${ENV_TARGET_IMAGES_FILE} \
nydus-snapshotter-e2e:0.1
nydus-snapshotter-0.13.4/README.md 0000664 0000000 0000000 00000024565 14533742372 0016616 0 ustar 00root root 0000000 0000000 [**[⬇️ Download]**](https://github.com/containerd/nydus-snapshotter/releases)
[**[📖 Website]**](https://nydus.dev/)
[**[☸ Quick Start (Kubernetes)**]](https://github.com/containerd/nydus-snapshotter/blob/main/docs/run_nydus_in_kubernetes.md)
[**[🤓 Quick Start (nerdctl)**]](https://github.com/containerd/nerdctl/blob/master/docs/nydus.md)
[**[❓ FAQs & Troubleshooting]**](https://github.com/dragonflyoss/nydus/wiki/FAQ)
# Nydus Snapshotter
[](https://github.com/containerd/nydus-snapshotter/releases)
[](https://github.com/containerd/nydus-snapshotter/blob/main/LICENSE)
[](https://goreportcard.com/report/github.com/containerd/nydus-snapshotter)
[](https://twitter.com/dragonfly_oss)
[](https://github.com/dragonflyoss/nydus)
Nydus-snapshotter is a **non-core** sub-project of containerd.
Nydus snapshotter is an external plugin of containerd for [Nydus image service](https://nydus.dev) which implements a chunk-based content-addressable filesystem on top of a called `RAFS (Registry Acceleration File System)` format that improves the current OCI image specification, in terms of container launching speed, image space, and network bandwidth efficiency, as well as data integrity with several runtime backends: FUSE, virtiofs and in-kernel [EROFS](https://www.kernel.org/doc/html/latest/filesystems/erofs.html).
Nydus supports lazy pulling feature since pulling image is one of the time-consuming steps in the container lifecycle. Lazy pulling here means a container can run even the image is partially available and necessary chunks of the image are fetched on-demand. Apart from that, Nydus also supports [(e)Stargz](https://github.com/containerd/stargz-snapshotter) and OCI (by using [zran](https://github.com/dragonflyoss/nydus/blob/master/docs/nydus-zran.md)) lazy pulling directly **WITHOUT** any explicit conversion.
For more details about how to build Nydus container image, please refer to [nydusify](https://github.com/dragonflyoss/nydus/blob/master/docs/nydusify.md) conversion tool and [acceld](https://github.com/goharbor/acceleration-service).
## Architecture
### Architecture Based on FUSE
### Architecture Based on Fscache/Erofs
## Building
Just invoke `make` and check out the output executable binary `./bin/containerd-nydus-grpc`
```bash
make
```
## Integrate Nydus-snapshotter into Containerd
The following document will describe how to manually configure containerd + Nydus snapshotter. If you want to run Nydus snapshotter in Kubernetes cluster, you can try to use helm or run nydus snapshotter as a container. You can refer to [this documentation](./docs/run_nydus_in_kubernetes.md).
Containerd provides a general mechanism to exploit different types of snapshotters. Please ensure your containerd's version is 1.4.0 or above.
Add Nydus as a proxy plugin into containerd's configuration file which may be located at `/etc/containerd/config.toml`.
```toml
# The `address` field specifies through which socket snapshotter and containerd communicate.
[proxy_plugins]
[proxy_plugins.nydus]
type = "snapshot"
address = "/run/containerd-nydus/containerd-nydus-grpc.sock"
```
Restart your containerd service making the change take effect. Assume that your node is systemd based, restart the service as below:
```bash
systemctl restart containerd
```
### Get Nydus Binaries
Get `nydusd` `nydus-image` and `nydusctl` binaries from [nydus releases page](https://github.com/dragonflyoss/nydus/releases).
It's suggested to install the binaries to your system path. `nydusd` is FUSE userspace daemon and a vhost-user-fs backend. Nydus-snapshotter
will fork a nydusd process when necessary.
### Configure Nydus
Please follow instructions to [configure nydus](./docs/configure_nydus.md) in order to make it work properly in your environment.
### Start Nydus Snapshotter
Nydus-snapshotter is implemented as a [proxy plugin](https://github.com/containerd/containerd/blob/04985039cede6aafbb7dfb3206c9c4d04e2f924d/PLUGINS.md#proxy-plugins) (`containerd-nydus-grpc`) for containerd.
Assume your server is systemd based, install nydus-snapshotter:
Note: `nydusd` and `nydus-image` should be found from $PATH.
```bash
make install
systemctl restart containerd
```
Or you can start nydus-snapshotter manually.
```bash
# `--nydusd` specifies the path to nydusd binary. If `nydusd` and `nydus-image` are installed, `--nydusd` and `--nydus-image`can be omitted.
# Otherwise, provide them in below command line.
# `address` is the domain socket that you configured in containerd configuration file
# `--nydusd-config` is the path to `nydusd` configuration file
# The default nydus-snapshotter work directory is located at `/var/lib/containerd-nydus`
$ sudo ./containerd-nydus-grpc --config /etc/nydus/config.toml --nydusd-config /etc/nydus/nydusd-config.json --log-to-stdout
```
### Validate Nydus-snapshotter Setup
Utilize containerd's `ctr` CLI command to validate if nydus-snapshotter is set up successfully.
```bash
$ ctr -a /run/containerd/containerd.sock plugin ls
TYPE ID PLATFORMS STATUS
io.containerd.snapshotter.v1 nydus - ok
```
### Optimize Nydus Image as per Workload
Nydus usually prefetch image data to local filesystem before a real user on-demand read. It helps to improve the performance and availability. A containerd NRI plugin [container image optimizer](docs/optimize_nydus_image.md) can be used to generate nydus image building suggestions to optimize your nydus image making the nydusd runtime match your workload IO pattern. The optimized nydus image has
a better performance.
## Quickstart Container with Lazy Pulling
### Start Container on single Node
Start container using `nerdctl` (>=v0.22) which has native nydus support with `nydus-snapshotter`.
```bash
# Start container by `nerdctl`
nerdctl --snapshotter nydus run ghcr.io/dragonflyoss/image-service/nginx:nydus-latest
```
### Start Container in Kubernetes Cluster
Change containerd's CRI configuration:
```toml
[plugins."io.containerd.grpc.v1.cri".containerd]
snapshotter = "nydus"
disable_snapshot_annotations = false
```
Use `crictl` to debug starting container via Kubernetes CRI. Dry run [steps](./docs/crictl_dry_run.md) of using `crictl` can be found in [documents](./docs).
### Setup with nydus-snapshotter image
We can also use the `nydus-snapshotter` container image when we want to put Nydus stuffs inside a container. See the [nydus-snapshotter example](./misc/example/README.md) for how to setup and use it.
## Integrate with Dragonfly to Distribute Images by P2P
Nydus is a sub-project of [Dragonfly](https://github.com/dragonflyoss/Dragonfly2). So it closely works with Dragonfly to distribute container images in a fast and efficient P2P fashion to reduce network latency and lower the pressure on a single-point of the registry.
### Quickstart Dragonfly & Nydus in Kubernetes
We recommend using the Dragonfly P2P data distribution system to further improve the runtime performance of Nydus images.
If you want to deploy Dragonfly and Nydus at the same time, please refer to this **[Quick Start](https://github.com/dragonflyoss/helm-charts/blob/main/INSTALL.md)**.
### Config Dragonfly mode
Dragonfly supports both **mirror** mode and HTTP **proxy** mode to boost the containers startup. It is suggested to use Dragonfly mirror mode. To integrate with Dragonfly in the mirror mode, please provide registry mirror in nydusd's json configuration file in section `device.backend.mirrors`
```json
{
"mirrors": [
{
"host": "http://127.0.0.1:65001",
"headers": "https://index.docker.io/v1/"
}
]
}
```
### Hot updating mirror configurations
In addition to setting the registry mirror in nydusd's json configuration file, `nydus-snapshotter` also supports hot updating mirror configurations. You can set the configuration directory in nudus-snapshotter's toml configuration file with `remote.mirrors_config.dir`. The empty `remote.mirrors_config.dir` means disabling it.
```toml
[remote.mirrors_config]
dir = "/etc/nydus/certs.d"
```
Configuration file is compatible with containerd's configuration file in toml format.
```toml
[host]
[host."http://127.0.0.1:65001"]
[host."http://127.0.0.1:65001".header]
# NOTE: For Dragonfly, the HTTP scheme must be explicitly specified.
X-Dragonfly-Registry = ["https://p2p-nydus.com"]
```
Mirror configurations loaded from nydusd's json file will be overwritten before pulling image if the valid mirror configuration items loaded from `remote.mirrors_config.dir` are greater than 0.
## Community
Nydus aims to form a **vendor-neutral opensource** image distribution solution to all communities.
Questions, bug reports, technical discussion, feature requests and contribution are always welcomed!
We're very pleased to hear your use cases any time.
Feel free to reach/join us via Slack and/or Dingtalk.
- **Slack:** [Nydus Workspace](https://join.slack.com/t/nydusimageservice/shared_invite/zt-pz4qvl4y-WIh4itPNILGhPS8JqdFm_w)
- **Twitter:** [@dragonfly_oss](https://twitter.com/dragonfly_oss)
- **Dingtalk:** [34971767](https://qr.dingtalk.com/action/joingroup?code=v1,k1,ioWGzuDZEIO10Bf+/ohz4RcQqAkW0MtOwoG1nbbMxQg=&_dt_no_comment=1&origin=11)
-o ",
Action: func(c *cli.Context) error {
return run(c.Args())
},
Before: func(c *cli.Context) error {
if c.NArg() != 4 {
cli.ShowAppHelpAndExit(c, 1)
}
return nil
},
}
err := app.Run(os.Args)
if err != nil {
log.Fatal(err)
}
os.Exit(0)
}
nydus-snapshotter-0.13.4/cmd/optimizer-nri-plugin/ 0000775 0000000 0000000 00000000000 14533742372 0022172 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/cmd/optimizer-nri-plugin/main.go 0000664 0000000 0000000 00000015613 14533742372 0023453 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2023. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package main
import (
"context"
"fmt"
"io"
"log/syslog"
"os"
"path/filepath"
"strings"
"time"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"github.com/urfave/cli/v2"
"github.com/containerd/containerd/reference/docker"
"github.com/containerd/nri/pkg/api"
"github.com/containerd/nri/pkg/stub"
"github.com/containerd/nydus-snapshotter/pkg/errdefs"
"github.com/containerd/nydus-snapshotter/pkg/fanotify"
"github.com/containerd/nydus-snapshotter/version"
"github.com/pelletier/go-toml"
)
const (
defaultEvents = "StartContainer,StopContainer"
defaultServerPath = "/usr/local/bin/optimizer-server"
defaultPersistDir = "/opt/nri/optimizer/results"
)
type PluginConfig struct {
Events []string `toml:"events"`
ServerPath string `toml:"server_path"`
PersistDir string `toml:"persist_dir"`
Readable bool `toml:"readable"`
Timeout int `toml:"timeout"`
Overwrite bool `toml:"overwrite"`
}
type PluginArgs struct {
PluginName string
PluginIdx string
PluginEvents string
Config PluginConfig
}
type Flags struct {
Args *PluginArgs
F []cli.Flag
}
func buildFlags(args *PluginArgs) []cli.Flag {
return []cli.Flag{
&cli.StringFlag{
Name: "name",
Usage: "plugin name to register to NRI",
Destination: &args.PluginName,
},
&cli.StringFlag{
Name: "idx",
Usage: "plugin index to register to NRI",
Destination: &args.PluginIdx,
},
&cli.StringFlag{
Name: "events",
Value: defaultEvents,
Usage: "the events that containerd subscribes to. DO NOT CHANGE THIS.",
Destination: &args.PluginEvents,
},
&cli.StringFlag{
Name: "server-path",
Value: defaultServerPath,
Usage: "the path of optimizer server binary",
Destination: &args.Config.ServerPath,
},
&cli.StringFlag{
Name: "persist-dir",
Value: defaultPersistDir,
Usage: "the directory to persist accessed files list for container",
Destination: &args.Config.PersistDir,
},
&cli.BoolFlag{
Name: "readable",
Value: false,
Usage: "whether to make the csv file human readable",
Destination: &args.Config.Readable,
},
&cli.IntFlag{
Name: "timeout",
Value: 0,
Usage: "the timeout to kill optimizer server, 0 to disable it",
Destination: &args.Config.Timeout,
},
&cli.BoolFlag{
Name: "overwrite",
Usage: "whether to overwrite the existed persistent files",
Destination: &args.Config.Overwrite,
},
}
}
func NewPluginFlags() *Flags {
var args PluginArgs
return &Flags{
Args: &args,
F: buildFlags(&args),
}
}
type plugin struct {
stub stub.Stub
mask stub.EventMask
}
var (
cfg PluginConfig
log *logrus.Logger
logWriter *syslog.Writer
_ = stub.ConfigureInterface(&plugin{})
globalFanotifyServer = make(map[string]*fanotify.Server)
)
const (
imageNameLabel = "io.kubernetes.cri.image-name"
)
func (p *plugin) Configure(config, runtime, version string) (stub.EventMask, error) {
log.Infof("got configuration data: %q from runtime %s %s", config, runtime, version)
if config == "" {
return p.mask, nil
}
tree, err := toml.Load(config)
if err != nil {
return 0, errors.Wrap(err, "parse TOML")
}
if err := tree.Unmarshal(&cfg); err != nil {
return 0, err
}
p.mask, err = api.ParseEventMask(cfg.Events...)
if err != nil {
return 0, errors.Wrap(err, "parse events in configuration")
}
log.Infof("configuration: %#v", cfg)
return p.mask, nil
}
func (p *plugin) StartContainer(_ *api.PodSandbox, container *api.Container) error {
dir, imageName, err := GetImageName(container.Annotations)
if err != nil {
return err
}
persistDir := filepath.Join(cfg.PersistDir, dir)
if err := os.MkdirAll(persistDir, os.ModePerm); err != nil {
return err
}
persistFile := filepath.Join(persistDir, imageName)
if cfg.Timeout > 0 {
persistFile = fmt.Sprintf("%s.timeout%ds", persistFile, cfg.Timeout)
}
fanotifyServer := fanotify.NewServer(cfg.ServerPath, container.Pid, imageName, persistFile, cfg.Readable, cfg.Overwrite, time.Duration(cfg.Timeout)*time.Second, logWriter)
if err := fanotifyServer.RunServer(); err != nil {
return err
}
globalFanotifyServer[imageName] = fanotifyServer
return nil
}
func (p *plugin) StopContainer(_ *api.PodSandbox, container *api.Container) ([]*api.ContainerUpdate, error) {
var update = []*api.ContainerUpdate{}
_, imageName, err := GetImageName(container.Annotations)
if err != nil {
return update, err
}
if fanotifyServer, ok := globalFanotifyServer[imageName]; ok {
fanotifyServer.StopServer()
} else {
return nil, errors.New("can not find fanotify server for container image " + imageName)
}
return update, nil
}
func GetImageName(annotations map[string]string) (string, string, error) {
named, err := docker.ParseDockerRef(annotations[imageNameLabel])
if err != nil {
return "", "", err
}
nameTagged := named.(docker.NamedTagged)
repo := docker.Path(nameTagged)
dir := filepath.Dir(repo)
image := filepath.Base(repo)
imageName := image + ":" + nameTagged.Tag()
return dir, imageName, nil
}
func (p *plugin) onClose() {
for _, fanotifyServer := range globalFanotifyServer {
fanotifyServer.StopServer()
}
os.Exit(0)
}
func main() {
flags := NewPluginFlags()
app := &cli.App{
Name: "optimizer-nri-plugin",
Usage: "Optimizer client for NRI plugin to manage optimizer server",
Version: version.Version,
Flags: flags.F,
HideVersion: true,
Action: func(c *cli.Context) error {
var (
opts []stub.Option
err error
)
cfg = flags.Args.Config
log = logrus.StandardLogger()
log.SetFormatter(&logrus.TextFormatter{
PadLevelText: true,
})
logWriter, err = syslog.New(syslog.LOG_INFO, "optimizer-nri-plugin")
if err == nil {
log.SetOutput(io.MultiWriter(os.Stdout, logWriter))
}
if flags.Args.PluginName != "" {
opts = append(opts, stub.WithPluginName(flags.Args.PluginName))
}
if flags.Args.PluginIdx != "" {
opts = append(opts, stub.WithPluginIdx(flags.Args.PluginIdx))
}
p := &plugin{}
if p.mask, err = api.ParseEventMask(flags.Args.PluginEvents); err != nil {
log.Fatalf("failed to parse events: %v", err)
}
cfg.Events = strings.Split(flags.Args.PluginEvents, ",")
if p.stub, err = stub.New(p, append(opts, stub.WithOnClose(p.onClose))...); err != nil {
log.Fatalf("failed to create plugin stub: %v", err)
}
err = p.stub.Run(context.Background())
if err != nil {
log.Errorf("plugin exited with error %v", err)
os.Exit(1)
}
return nil
},
}
if err := app.Run(os.Args); err != nil {
if errdefs.IsConnectionClosed(err) {
log.Info("optimizer NRI plugin exited")
} else {
log.WithError(err).Fatal("failed to start optimizer NRI plugin")
}
}
}
nydus-snapshotter-0.13.4/cmd/prefetchfiles-nri-plugin/ 0000775 0000000 0000000 00000000000 14533742372 0022773 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/cmd/prefetchfiles-nri-plugin/main.go 0000664 0000000 0000000 00000011505 14533742372 0024250 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2023. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package main
import (
"context"
"fmt"
"io"
"log/syslog"
"net"
"net/http"
"os"
"path/filepath"
"strings"
"github.com/containerd/nri/pkg/api"
"github.com/containerd/nri/pkg/stub"
"github.com/pelletier/go-toml"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"github.com/urfave/cli/v2"
"github.com/containerd/nydus-snapshotter/pkg/errdefs"
"github.com/containerd/nydus-snapshotter/version"
)
const (
endpointPrefetch = "/api/v1/prefetch"
defaultEvents = "RunPodSandbox"
defaultSystemControllerAddress = "/run/containerd-nydus/system.sock"
defaultPrefetchConfigDir = "/etc/nydus"
nydusPrefetchAnnotation = "containerd.io/nydus-prefetch"
)
type PluginArgs struct {
PluginName string
PluginIdx string
SocketAddress string
}
type Flags struct {
Args *PluginArgs
Flag []cli.Flag
}
func buildFlags(args *PluginArgs) []cli.Flag {
return []cli.Flag{
&cli.StringFlag{
Name: "name",
Usage: "plugin name to register to NRI",
Destination: &args.PluginName,
},
&cli.StringFlag{
Name: "idx",
Usage: "plugin index to register to NRI",
Destination: &args.PluginIdx,
},
&cli.StringFlag{
Name: "socket-addr",
Value: defaultSystemControllerAddress,
Usage: "unix domain socket address. If defined in the configuration file, there is no need to add ",
Destination: &args.SocketAddress,
},
}
}
func NewPluginFlags() *Flags {
var args PluginArgs
return &Flags{
Args: &args,
Flag: buildFlags(&args),
}
}
type plugin struct {
stub stub.Stub
mask stub.EventMask
}
var (
globalSocket string
log *logrus.Logger
logWriter *syslog.Writer
)
// sendDataOverHTTP sends the prefetch data to the specified endpoint over HTTP using a Unix socket.
func sendDataOverHTTP(data string, endpoint, sock string) error {
url := fmt.Sprintf("http://unix%s", endpoint)
req, err := http.NewRequest(http.MethodPut, url, strings.NewReader(data))
if err != nil {
return err
}
client := &http.Client{
Transport: &http.Transport{
DialContext: func(_ context.Context, _, _ string) (net.Conn, error) {
return net.Dial("unix", sock)
},
},
}
resp, err := client.Do(req)
if err != nil {
return err
}
if resp.StatusCode != http.StatusOK {
return fmt.Errorf("failed to send data, status code: %d", resp.StatusCode)
}
resp.Body.Close()
return nil
}
func (p *plugin) RunPodSandbox(pod *api.PodSandbox) error {
prefetchList, ok := pod.Annotations[nydusPrefetchAnnotation]
if !ok {
return nil
}
err := sendDataOverHTTP(prefetchList, endpointPrefetch, globalSocket)
if err != nil {
log.Errorf("failed to send data: %v", err)
return err
}
return nil
}
func main() {
flags := NewPluginFlags()
app := &cli.App{
Name: "prefetch-nri-plugin",
Usage: "NRI plugin for obtaining and transmitting prefetch files path",
Version: version.Version,
Flags: flags.Flag,
HideVersion: true,
Action: func(c *cli.Context) error {
var (
opts []stub.Option
err error
)
log = logrus.StandardLogger()
configFileName := "prefetchConfig.toml"
configDir := defaultPrefetchConfigDir
configFilePath := filepath.Join(configDir, configFileName)
config, err := toml.LoadFile(configFilePath)
if err != nil {
log.Warnf("failed to read config file: %v", err)
}
configSocketAddrRaw := config.Get("file_prefetch.socket_address")
if configSocketAddrRaw != nil {
if configSocketAddr, ok := configSocketAddrRaw.(string); ok {
globalSocket = configSocketAddr
} else {
log.Warnf("failed to read config: 'file_prefetch.socket_address' is not a string")
}
} else {
globalSocket = flags.Args.SocketAddress
}
log.SetFormatter(&logrus.TextFormatter{
PadLevelText: true,
})
logWriter, err = syslog.New(syslog.LOG_INFO, "prefetch-nri-plugin")
if err == nil {
log.SetOutput(io.MultiWriter(os.Stdout, logWriter))
}
if flags.Args.PluginName != "" {
opts = append(opts, stub.WithPluginName(flags.Args.PluginName))
}
if flags.Args.PluginIdx != "" {
opts = append(opts, stub.WithPluginIdx(flags.Args.PluginIdx))
}
p := &plugin{}
if p.mask, err = api.ParseEventMask(defaultEvents); err != nil {
log.Fatalf("failed to parse events: %v", err)
}
if p.stub, err = stub.New(p, opts...); err != nil {
log.Fatalf("failed to create plugin stub: %v", err)
}
err = p.stub.Run(context.Background())
if err != nil {
return errors.Wrap(err, "plugin exited")
}
return nil
},
}
if err := app.Run(os.Args); err != nil {
if errdefs.IsConnectionClosed(err) {
log.Info("prefetch NRI plugin exited")
} else {
log.WithError(err).Fatal("failed to start prefetch NRI plugin")
}
}
}
nydus-snapshotter-0.13.4/config/ 0000775 0000000 0000000 00000000000 14533742372 0016570 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/config/config.go 0000664 0000000 0000000 00000026746 14533742372 0020403 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package config
import (
"os"
"github.com/imdario/mergo"
"github.com/pelletier/go-toml"
"github.com/pkg/errors"
"github.com/containerd/nydus-snapshotter/internal/constant"
"github.com/containerd/nydus-snapshotter/internal/flags"
"github.com/containerd/nydus-snapshotter/pkg/cgroup"
"github.com/containerd/nydus-snapshotter/pkg/errdefs"
"github.com/containerd/nydus-snapshotter/pkg/utils/file"
"github.com/containerd/nydus-snapshotter/pkg/utils/parser"
"github.com/containerd/nydus-snapshotter/pkg/utils/sysinfo"
)
func init() {
recoverPolicyParser = map[string]DaemonRecoverPolicy{
RecoverPolicyNone.String(): RecoverPolicyNone,
RecoverPolicyRestart.String(): RecoverPolicyRestart,
RecoverPolicyFailover.String(): RecoverPolicyFailover}
}
// Define a policy how to fork nydusd daemon and attach file system instances to serve.
type DaemonMode string
const (
// Spawn a dedicated nydusd for each RAFS instance.
DaemonModeMultiple DaemonMode = DaemonMode(constant.DaemonModeMultiple)
// Spawn a dedicated nydusd for each RAFS instance.
DaemonModeDedicated DaemonMode = DaemonMode(constant.DaemonModeDedicated)
// Share a global nydusd to serve all RAFS instances.
DaemonModeShared DaemonMode = DaemonMode(constant.DaemonModeShared)
// Do not spawn nydusd for RAFS instances.
//
// For tarfs and rund, there's no need to create nydusd to serve RAFS instances,
// the snapshotter just returns mount slices with additional information for runC/runD
// to manage those snapshots.
DaemonModeNone DaemonMode = DaemonMode(constant.DaemonModeNone)
DaemonModeInvalid DaemonMode = DaemonMode(constant.DaemonModeInvalid)
)
func parseDaemonMode(m string) (DaemonMode, error) {
switch m {
case string(DaemonModeMultiple):
return DaemonModeDedicated, nil
case string(DaemonModeDedicated):
return DaemonModeDedicated, nil
case string(DaemonModeShared):
return DaemonModeShared, nil
case string(DaemonModeNone):
return DaemonModeNone, nil
default:
return DaemonModeInvalid, errors.Errorf("invalid daemon mode %q", m)
}
}
type DaemonRecoverPolicy int
const (
RecoverPolicyInvalid DaemonRecoverPolicy = iota
RecoverPolicyNone
RecoverPolicyRestart
RecoverPolicyFailover
)
func (p DaemonRecoverPolicy) String() string {
switch p {
case RecoverPolicyNone:
return "none"
case RecoverPolicyRestart:
return "restart"
case RecoverPolicyFailover:
return "failover"
case RecoverPolicyInvalid:
fallthrough
default:
return ""
}
}
var recoverPolicyParser map[string]DaemonRecoverPolicy
func ParseRecoverPolicy(p string) (DaemonRecoverPolicy, error) {
policy, ok := recoverPolicyParser[p]
if !ok {
return RecoverPolicyInvalid, errors.Errorf("invalid recover policy %q", p)
}
return policy, nil
}
const (
FsDriverBlockdev string = constant.FsDriverBlockdev
FsDriverFusedev string = constant.FsDriverFusedev
FsDriverFscache string = constant.FsDriverFscache
FsDriverNodev string = constant.FsDriverNodev
FsDriverProxy string = constant.FsDriverProxy
)
type Experimental struct {
EnableStargz bool `toml:"enable_stargz"`
EnableReferrerDetect bool `toml:"enable_referrer_detect"`
TarfsConfig TarfsConfig `toml:"tarfs"`
}
type TarfsConfig struct {
EnableTarfs bool `toml:"enable_tarfs"`
MountTarfsOnHost bool `toml:"mount_tarfs_on_host"`
TarfsHint bool `toml:"tarfs_hint"`
MaxConcurrentProc int `toml:"max_concurrent_proc"`
ExportMode string `toml:"export_mode"`
}
type CgroupConfig struct {
Enable bool `toml:"enable"`
MemoryLimit string `toml:"memory_limit"`
}
// Configure how to start and recover nydusd daemons
type DaemonConfig struct {
NydusdPath string `toml:"nydusd_path"`
NydusdConfigPath string `toml:"nydusd_config"`
NydusImagePath string `toml:"nydusimage_path"`
RecoverPolicy string `toml:"recover_policy"`
FsDriver string `toml:"fs_driver"`
ThreadsNumber int `toml:"threads_number"`
LogRotationSize int `toml:"log_rotation_size"`
}
type LoggingConfig struct {
LogToStdout bool `toml:"log_to_stdout"`
LogLevel string `toml:"level"`
LogDir string `toml:"dir"`
RotateLogMaxSize int `toml:"log_rotation_max_size"`
RotateLogMaxBackups int `toml:"log_rotation_max_backups"`
RotateLogMaxAge int `toml:"log_rotation_max_age"`
RotateLogLocalTime bool `toml:"log_rotation_local_time"`
RotateLogCompress bool `toml:"log_rotation_compress"`
}
// Nydus image layers additional process
type ImageConfig struct {
PublicKeyFile string `toml:"public_key_file"`
ValidateSignature bool `toml:"validate_signature"`
}
// Configure containerd snapshots interfaces and how to process the snapshots
// requests from containerd
type SnapshotConfig struct {
EnableNydusOverlayFS bool `toml:"enable_nydus_overlayfs"`
EnableKataVolume bool `toml:"enable_kata_volume"`
SyncRemove bool `toml:"sync_remove"`
}
// Configure cache manager that manages the cache files lifecycle
type CacheManagerConfig struct {
Disable bool `toml:"disable"`
// Trigger GC gc_period after the specified period.
// Example format: 24h, 120min
GCPeriod string `toml:"gc_period"`
CacheDir string `toml:"cache_dir"`
}
// Configure how nydus-snapshotter receive auth information
type AuthConfig struct {
// based on kubeconfig or ServiceAccount
EnableKubeconfigKeychain bool `toml:"enable_kubeconfig_keychain"`
KubeconfigPath string `toml:"kubeconfig_path"`
// CRI proxy mode
EnableCRIKeychain bool `toml:"enable_cri_keychain"`
ImageServiceAddress string `toml:"image_service_address"`
}
// Configure remote storage like container registry
type RemoteConfig struct {
AuthConfig AuthConfig `toml:"auth"`
ConvertVpcRegistry bool `toml:"convert_vpc_registry"`
SkipSSLVerify bool `toml:"skip_ssl_verify"`
MirrorsConfig MirrorsConfig `toml:"mirrors_config"`
}
type MirrorsConfig struct {
Dir string `toml:"dir"`
}
type MetricsConfig struct {
Address string `toml:"address"`
}
type DebugConfig struct {
ProfileDuration int64 `toml:"daemon_cpu_profile_duration_secs"`
PprofAddress string `toml:"pprof_address"`
}
type SystemControllerConfig struct {
Enable bool `toml:"enable"`
Address string `toml:"address"`
DebugConfig DebugConfig `toml:"debug"`
}
type SnapshotterConfig struct {
// Configuration format version
Version int `toml:"version"`
// Snapshotter's root work directory
Root string `toml:"root"`
Address string `toml:"address"`
DaemonMode string `toml:"daemon_mode"`
// Clean up all the resources when snapshotter is closed
CleanupOnClose bool `toml:"cleanup_on_close"`
SystemControllerConfig SystemControllerConfig `toml:"system"`
MetricsConfig MetricsConfig `toml:"metrics"`
DaemonConfig DaemonConfig `toml:"daemon"`
SnapshotsConfig SnapshotConfig `toml:"snapshot"`
RemoteConfig RemoteConfig `toml:"remote"`
ImageConfig ImageConfig `toml:"image"`
CacheManagerConfig CacheManagerConfig `toml:"cache_manager"`
LoggingConfig LoggingConfig `toml:"log"`
CgroupConfig CgroupConfig `toml:"cgroup"`
Experimental Experimental `toml:"experimental"`
}
func LoadSnapshotterConfig(path string) (*SnapshotterConfig, error) {
var config SnapshotterConfig
// get nydus-snapshotter configuration from specified path of toml file
if path == "" {
return nil, errors.New("snapshotter configuration path cannot be empty")
}
tree, err := toml.LoadFile(path)
if err != nil {
return nil, errors.Wrapf(err, "load toml configuration from file %q", path)
}
if err = tree.Unmarshal(&config); err != nil {
return nil, errors.Wrap(err, "unmarshal snapshotter configuration")
}
if config.Version != 1 {
return nil, errors.Errorf("unsupported configuration version %d", config.Version)
}
return &config, nil
}
func MergeConfig(to, from *SnapshotterConfig) error {
err := mergo.Merge(to, from)
if err != nil {
return err
}
return nil
}
func ValidateConfig(c *SnapshotterConfig) error {
if c == nil {
return errors.Wrapf(errdefs.ErrInvalidArgument, "configuration is none")
}
if c.ImageConfig.ValidateSignature {
if c.ImageConfig.PublicKeyFile == "" {
return errors.New("public key file for signature validation is not provided")
} else if _, err := os.Stat(c.ImageConfig.PublicKeyFile); err != nil {
return errors.Wrapf(err, "check publicKey file %q", c.ImageConfig.PublicKeyFile)
}
}
if len(c.Root) == 0 {
return errors.New("empty root directory")
}
if c.DaemonConfig.FsDriver != FsDriverFscache && c.DaemonConfig.FsDriver != FsDriverFusedev &&
c.DaemonConfig.FsDriver != FsDriverBlockdev && c.DaemonConfig.FsDriver != FsDriverNodev &&
c.DaemonConfig.FsDriver != FsDriverProxy {
return errors.Errorf("invalid filesystem driver %q", c.DaemonConfig.FsDriver)
}
if _, err := ParseRecoverPolicy(c.DaemonConfig.RecoverPolicy); err != nil {
return err
}
if c.DaemonConfig.ThreadsNumber > 1024 {
return errors.Errorf("nydusd worker thread number %d is too big, max 1024", c.DaemonConfig.ThreadsNumber)
}
if c.RemoteConfig.AuthConfig.EnableCRIKeychain && c.RemoteConfig.AuthConfig.EnableKubeconfigKeychain {
return errors.Wrapf(errdefs.ErrInvalidArgument,
"\"enable_cri_keychain\" and \"enable_kubeconfig_keychain\" can't be set at the same time")
}
if c.RemoteConfig.MirrorsConfig.Dir != "" {
dirExisted, err := file.IsDirExisted(c.RemoteConfig.MirrorsConfig.Dir)
if err != nil {
return err
}
if !dirExisted {
return errors.Errorf("mirrors config directory %s does not exist", c.RemoteConfig.MirrorsConfig.Dir)
}
}
return nil
}
// Parse command line arguments and fill the nydus-snapshotter configuration
// Always let options from CLI override those from configuration file.
func ParseParameters(args *flags.Args, cfg *SnapshotterConfig) error {
// --- essential configuration
if args.Address != "" {
cfg.Address = args.Address
}
if args.RootDir != "" {
cfg.Root = args.RootDir
}
// Give --shared-daemon higher priority
if args.DaemonMode != "" {
cfg.DaemonMode = args.DaemonMode
}
// --- image processor configuration
// empty
// --- daemon configuration
daemonConfig := &cfg.DaemonConfig
if args.NydusdConfigPath != "" {
daemonConfig.NydusdConfigPath = args.NydusdConfigPath
}
if args.NydusdPath != "" {
daemonConfig.NydusdPath = args.NydusdPath
}
if args.NydusImagePath != "" {
daemonConfig.NydusImagePath = args.NydusImagePath
}
if args.FsDriver != "" {
daemonConfig.FsDriver = args.FsDriver
}
// --- cache manager configuration
// empty
// --- logging configuration
logConfig := &cfg.LoggingConfig
if args.LogLevel != "" {
logConfig.LogLevel = args.LogLevel
}
if args.LogToStdoutCount > 0 {
logConfig.LogToStdout = args.LogToStdout
}
// --- remote storage configuration
// empty
// --- snapshot configuration
// empty
// --- metrics configuration
// empty
return nil
}
func ParseCgroupConfig(config CgroupConfig) (cgroup.Config, error) {
totalMemory, err := sysinfo.GetTotalMemoryBytes()
if err != nil {
return cgroup.Config{}, errors.Wrap(err, "Failed to get total memory bytes")
}
memoryLimitInBytes, err := parser.MemoryConfigToBytes(config.MemoryLimit, totalMemory)
if err != nil {
return cgroup.Config{}, err
}
return cgroup.Config{
MemoryLimitInBytes: memoryLimitInBytes,
}, nil
}
nydus-snapshotter-0.13.4/config/config_test.go 0000664 0000000 0000000 00000017335 14533742372 0021434 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2023. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package config
import (
"path/filepath"
"testing"
"time"
"github.com/containerd/nydus-snapshotter/internal/constant"
"github.com/containerd/nydus-snapshotter/internal/flags"
"github.com/stretchr/testify/assert"
)
func TestLoadSnapshotterTOMLConfig(t *testing.T) {
A := assert.New(t)
cfg, err := LoadSnapshotterConfig("../misc/snapshotter/config.toml")
A.NoError(err)
exampleConfig := SnapshotterConfig{
Version: 1,
Root: "/var/lib/containerd-nydus",
Address: "/run/containerd-nydus/containerd-nydus-grpc.sock",
DaemonMode: "dedicated",
Experimental: Experimental{
EnableStargz: false,
EnableReferrerDetect: false,
},
CleanupOnClose: false,
SystemControllerConfig: SystemControllerConfig{
Enable: true,
Address: "/run/containerd-nydus/system.sock",
DebugConfig: DebugConfig{
ProfileDuration: 5,
PprofAddress: "",
},
},
DaemonConfig: DaemonConfig{
NydusdPath: "/usr/local/bin/nydusd",
NydusImagePath: "/usr/local/bin/nydus-image",
FsDriver: "fusedev",
RecoverPolicy: "restart",
NydusdConfigPath: "/etc/nydus/nydusd-config.fusedev.json",
ThreadsNumber: 4,
LogRotationSize: 100,
},
SnapshotsConfig: SnapshotConfig{
EnableNydusOverlayFS: false,
SyncRemove: false,
},
RemoteConfig: RemoteConfig{
ConvertVpcRegistry: false,
AuthConfig: AuthConfig{
EnableKubeconfigKeychain: false,
KubeconfigPath: "",
},
MirrorsConfig: MirrorsConfig{
Dir: "",
},
},
ImageConfig: ImageConfig{
PublicKeyFile: "",
ValidateSignature: false,
},
CacheManagerConfig: CacheManagerConfig{
Disable: false,
GCPeriod: "24h",
CacheDir: "",
},
LoggingConfig: LoggingConfig{
LogLevel: "info",
RotateLogCompress: true,
RotateLogLocalTime: true,
RotateLogMaxAge: 7,
RotateLogMaxBackups: 5,
RotateLogMaxSize: 100,
LogToStdout: false,
},
MetricsConfig: MetricsConfig{
Address: ":9110",
},
CgroupConfig: CgroupConfig{
Enable: true,
MemoryLimit: "",
},
}
A.EqualValues(cfg, &exampleConfig)
var args = flags.Args{}
args.RootDir = "/var/lib/containerd/nydus"
exampleConfig.Root = "/var/lib/containerd/nydus"
err = ParseParameters(&args, cfg)
A.NoError(err)
A.EqualValues(cfg, &exampleConfig)
A.EqualValues(cfg.LoggingConfig.LogToStdout, false)
args.LogToStdout = true
args.LogToStdoutCount = 1
err = ParseParameters(&args, cfg)
A.NoError(err)
A.EqualValues(cfg.LoggingConfig.LogToStdout, true)
err = ProcessConfigurations(cfg)
A.NoError(err)
A.Equal(GetCacheGCPeriod(), time.Hour*24)
}
func TestSnapshotterConfig(t *testing.T) {
A := assert.New(t)
var cfg SnapshotterConfig
var args flags.Args
// The log_to_stdout is false in toml file without --log-to-stdout flag.
// Expected false.
cfg.LoggingConfig.LogToStdout = false
args.LogToStdoutCount = 0
err := ParseParameters(&args, &cfg)
A.NoError(err)
A.EqualValues(cfg.LoggingConfig.LogToStdout, false)
// The log_to_stdout is true in toml file without --log-to-stdout flag.
// Expected true.
// This case is failed.
cfg.LoggingConfig.LogToStdout = true
args.LogToStdoutCount = 0
err = ParseParameters(&args, &cfg)
A.NoError(err)
A.EqualValues(cfg.LoggingConfig.LogToStdout, true)
// The log_to_stdout is false in toml file with --log-to-stdout=true.
// Expected true (command flag has higher priority).
args.LogToStdout = true
args.LogToStdoutCount = 1
cfg.LoggingConfig.LogToStdout = false
err = ParseParameters(&args, &cfg)
A.NoError(err)
A.EqualValues(cfg.LoggingConfig.LogToStdout, true)
// The log_to_stdout is true in toml file with --log-to-stdout=true.
// Expected true (command flag has higher priority).
args.LogToStdout = true
args.LogToStdoutCount = 1
cfg.LoggingConfig.LogToStdout = true
err = ParseParameters(&args, &cfg)
A.NoError(err)
A.EqualValues(cfg.LoggingConfig.LogToStdout, true)
// The log_to_stdout is false in toml file with --log-to-stdout=false.
// Expected false (command flag has higher priority).
args.LogToStdout = false
args.LogToStdoutCount = 1
cfg.LoggingConfig.LogToStdout = false
err = ParseParameters(&args, &cfg)
A.NoError(err)
A.EqualValues(cfg.LoggingConfig.LogToStdout, false)
// The log_to_stdout is true in toml file with --log-to-stdout=false.
// Expected false (command flag has higher priority).
args.LogToStdout = false
args.LogToStdoutCount = 1
cfg.LoggingConfig.LogToStdout = true
err = ParseParameters(&args, &cfg)
A.NoError(err)
A.EqualValues(cfg.LoggingConfig.LogToStdout, false)
}
func TestMergeConfig(t *testing.T) {
A := assert.New(t)
var defaultSnapshotterConfig SnapshotterConfig
var snapshotterConfig1 SnapshotterConfig
err := defaultSnapshotterConfig.FillUpWithDefaults()
A.NoError(err)
err = MergeConfig(&snapshotterConfig1, &defaultSnapshotterConfig)
A.NoError(err)
A.Equal(snapshotterConfig1.Root, constant.DefaultRootDir)
A.Equal(snapshotterConfig1.LoggingConfig.LogDir, "")
A.Equal(snapshotterConfig1.CacheManagerConfig.CacheDir, "")
A.Equal(snapshotterConfig1.DaemonMode, constant.DefaultDaemonMode)
A.Equal(snapshotterConfig1.SystemControllerConfig.Address, constant.DefaultSystemControllerAddress)
A.Equal(snapshotterConfig1.LoggingConfig.LogLevel, constant.DefaultLogLevel)
A.Equal(snapshotterConfig1.LoggingConfig.RotateLogMaxSize, constant.DefaultRotateLogMaxSize)
A.Equal(snapshotterConfig1.LoggingConfig.RotateLogMaxBackups, constant.DefaultRotateLogMaxBackups)
A.Equal(snapshotterConfig1.LoggingConfig.RotateLogMaxAge, constant.DefaultRotateLogMaxAge)
A.Equal(snapshotterConfig1.LoggingConfig.RotateLogCompress, constant.DefaultRotateLogCompress)
A.Equal(snapshotterConfig1.DaemonConfig.NydusdConfigPath, constant.DefaultNydusDaemonConfigPath)
A.Equal(snapshotterConfig1.DaemonConfig.RecoverPolicy, RecoverPolicyRestart.String())
A.Equal(snapshotterConfig1.CacheManagerConfig.GCPeriod, constant.DefaultGCPeriod)
var snapshotterConfig2 SnapshotterConfig
snapshotterConfig2.Root = "/snapshotter/root"
err = MergeConfig(&snapshotterConfig2, &defaultSnapshotterConfig)
A.NoError(err)
A.Equal(snapshotterConfig2.Root, "/snapshotter/root")
A.Equal(snapshotterConfig2.LoggingConfig.LogDir, "")
A.Equal(snapshotterConfig2.CacheManagerConfig.CacheDir, "")
}
func TestProcessConfigurations(t *testing.T) {
A := assert.New(t)
var defaultSnapshotterConfig SnapshotterConfig
var snapshotterConfig1 SnapshotterConfig
err := defaultSnapshotterConfig.FillUpWithDefaults()
A.NoError(err)
err = MergeConfig(&snapshotterConfig1, &defaultSnapshotterConfig)
A.NoError(err)
err = ValidateConfig(&snapshotterConfig1)
A.NoError(err)
err = ProcessConfigurations(&snapshotterConfig1)
A.NoError(err)
A.Equal(snapshotterConfig1.LoggingConfig.LogDir, filepath.Join(snapshotterConfig1.Root, "logs"))
A.Equal(snapshotterConfig1.CacheManagerConfig.CacheDir, filepath.Join(snapshotterConfig1.Root, "cache"))
var snapshotterConfig2 SnapshotterConfig
snapshotterConfig2.Root = "/snapshotter/root"
err = MergeConfig(&snapshotterConfig2, &defaultSnapshotterConfig)
A.NoError(err)
err = ValidateConfig(&snapshotterConfig2)
A.NoError(err)
err = ProcessConfigurations(&snapshotterConfig2)
A.NoError(err)
A.Equal(snapshotterConfig2.LoggingConfig.LogDir, filepath.Join(snapshotterConfig2.Root, "logs"))
A.Equal(snapshotterConfig2.CacheManagerConfig.CacheDir, filepath.Join(snapshotterConfig2.Root, "cache"))
var snapshotterConfig3 SnapshotterConfig
snapshotterConfig3.Root = "./snapshotter/root"
err = MergeConfig(&snapshotterConfig3, &defaultSnapshotterConfig)
A.NoError(err)
err = ValidateConfig(&snapshotterConfig3)
A.NoError(err)
err = ProcessConfigurations(&snapshotterConfig3)
A.NoError(err)
}
nydus-snapshotter-0.13.4/config/daemonconfig/ 0000775 0000000 0000000 00000000000 14533742372 0021221 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/config/daemonconfig/daemonconfig.go 0000664 0000000 0000000 00000013333 14533742372 0024204 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package daemonconfig
import (
"encoding/json"
"os"
"github.com/pkg/errors"
"github.com/containerd/nydus-snapshotter/config"
"github.com/containerd/nydus-snapshotter/pkg/auth"
"github.com/containerd/nydus-snapshotter/pkg/utils/registry"
)
type StorageBackendType = string
const (
backendTypeLocalfs StorageBackendType = "localfs"
backendTypeOss StorageBackendType = "oss"
backendTypeRegistry StorageBackendType = "registry"
)
type DaemonConfig interface {
// Provide stuffs relevant to accessing registry apart from auth
Supplement(host, repo, snapshotID string, params map[string]string)
// Provide auth
FillAuth(kc *auth.PassKeyChain)
StorageBackend() (StorageBackendType, *BackendConfig)
UpdateMirrors(mirrorsConfigDir, registryHost string) error
DumpString() (string, error)
DumpFile(path string) error
}
// Daemon configurations factory
func NewDaemonConfig(fsDriver, path string) (DaemonConfig, error) {
switch fsDriver {
case config.FsDriverFscache:
cfg, err := LoadFscacheConfig(path)
if err != nil {
return nil, err
}
return cfg, nil
case config.FsDriverFusedev:
cfg, err := LoadFuseConfig(path)
if err != nil {
return nil, err
}
return cfg, nil
default:
return nil, errors.Errorf("unsupported, fs driver %q", fsDriver)
}
}
type MirrorConfig struct {
Host string `json:"host,omitempty"`
Headers map[string]string `json:"headers,omitempty"`
HealthCheckInterval int `json:"health_check_interval,omitempty"`
FailureLimit uint8 `json:"failure_limit,omitempty"`
PingURL string `json:"ping_url,omitempty"`
}
type BackendConfig struct {
// Localfs backend configs
BlobFile string `json:"blob_file,omitempty"`
Dir string `json:"dir,omitempty"`
ReadAhead bool `json:"readahead"`
ReadAheadSec int `json:"readahead_sec,omitempty"`
// Registry backend configs
Host string `json:"host,omitempty"`
Repo string `json:"repo,omitempty"`
Auth string `json:"auth,omitempty"`
RegistryToken string `json:"registry_token,omitempty"`
BlobURLScheme string `json:"blob_url_scheme,omitempty"`
BlobRedirectedHost string `json:"blob_redirected_host,omitempty"`
Mirrors []MirrorConfig `json:"mirrors,omitempty"`
// OSS backend configs
EndPoint string `json:"endpoint,omitempty"`
AccessKeyID string `json:"access_key_id,omitempty"`
AccessKeySecret string `json:"access_key_secret,omitempty"`
BucketName string `json:"bucket_name,omitempty"`
ObjectPrefix string `json:"object_prefix,omitempty"`
// Shared by registry and oss backend
Scheme string `json:"scheme,omitempty"`
SkipVerify bool `json:"skip_verify,omitempty"`
// Below configs are common configs shared by all backends
Proxy struct {
URL string `json:"url,omitempty"`
Fallback bool `json:"fallback"`
PingURL string `json:"ping_url,omitempty"`
CheckInterval int `json:"check_interval,omitempty"`
UseHTTP bool `json:"use_http,omitempty"`
} `json:"proxy,omitempty"`
Timeout int `json:"timeout,omitempty"`
ConnectTimeout int `json:"connect_timeout,omitempty"`
RetryLimit int `json:"retry_limit,omitempty"`
}
type DeviceConfig struct {
Backend struct {
BackendType string `json:"type"`
Config BackendConfig `json:"config"`
} `json:"backend"`
Cache struct {
CacheType string `json:"type"`
Compressed bool `json:"compressed,omitempty"`
Config struct {
WorkDir string `json:"work_dir"`
DisableIndexedMap bool `json:"disable_indexed_map"`
} `json:"config"`
} `json:"cache"`
}
// For nydusd as FUSE daemon. Serialize Daemon info and persist to a json file
// We don't have to persist configuration file for fscache since its configuration
// is passed through HTTP API.
func DumpConfigFile(c interface{}, path string) error {
b, err := json.Marshal(c)
if err != nil {
return errors.Wrapf(err, "marshal config")
}
return os.WriteFile(path, b, 0600)
}
func DumpConfigString(c interface{}) (string, error) {
b, err := json.Marshal(c)
return string(b), err
}
// Achieve a daemon configuration from template or snapshotter's configuration
func SupplementDaemonConfig(c DaemonConfig, imageID, snapshotID string,
vpcRegistry bool, labels map[string]string, params map[string]string) error {
image, err := registry.ParseImage(imageID)
if err != nil {
return errors.Wrapf(err, "parse image %s", imageID)
}
backendType, _ := c.StorageBackend()
switch backendType {
case backendTypeRegistry:
registryHost := image.Host
if vpcRegistry {
registryHost = registry.ConvertToVPCHost(registryHost)
} else if registryHost == "docker.io" {
// For docker.io images, we should use index.docker.io
registryHost = "index.docker.io"
}
if err := c.UpdateMirrors(config.GetMirrorsConfigDir(), registryHost); err != nil {
return errors.Wrap(err, "update mirrors config")
}
// If no auth is provided, don't touch auth from provided nydusd configuration file.
// We don't validate the original nydusd auth from configuration file since it can be empty
// when repository is public.
keyChain := auth.GetRegistryKeyChain(registryHost, imageID, labels)
c.Supplement(registryHost, image.Repo, snapshotID, params)
c.FillAuth(keyChain)
// Localfs and OSS backends don't need any update,
// just use the provided config in template
case backendTypeLocalfs:
case backendTypeOss:
default:
return errors.Errorf("unknown backend type %s", backendType)
}
return nil
}
nydus-snapshotter-0.13.4/config/daemonconfig/daemonconfig_test.go 0000664 0000000 0000000 00000003005 14533742372 0025236 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package daemonconfig
import (
"encoding/json"
"testing"
"github.com/stretchr/testify/require"
)
func TestLoadConfig(t *testing.T) {
buf := []byte(`{
"device": {
"backend": {
"type": "registry",
"config": {
"skip_verify": true,
"host": "acr-nydus-registry-vpc.cn-hangzhou.cr.aliyuncs.com",
"repo": "test/myserver",
"auth": "",
"blob_url_scheme": "http",
"proxy": {
"url": "http://p2p-proxy:65001",
"fallback": true,
"ping_url": "http://p2p-proxy:40901/server/ping",
"check_interval": 5
},
"timeout": 5,
"connect_timeout": 5,
"retry_limit": 0
}
},
"cache": {
"type": "blobcache",
"config": {
"work_dir": "/cache"
}
}
},
"mode": "direct",
"digest_validate": true,
"iostats_files": true,
"enable_xattr": true,
"fs_prefetch": {
"enable": true,
"threads_count": 10,
"merging_size": 131072
}
}`)
var cfg FuseDaemonConfig
err := json.Unmarshal(buf, &cfg)
require.Nil(t, err)
require.Equal(t, cfg.FSPrefetch.Enable, true)
require.Equal(t, cfg.FSPrefetch.MergingSize, 131072)
require.Equal(t, cfg.FSPrefetch.ThreadsCount, 10)
require.Equal(t, cfg.Device.Backend.Config.BlobURLScheme, "http")
require.Equal(t, cfg.Device.Backend.Config.SkipVerify, true)
require.Equal(t, cfg.Device.Backend.Config.Proxy.CheckInterval, 5)
}
nydus-snapshotter-0.13.4/config/daemonconfig/fscache.go 0000664 0000000 0000000 00000006376 14533742372 0023160 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package daemonconfig
import (
"encoding/json"
"os"
"path"
"github.com/containerd/containerd/log"
"github.com/containerd/nydus-snapshotter/pkg/auth"
"github.com/containerd/nydus-snapshotter/pkg/utils/erofs"
"github.com/pkg/errors"
)
const (
WorkDir string = "workdir"
Bootstrap string = "bootstrap"
)
type BlobPrefetchConfig struct {
Enable bool `json:"enable"`
ThreadsCount int `json:"threads_count"`
MergingSize int `json:"merging_size"`
BandwidthRate int `json:"bandwidth_rate"`
}
type FscacheDaemonConfig struct {
// These fields is only for fscache daemon.
Type string `json:"type"`
// Snapshotter fills
ID string `json:"id"`
DomainID string `json:"domain_id"`
Config *struct {
ID string `json:"id"`
BackendType string `json:"backend_type"`
BackendConfig BackendConfig `json:"backend_config"`
CacheType string `json:"cache_type"`
// Snapshotter fills
CacheConfig struct {
WorkDir string `json:"work_dir"`
} `json:"cache_config"`
BlobPrefetchConfig BlobPrefetchConfig `json:"prefetch_config"`
MetadataPath string `json:"metadata_path"`
} `json:"config"`
}
// Load Fscache configuration template file
func LoadFscacheConfig(p string) (*FscacheDaemonConfig, error) {
var cfg FscacheDaemonConfig
b, err := os.ReadFile(p)
if err != nil {
return nil, errors.Wrapf(err, "read fscache configuration file %s", p)
}
if err = json.Unmarshal(b, &cfg); err != nil {
return nil, errors.Wrapf(err, "unmarshal")
}
if cfg.Config == nil {
return nil, errors.New("invalid fscache configuration")
}
return &cfg, nil
}
func (c *FscacheDaemonConfig) UpdateMirrors(mirrorsConfigDir, registryHost string) error {
mirrors, err := LoadMirrorsConfig(mirrorsConfigDir, registryHost)
if err != nil {
return err
}
if len(mirrors) > 0 {
c.Config.BackendConfig.Mirrors = mirrors
}
return nil
}
func (c *FscacheDaemonConfig) StorageBackend() (string, *BackendConfig) {
return c.Config.BackendType, &c.Config.BackendConfig
}
// Each fscache/erofs has a configuration with different fscache ID built from snapshot ID.
func (c *FscacheDaemonConfig) Supplement(host, repo, snapshotID string, params map[string]string) {
c.Config.BackendConfig.Host = host
c.Config.BackendConfig.Repo = repo
fscacheID := erofs.FscacheID(snapshotID)
c.ID = fscacheID
if c.DomainID != "" {
log.L.Warnf("Linux Kernel Shared Domain feature in use. make sure your kernel version >= 6.1")
} else {
c.DomainID = fscacheID
}
c.Config.ID = fscacheID
if WorkDir, ok := params[WorkDir]; ok {
c.Config.CacheConfig.WorkDir = WorkDir
}
if bootstrap, ok := params[Bootstrap]; ok {
c.Config.MetadataPath = bootstrap
}
}
func (c *FscacheDaemonConfig) FillAuth(kc *auth.PassKeyChain) {
if kc != nil {
if kc.TokenBase() {
c.Config.BackendConfig.RegistryToken = kc.Password
} else {
c.Config.BackendConfig.Auth = kc.ToBase64()
}
}
}
func (c *FscacheDaemonConfig) DumpString() (string, error) {
return DumpConfigString(c)
}
func (c *FscacheDaemonConfig) DumpFile(f string) error {
if err := os.MkdirAll(path.Dir(f), 0755); err != nil {
return err
}
return DumpConfigFile(c, f)
}
nydus-snapshotter-0.13.4/config/daemonconfig/fuse.go 0000664 0000000 0000000 00000005465 14533742372 0022524 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package daemonconfig
import (
"encoding/json"
"os"
"path"
"github.com/pkg/errors"
"github.com/containerd/nydus-snapshotter/pkg/auth"
)
const CacheDir string = "cachedir"
// Used when nydusd works as a FUSE daemon or vhost-user-fs backend
type FuseDaemonConfig struct {
Device *DeviceConfig `json:"device"`
Mode string `json:"mode"`
DigestValidate bool `json:"digest_validate"`
IOStatsFiles bool `json:"iostats_files,omitempty"`
EnableXattr bool `json:"enable_xattr,omitempty"`
AccessPattern bool `json:"access_pattern,omitempty"`
LatestReadFiles bool `json:"latest_read_files,omitempty"`
FSPrefetch `json:"fs_prefetch,omitempty"`
// (experimental) The nydus daemon could cache more data to increase hit ratio when enabled the warmup feature.
Warmup uint64 `json:"warmup,omitempty"`
}
// Control how to perform prefetch from file system layer
type FSPrefetch struct {
Enable bool `json:"enable"`
PrefetchAll bool `json:"prefetch_all"`
ThreadsCount int `json:"threads_count"`
MergingSize int `json:"merging_size"`
BandwidthRate int `json:"bandwidth_rate"`
}
// Load fuse daemon configuration from template file
func LoadFuseConfig(p string) (*FuseDaemonConfig, error) {
b, err := os.ReadFile(p)
if err != nil {
return nil, errors.Wrapf(err, "read FUSE configuration file %s", p)
}
var cfg FuseDaemonConfig
if err := json.Unmarshal(b, &cfg); err != nil {
return nil, errors.Wrapf(err, "unmarshal %s", p)
}
if cfg.Device == nil {
return nil, errors.New("invalid fuse daemon configuration")
}
return &cfg, nil
}
func (c *FuseDaemonConfig) Supplement(host, repo, snapshotID string, params map[string]string) {
c.Device.Backend.Config.Host = host
c.Device.Backend.Config.Repo = repo
c.Device.Cache.Config.WorkDir = params[CacheDir]
}
func (c *FuseDaemonConfig) FillAuth(kc *auth.PassKeyChain) {
if kc != nil {
if kc.TokenBase() {
c.Device.Backend.Config.RegistryToken = kc.Password
} else {
c.Device.Backend.Config.Auth = kc.ToBase64()
}
}
}
func (c *FuseDaemonConfig) UpdateMirrors(mirrorsConfigDir, registryHost string) error {
mirrors, err := LoadMirrorsConfig(mirrorsConfigDir, registryHost)
if err != nil {
return err
}
if len(mirrors) > 0 {
c.Device.Backend.Config.Mirrors = mirrors
}
return nil
}
func (c *FuseDaemonConfig) StorageBackend() (string, *BackendConfig) {
return c.Device.Backend.BackendType, &c.Device.Backend.Config
}
func (c *FuseDaemonConfig) DumpString() (string, error) {
return DumpConfigString(c)
}
func (c *FuseDaemonConfig) DumpFile(f string) error {
if err := os.MkdirAll(path.Dir(f), 0755); err != nil {
return err
}
return DumpConfigFile(c, f)
}
nydus-snapshotter-0.13.4/config/daemonconfig/mirrors.go 0000664 0000000 0000000 00000014131 14533742372 0023245 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2023. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package daemonconfig
import (
"fmt"
"net/http"
"net/url"
"os"
"path/filepath"
"sort"
"strings"
"github.com/containerd/containerd/log"
"github.com/pelletier/go-toml"
"github.com/pkg/errors"
)
// Copied from containerd, for compatibility with containerd's toml configuration file.
type HostFileConfig struct {
Capabilities []string `toml:"capabilities"`
CACert interface{} `toml:"ca"`
Client interface{} `toml:"client"`
SkipVerify *bool `toml:"skip_verify"`
Header map[string]interface{} `toml:"header"`
OverridePath bool `toml:"override_path"`
// The following configuration items are specific to nydus.
HealthCheckInterval int `toml:"health_check_interval,omitempty"`
FailureLimit uint8 `toml:"failure_limit,omitempty"`
PingURL string `toml:"ping_url,omitempty"`
}
type hostConfig struct {
Scheme string
Host string
Header http.Header
HealthCheckInterval int
FailureLimit uint8
PingURL string
}
func makeStringSlice(slice []interface{}, cb func(string) string) ([]string, error) {
out := make([]string, len(slice))
for i, value := range slice {
str, ok := value.(string)
if !ok {
return nil, fmt.Errorf("unable to cast %v to string", value)
}
if cb != nil {
out[i] = cb(str)
} else {
out[i] = str
}
}
return out, nil
}
func parseMirrorsConfig(hosts []hostConfig) []MirrorConfig {
var parsedMirrors = make([]MirrorConfig, len(hosts))
for i, host := range hosts {
parsedMirrors[i].Host = fmt.Sprintf("%s://%s", host.Scheme, host.Host)
parsedMirrors[i].HealthCheckInterval = host.HealthCheckInterval
parsedMirrors[i].FailureLimit = host.FailureLimit
parsedMirrors[i].PingURL = host.PingURL
if len(host.Header) > 0 {
mirrorHeader := make(map[string]string, len(host.Header))
for key, value := range host.Header {
if len(value) > 1 {
log.L.Warnf("some values of the header[%q] are omitted: %#v", key, value[1:])
}
mirrorHeader[key] = host.Header.Get(key)
}
parsedMirrors[i].Headers = mirrorHeader
}
}
return parsedMirrors
}
// hostDirectory converts ":port" to "_port_" in directory names
func hostDirectory(host string) string {
idx := strings.LastIndex(host, ":")
if idx > 0 {
return host[:idx] + "_" + host[idx+1:] + "_"
}
return host
}
func hostPaths(root, host string) []string {
var hosts []string
ch := hostDirectory(host)
if ch != host {
hosts = append(hosts, filepath.Join(root, ch))
}
return append(hosts,
filepath.Join(root, host),
filepath.Join(root, "_default"),
)
}
func hostDirFromRoot(root, host string) (string, error) {
for _, p := range hostPaths(root, host) {
if _, err := os.Stat(p); err == nil {
return p, nil
} else if !os.IsNotExist(err) {
return "", err
}
}
return "", nil
}
// getSortedHosts returns the list of hosts as they defined in the file.
func getSortedHosts(root *toml.Tree) ([]string, error) {
iter, ok := root.Get("host").(*toml.Tree)
if !ok {
return nil, errors.New("invalid `host` tree")
}
list := append([]string{}, iter.Keys()...)
// go-toml stores TOML sections in the map object, so no order guaranteed.
// We retrieve line number for each key and sort the keys by position.
sort.Slice(list, func(i, j int) bool {
h1 := iter.GetPath([]string{list[i]}).(*toml.Tree)
h2 := iter.GetPath([]string{list[j]}).(*toml.Tree)
return h1.Position().Line < h2.Position().Line
})
return list, nil
}
// parseHostConfig returns the parsed host configuration, make sure the server is not null.
func parseHostConfig(server string, config HostFileConfig) (hostConfig, error) {
var (
result = hostConfig{}
err error
)
if !strings.HasPrefix(server, "http") {
server = "https://" + server
}
u, err := url.Parse(server)
if err != nil {
return hostConfig{}, fmt.Errorf("unable to parse server %v: %w", server, err)
}
result.Scheme = u.Scheme
result.Host = u.Host
if config.Header != nil {
header := http.Header{}
for key, ty := range config.Header {
switch value := ty.(type) {
case string:
header[key] = []string{value}
case []interface{}:
header[key], err = makeStringSlice(value, nil)
if err != nil {
return hostConfig{}, err
}
default:
return hostConfig{}, fmt.Errorf("invalid type %v for header %q", ty, key)
}
}
result.Header = header
}
result.HealthCheckInterval = config.HealthCheckInterval
result.FailureLimit = config.FailureLimit
result.PingURL = config.PingURL
return result, nil
}
func parseHostsFile(b []byte) ([]hostConfig, error) {
tree, err := toml.LoadBytes(b)
if err != nil {
return nil, fmt.Errorf("failed to parse TOML: %w", err)
}
c := struct {
// HostConfigs store the per-host configuration
HostConfigs map[string]HostFileConfig `toml:"host"`
}{}
orderedHosts, err := getSortedHosts(tree)
if err != nil {
return nil, err
}
var (
hosts []hostConfig
)
if err := tree.Unmarshal(&c); err != nil {
return nil, err
}
// Parse hosts array
for _, host := range orderedHosts {
if host != "" {
config := c.HostConfigs[host]
parsed, err := parseHostConfig(host, config)
if err != nil {
return nil, err
}
hosts = append(hosts, parsed)
}
}
return hosts, nil
}
func loadHostDir(hostsDir string) ([]hostConfig, error) {
b, err := os.ReadFile(filepath.Join(hostsDir, "hosts.toml"))
if err != nil {
if !os.IsNotExist(err) {
return nil, err
}
return []hostConfig{}, nil
}
hosts, err := parseHostsFile(b)
if err != nil {
return nil, err
}
return hosts, nil
}
func LoadMirrorsConfig(mirrorsConfigDir, registryHost string) ([]MirrorConfig, error) {
var mirrors []MirrorConfig
if mirrorsConfigDir == "" {
return mirrors, nil
}
hostDir, err := hostDirFromRoot(mirrorsConfigDir, registryHost)
if err != nil {
return nil, err
}
if hostDir == "" {
return mirrors, nil
}
hostConfig, err := loadHostDir(hostDir)
if err != nil {
return nil, err
}
mirrors = append(mirrors, parseMirrorsConfig(hostConfig)...)
return mirrors, nil
}
nydus-snapshotter-0.13.4/config/daemonconfig/mirrors_test.go 0000664 0000000 0000000 00000005426 14533742372 0024313 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2023. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package daemonconfig
import (
"os"
"path/filepath"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestLoadMirrorConfig(t *testing.T) {
tmpDir := t.TempDir()
defer os.RemoveAll(tmpDir)
registryHost := "registry.docker.io"
mirrorsConfigDir := filepath.Join(tmpDir, "certs.d")
registryHostConfigDir := filepath.Join(mirrorsConfigDir, registryHost)
defaultHostConfigDir := filepath.Join(mirrorsConfigDir, "_default")
mirrors, err := LoadMirrorsConfig("", registryHost)
require.NoError(t, err)
require.Nil(t, mirrors)
mirrors, err = LoadMirrorsConfig(mirrorsConfigDir, registryHost)
require.NoError(t, err)
require.Nil(t, mirrors)
err = os.MkdirAll(defaultHostConfigDir, os.ModePerm)
assert.NoError(t, err)
mirrors, err = LoadMirrorsConfig(mirrorsConfigDir, registryHost)
require.NoError(t, err)
require.Nil(t, mirrors)
buf1 := []byte(`server = "https://default-docker.hub.com"
[host]
[host."http://default-p2p-mirror1:65001"]
[host."http://default-p2p-mirror1:65001".header]
X-Dragonfly-Registry = ["https://default-docker.hub.com"]
`)
err = os.WriteFile(filepath.Join(defaultHostConfigDir, "hosts.toml"), buf1, 0600)
assert.NoError(t, err)
mirrors, err = LoadMirrorsConfig(mirrorsConfigDir, registryHost)
require.NoError(t, err)
require.Equal(t, len(mirrors), 1)
require.Equal(t, mirrors[0].Host, "http://default-p2p-mirror1:65001")
require.Equal(t, mirrors[0].Headers["X-Dragonfly-Registry"], "https://default-docker.hub.com")
err = os.MkdirAll(registryHostConfigDir, os.ModePerm)
assert.NoError(t, err)
buf2 := []byte(`server = "https://docker.hub.com"
[host]
[host."http://p2p-mirror1:65001"]
[host."http://p2p-mirror1:65001".header]
X-Dragonfly-Registry = ["https://docker.hub.com"]
`)
err = os.WriteFile(filepath.Join(registryHostConfigDir, "hosts.toml"), buf2, 0600)
assert.NoError(t, err)
mirrors, err = LoadMirrorsConfig(mirrorsConfigDir, registryHost)
require.NoError(t, err)
require.Equal(t, len(mirrors), 1)
require.Equal(t, mirrors[0].Host, "http://p2p-mirror1:65001")
require.Equal(t, mirrors[0].Headers["X-Dragonfly-Registry"], "https://docker.hub.com")
buf3 := []byte(`
[host."http://p2p-mirror2:65001"]
[host."http://p2p-mirror2:65001".header]
X-Dragonfly-Registry = ["https://docker.hub.com"]
`)
err = os.WriteFile(filepath.Join(registryHostConfigDir, "hosts.toml"), buf3, 0600)
assert.NoError(t, err)
mirrors, err = LoadMirrorsConfig(mirrorsConfigDir, registryHost)
require.NoError(t, err)
require.Equal(t, len(mirrors), 1)
require.Equal(t, mirrors[0].Host, "http://p2p-mirror2:65001")
require.Equal(t, mirrors[0].Headers["X-Dragonfly-Registry"], "https://docker.hub.com")
}
nydus-snapshotter-0.13.4/config/default.go 0000664 0000000 0000000 00000003620 14533742372 0020544 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2023. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package config
import (
"os/exec"
"github.com/containerd/nydus-snapshotter/internal/constant"
)
func (c *SnapshotterConfig) FillUpWithDefaults() error {
c.Version = 1
c.Root = constant.DefaultRootDir
c.Address = constant.DefaultAddress
// essential configuration
if c.DaemonMode == "" {
c.DaemonMode = constant.DefaultDaemonMode
}
// system controller configuration
c.SystemControllerConfig.Address = constant.DefaultSystemControllerAddress
// logging configuration
logConfig := &c.LoggingConfig
if logConfig.LogLevel == "" {
logConfig.LogLevel = constant.DefaultLogLevel
}
logConfig.RotateLogMaxSize = constant.DefaultRotateLogMaxSize
logConfig.RotateLogMaxBackups = constant.DefaultRotateLogMaxBackups
logConfig.RotateLogMaxAge = constant.DefaultRotateLogMaxAge
logConfig.RotateLogLocalTime = constant.DefaultRotateLogLocalTime
logConfig.RotateLogCompress = constant.DefaultRotateLogCompress
// daemon configuration
daemonConfig := &c.DaemonConfig
if daemonConfig.NydusdConfigPath == "" {
daemonConfig.NydusdConfigPath = constant.DefaultNydusDaemonConfigPath
}
daemonConfig.RecoverPolicy = RecoverPolicyRestart.String()
daemonConfig.FsDriver = constant.DefaultFsDriver
daemonConfig.LogRotationSize = constant.DefaultDaemonRotateLogMaxSize
// cache configuration
cacheConfig := &c.CacheManagerConfig
if cacheConfig.GCPeriod == "" {
cacheConfig.GCPeriod = constant.DefaultGCPeriod
}
return c.SetupNydusBinaryPaths()
}
func (c *SnapshotterConfig) SetupNydusBinaryPaths() error {
// resolve nydusd path
if path, err := exec.LookPath(constant.NydusdBinaryName); err == nil {
c.DaemonConfig.NydusdPath = path
}
// resolve nydus-image path
if path, err := exec.LookPath(constant.NydusImageBinaryName); err == nil {
c.DaemonConfig.NydusImagePath = path
}
return nil
}
nydus-snapshotter-0.13.4/config/global.go 0000664 0000000 0000000 00000013105 14533742372 0020357 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2023. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
// Expose configurations across nydus-snapshotter, the configurations is parsed
// and extracted from nydus-snapshotter toml based configuration file or command line
package config
import (
"os"
"path/filepath"
"time"
"github.com/containerd/containerd/log"
"github.com/pkg/errors"
"github.com/containerd/nydus-snapshotter/internal/logging"
"github.com/containerd/nydus-snapshotter/pkg/utils/mount"
)
var (
globalConfig GlobalConfig
)
// Global cached configuration information to help:
// - access configuration information without passing a configuration object
// - avoid frequent generation of information from configuration information
type GlobalConfig struct {
origin *SnapshotterConfig
SnapshotsDir string
DaemonMode DaemonMode
SocketRoot string
ConfigRoot string
RootMountpoint string
DaemonThreadsNum int
CacheGCPeriod time.Duration
MirrorsConfig MirrorsConfig
}
func IsFusedevSharedModeEnabled() bool {
return globalConfig.DaemonMode == DaemonModeShared
}
func GetDaemonMode() DaemonMode {
return globalConfig.DaemonMode
}
func GetSnapshotsRootDir() string {
return globalConfig.SnapshotsDir
}
func GetRootMountpoint() string {
return globalConfig.RootMountpoint
}
func GetSocketRoot() string {
return globalConfig.SocketRoot
}
func GetConfigRoot() string {
return globalConfig.ConfigRoot
}
func GetMirrorsConfigDir() string {
return globalConfig.MirrorsConfig.Dir
}
func GetFsDriver() string {
return globalConfig.origin.DaemonConfig.FsDriver
}
func GetCacheGCPeriod() time.Duration {
return globalConfig.CacheGCPeriod
}
func GetLogDir() string {
return globalConfig.origin.LoggingConfig.LogDir
}
func GetLogLevel() string {
return globalConfig.origin.LoggingConfig.LogLevel
}
func GetDaemonLogRotationSize() int {
return globalConfig.origin.DaemonConfig.LogRotationSize
}
func GetDaemonThreadsNumber() int {
return globalConfig.origin.DaemonConfig.ThreadsNumber
}
func GetLogToStdout() bool {
return globalConfig.origin.LoggingConfig.LogToStdout
}
func IsSystemControllerEnabled() bool {
return globalConfig.origin.SystemControllerConfig.Enable
}
func SystemControllerAddress() string {
return globalConfig.origin.SystemControllerConfig.Address
}
func SystemControllerPprofAddress() string {
return globalConfig.origin.SystemControllerConfig.DebugConfig.PprofAddress
}
func GetDaemonProfileCPUDuration() int64 {
return globalConfig.origin.SystemControllerConfig.DebugConfig.ProfileDuration
}
func GetSkipSSLVerify() bool {
return globalConfig.origin.RemoteConfig.SkipSSLVerify
}
const (
TarfsLayerVerityOnly string = "layer_verity_only"
TarfsImageVerityOnly string = "image_verity_only"
TarfsLayerBlockDevice string = "layer_block"
TarfsImageBlockDevice string = "image_block"
TarfsLayerBlockWithVerity string = "layer_block_with_verity"
TarfsImageBlockWithVerity string = "image_block_with_verity"
)
func GetTarfsMountOnHost() bool {
return globalConfig.origin.Experimental.TarfsConfig.MountTarfsOnHost
}
func GetTarfsExportEnabled() bool {
switch globalConfig.origin.Experimental.TarfsConfig.ExportMode {
case TarfsLayerVerityOnly, TarfsLayerBlockDevice, TarfsLayerBlockWithVerity:
return true
case TarfsImageVerityOnly, TarfsImageBlockDevice, TarfsImageBlockWithVerity:
return true
default:
return false
}
}
// Returns (wholeImage, generateBlockImage, withVerityInfo)
// wholeImage: generate tarfs for the whole image instead of of a specific layer.
// generateBlockImage: generate a block image file.
// withVerityInfo: generate disk verity information.
func GetTarfsExportFlags() (bool, bool, bool) {
switch globalConfig.origin.Experimental.TarfsConfig.ExportMode {
case "layer_verity_only":
return false, false, true
case "image_verity_only":
return true, false, true
case "layer_block":
return false, true, false
case "image_block":
return true, true, false
case "layer_block_with_verity":
return false, true, true
case "image_block_with_verity":
return true, true, true
default:
return false, false, false
}
}
func ProcessConfigurations(c *SnapshotterConfig) error {
if c.LoggingConfig.LogDir == "" {
c.LoggingConfig.LogDir = filepath.Join(c.Root, logging.DefaultLogDirName)
}
if c.CacheManagerConfig.CacheDir == "" {
c.CacheManagerConfig.CacheDir = filepath.Join(c.Root, "cache")
}
globalConfig.origin = c
globalConfig.SnapshotsDir = filepath.Join(c.Root, "snapshots")
globalConfig.ConfigRoot = filepath.Join(c.Root, "config")
globalConfig.SocketRoot = filepath.Join(c.Root, "socket")
globalConfig.RootMountpoint = filepath.Join(c.Root, "mnt")
globalConfig.MirrorsConfig = c.RemoteConfig.MirrorsConfig
if c.CacheManagerConfig.GCPeriod != "" {
d, err := time.ParseDuration(c.CacheManagerConfig.GCPeriod)
if err != nil {
return errors.Errorf("invalid GC period '%s'", c.CacheManagerConfig.GCPeriod)
}
globalConfig.CacheGCPeriod = d
}
m, err := parseDaemonMode(c.DaemonMode)
if err != nil {
return err
}
if c.DaemonConfig.FsDriver == FsDriverFscache && m != DaemonModeShared {
log.L.Infof("fscache driver only supports 'shared' mode, override daemon mode from '%s' to 'shared'", m)
m = DaemonModeShared
}
globalConfig.DaemonMode = m
return nil
}
func SetUpEnvironment(c *SnapshotterConfig) error {
if err := os.MkdirAll(c.Root, 0700); err != nil {
return errors.Wrapf(err, "create root dir %s", c.Root)
}
realPath, err := mount.NormalizePath(c.Root)
if err != nil {
return errors.Wrapf(err, "invalid root path")
}
c.Root = realPath
return nil
}
nydus-snapshotter-0.13.4/docs/ 0000775 0000000 0000000 00000000000 14533742372 0016253 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/docs/configure_nydus.md 0000664 0000000 0000000 00000014166 14533742372 0022010 0 ustar 00root root 0000000 0000000 # Configure Nydus-snapshotter
Nydus-snapshotter can receive a toml file as its configurations to start providing image service through CLI parameter `--config`. An example configuration file can be found [here](../misc/snapshotter/config.toml). Besides nydus-snapshotter's configuration, `nydusd`'s configuration has to be provided to nydus-snapshotter too. Nydusd is started by nydus-snapshotter and it is configured by the provided json configuration file. A minimal configuration file can be found [here](../misc/snapshotter/nydusd-config.fusedev.json)
## Authentication
As [containerd#3731](https://github.com/containerd/containerd/issues/3731) discussed, containerd doesn't share credentials with third snapshotters now. Like [stargz snapshotter](https://github.com/containerd/stargz-snapshotter/blob/main/docs/overview.md#authentication), nydus-snapshotter supports 3 main ways to access registries with custom configurations. You can use configuration file to enable them.
The snapshotter will try to get image pull keychain in the following order if such way is enabled:
1. intercept CRI request and extract private registry auth
2. docker config (default enabled)
3. k8s docker config secret
### dockerconfig-based authentication
By default, the snapshotter tries to get credentials from `$DOCKER_CONFIG` or `~/.docker/config.json`.
Following example enables nydus-snapshotter to access to private registries using `docker login` command.
```console
# docker login
(Enter username and password)
# crictl pull --creds USERNAME[:PASSWORD] docker.io//ubuntu:22.04
(Here the credential is only used by containerd)
```
### CRI-based authentication
Following configuration enables nydus-snapshotter to pull private images via CRI requests.
```toml
[remote.auth]
# Fetch the private registry auth as CRI image service proxy
enable_cri_keychain = true
image_service_address = "/run/containerd/containerd.sock"
```
The snapshotter works as a proxy of CRI Image Service and exposes CRI Image Service API on the snapshotter's unix socket (i.e. `/run/containerd/containerd-nydus-grpc.sock`). The snapshotter acquires registry creds by scanning requests.
The `image_service_address` is the original image service socket. It can be omitted and the default value will be the containerd's default socket path `/run/containerd/containerd.sock`.
You **must** specify `--image-service-endpoint=unix:///run/containerd-nydus/containerd-nydus-grpc.sock` option to kubelet when using Kubernetes. Or specify `image-endpoint: "unix:////run/containerd-nydus/containerd-nydus-grpc.sock"` in `crictl.yaml` when using `crictl`.
### kubeconfig-based authentication
This is another way to enable lazy pulling of private images on Kubernetes, Nydus snapshotter will start a goroutine to listen on secrets (type = `kubernetes.io/dockerconfigjson`) for private registries.
#### use kubeconfig file
Following configuration enables nydus-snapshotter to access to private registries using kubernetes secrets in the cluster using kubeconfig files.
```toml
[remote.auth]
enable_kubeconfig_keychain = true
kubeconfig_path = "/path/to/.kubeconfig"
```
If no `kubeconfig_path` is specified, snapshotter searches kubeconfig files from `$KUBECONFIG` or `~/.kube/config`.
Please note that kubeconfig-based authentication requires additional privilege (i.e. kubeconfig to list/watch secrets) to the node.
And this doesn't work if `kubelet` retrieve credentials from somewhere not API server (e.g. [credential provider](https://kubernetes.io/docs/tasks/kubelet-credential-provider/kubelet-credential-provider/)).
#### use ServiceAccount
If your Nydus snapshotter runs in a Kubernetes cluster and you don't want to use kubeconfig, you can also choose to use ServiceAccount to configure the corresponding permissions for Nydus snapshotter.
```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: nydus-snapshotter-sa
namespace: nydus-system
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: nydus-snapshotter-role
rules:
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- list
- watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: nydus-snapshotter-role-binding
roleRef:
kind: ClusterRole
name: nydus-snapshotter-role
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: nydus-snapshotter-sa
namespace: nydus-system
```
Then you can set the desired ServiceAccount with the required permissions fro your Nydus snapshotter Pod:
```yaml
apiVersion: v1
kind: Pod
metadata:
name: nydus-snapshotter
namespace: nydus-system
spec:
containers:
name: nydus-snapshotter
serviceAccountName: nydus-snapshotter-sa
...
```
#### create secrets
If you have logged into a private registry, you can create a secret from the config file:
```bash
$ kubectl create --namespace nydus-system secret generic regcred \
--from-file=.dockerconfigjson=$HOME/.docker/config.json \
--type=kubernetes.io/dockerconfigjson
```
The Nydus snapshotter will get the new secret and parse the authorization. If your new Pod uses a private registry, then this authentication information will be used to pull the image from the private registry.
## Metrics
Nydusd records metrics in its own format. The metrics are exported via a HTTP server on top of unix domain socket. Nydus-snapshotter fetches the metrics and convert them in to Prometheus format which is exported via a network address. Nydus-snapshotter by default does not fetch metrics from nydusd. You can enable the nydusd metrics download by assigning a network address to `metrics.address` in nydus-snapshotter's toml [configuration file](../misc/snapshotter/config.toml).
Once this entry is enabled, not only nydusd metrics, but also some information about the nydus-snapshotter
runtime and snapshot related events are exported in Prometheus format as well.
## Diagnose
A system controller can be ran insides nydus-snapshotter.
By setting `system.enable` to `true`, nydus-snapshotter will start a simple HTTP server on unix domain socket `system.address` path and exports some internal working status to users. The address defaults to `/var/run/containerd-nydus/system.sock`
nydus-snapshotter-0.13.4/docs/crictl_dry_run.md 0000664 0000000 0000000 00000002147 14533742372 0021623 0 ustar 00root root 0000000 0000000 # Start Container by crictl
## Create crictl Config
The runtime endpoint can be set in the config file. Please refer to [crictl](https://github.com/kubernetes-sigs/cri-tools/blob/master/docs/crictl.md) document for more details.
Compose your `crictl` configuration file named as `crictl.yaml`:
```yml
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: true
```
Compose a pod configuration which can be named as `pod.yaml`
```yml
metadata:
attempt: 1
name: nydus-sandbox
namespace: default
uid: hdishd83djaidwnduwk28bcsb
log_directory: /tmp
linux:
security_context:
namespace_options:
network: 2
```
Compose a container configuration which can be named as `container.yaml`
```yml
metadata:
name: nydus-container
image:
image:
command:
- /bin/sleep
args:
- 600
log_path: container.1.log
```
Start a container based on nydus image.
```bash
# auth is base64 encoded string from "username:password"
$ crictl --config ./crictl.yaml run --auth ./container.yaml ./pod.yaml
```
nydus-snapshotter-0.13.4/docs/diagram/ 0000775 0000000 0000000 00000000000 14533742372 0017657 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/docs/diagram/nydus_fscache_erofs_arch.svg 0000664 0000000 0000000 00000056626 14533742372 0025430 0 ustar 00root root 0000000 0000000 snapshotter plugin nydusd containerd container erofs Registry Pull Bootstrap/Meta Layer Data overlayfs stacked Posix File Interfaces container Kernel Annotations Mount Slice Snapshot IDs P2P cluster/ Dragonfly auth CRI cachefiles fscache erofs overlayfs stacked snapshotter plugin nydusd containerd container fuse Registry Pull Bootstrap/Meta Layer Data overlayfs stacked Posix File Interfaces container Kernel FUSE daemon nydusd nydusd Annotations Mount Slice Snapshot IDs container P2P cluster auth CRI NRI adaptation Optimizer （client） Optimizer server （image1） Optimizer server （image2） CRI runtime low level runtime （runc/kata） container OCI Spec kubelet accessed files list （in order） OCI image optimized nydus image
Arguments:
source from which to build the RAFS filesystem
Options:
-L, --log-file
Log file path
-t, --type
Conversion type: [default: dir-rafs] [possible values: directory, dir-rafs, estargz-rafs, estargz-ref, estargztoc-ref, tar-rafs, tar-tarfs, targz-rafs, targz-ref, stargz_index]
-B, --bootstrap
File path to save the generated RAFS metadata blob
-l, --log-level
Log level: [default: info] [possible values: trace, debug, info, warn, error]
-D, --blob-dir
Directory path to save generated RAFS metadata and data blobs
-b, --blob
File path to save the generated RAFS data blob
--blob-inline-meta
Inline RAFS metadata and blob metadata into the data blob
--blob-id
OSS object id for the generated RAFS data blob
--blob-data-size
Set data blob size for 'estargztoc-ref' conversion
--chunk-size
Set the size of data chunks, must be power of two and between 0x1000-0x1000000:
--batch-size
Set the batch size to merge small chunks, must be power of two, between 0x1000-0x1000000 or be zero: [default: 0]
--compressor
Algorithm to compress data chunks: [default: zstd] [possible values: none, lz4_block, zstd]
--digester
Algorithm to digest data chunks: [default: blake3] [possible values: blake3, sha256]
-C, --config
Configuration file for storage backend, cache and RAFS FUSE filesystem.
-v, --fs-version
Set RAFS format version number: [default: 6] [possible values: 5, 6]
--features
Enable/disable features [possible values: blob-toc]
--chunk-dict
File path of chunk dictionary for data deduplication
--parent-bootstrap
File path of the parent/referenced RAFS metadata blob (optional)
--aligned-chunk
Align uncompressed data chunks to 4K, only for RAFS V5
--repeatable
Generate reproducible RAFS metadata
--whiteout-spec
Set the type of whiteout specification: [default: oci] [possible values: oci, overlayfs, none]
--prefetch-policy
Set data prefetch policy [default: none] [possible values: fs, blob, none]
-J, --output-json
File path to save operation result in JSON format
-h, --help
Print help information
`),
},
{
name: "'--batch-size' is supported in v2.2.0-239-gf5c08fcf",
feature: FeatureBatchSize,
expect: true,
helpMsg: []byte(`
Create RAFS filesystems from directories, tar files or OCI images
Usage: nydus-image create [OPTIONS]
Arguments:
source from which to build the RAFS filesystem
Options:
-L, --log-file
Log file path
-t, --type
Conversion type: [default: dir-rafs] [possible values: directory, dir-rafs, estargz-rafs, estargz-ref, estargztoc-ref, tar-rafs, tar-tarfs, targz-rafs, targz-ref, stargz_index]
-B, --bootstrap
File path to save the generated RAFS metadata blob
-l, --log-level
Log level: [default: info] [possible values: trace, debug, info, warn, error]
-D, --blob-dir
Directory path to save generated RAFS metadata and data blobs
-b, --blob
File path to save the generated RAFS data blob
--blob-inline-meta
Inline RAFS metadata and blob metadata into the data blob
--blob-id
OSS object id for the generated RAFS data blob
--blob-data-size
Set data blob size for 'estargztoc-ref' conversion
--chunk-size
Set the size of data chunks, must be power of two and between 0x1000-0x1000000:
--batch-size
Set the batch size to merge small chunks, must be power of two, between 0x1000-0x1000000 or be zero: [default: 0]
--compressor
Algorithm to compress data chunks: [default: zstd] [possible values: none, lz4_block, zstd]
--digester
Algorithm to digest data chunks: [default: blake3] [possible values: blake3, sha256]
-C, --config
Configuration file for storage backend, cache and RAFS FUSE filesystem.
-v, --fs-version
Set RAFS format version number: [default: 6] [possible values: 5, 6]
--features
Enable/disable features [possible values: blob-toc]
--chunk-dict
File path of chunk dictionary for data deduplication
--parent-bootstrap
File path of the parent/referenced RAFS metadata blob (optional)
--aligned-chunk
Align uncompressed data chunks to 4K, only for RAFS V5
--repeatable
Generate reproducible RAFS metadata
--whiteout-spec
Set the type of whiteout specification: [default: oci] [possible values: oci, overlayfs, none]
--prefetch-policy
Set data prefetch policy [default: none] [possible values: fs, blob, none]
-J, --output-json
File path to save operation result in JSON format
-h, --help
Print help information
`),
},
{
name: "'--batch-size' is not supported in v2.2.0-163-g180f6d2c",
feature: FeatureBatchSize,
expect: false,
helpMsg: []byte(`
Create RAFS filesystems from directories, tar files or OCI images
Usage: nydus-image create [OPTIONS]
Arguments:
source from which to build the RAFS filesystem
Options:
-L, --log-file
Log file path
-t, --type
Conversion type: [default: dir-rafs] [possible values: directory, dir-rafs, estargz-rafs, estargz-ref, estargztoc-ref, tar-rafs, tar-tarfs, targz-rafs, targz-ref, stargz_index]
-B, --bootstrap
File path to save the generated RAFS metadata blob
-l, --log-level
Log level: [default: info] [possible values: trace, debug, info, warn, error]
-D, --blob-dir
Directory path to save generated RAFS metadata and data blobs
-b, --blob
File path to save the generated RAFS data blob
--blob-inline-meta
Inline RAFS metadata and blob metadata into the data blob
--blob-id
OSS object id for the generated RAFS data blob
--blob-data-size
Set data blob size for 'estargztoc-ref' conversion
--chunk-size
Set the size of data chunks, must be power of two and between 0x1000-0x1000000:
--compressor
Algorithm to compress data chunks: [default: zstd] [possible values: none, lz4_block, zstd]
--digester
Algorithm to digest data chunks: [default: blake3] [possible values: blake3, sha256]
-C, --config
Configuration file for storage backend, cache and RAFS FUSE filesystem.
-v, --fs-version
Set RAFS format version number: [default: 6] [possible values: 5, 6]
--features
Enable/disable features [possible values: blob-toc]
--chunk-dict
File path of chunk dictionary for data deduplication
--parent-bootstrap
File path of the parent/referenced RAFS metadata blob (optional)
--aligned-chunk
Align uncompressed data chunks to 4K, only for RAFS V5
--repeatable
Generate reproducible RAFS metadata
--whiteout-spec
Set the type of whiteout specification: [default: oci] [possible values: oci, overlayfs, none]
--prefetch-policy
Set data prefetch policy [default: none] [possible values: fs, blob, none]
-J, --output-json
File path to save operation result in JSON format
-h, --help
Print help information
`),
},
{
name: "'--encrypt' is supported in v2.2.0-261-g22ad0e2c",
feature: FeatureEncrypt,
expect: true,
helpMsg: []byte(`
Create RAFS filesystems from directories, tar files or OCI images
Usage: nydus-image create [OPTIONS]
Arguments:
source from which to build the RAFS filesystem
Options:
-L, --log-file
Log file path
-t, --type
Conversion type: [default: dir-rafs] [possible values: directory, dir-rafs, estargz-rafs, estargz-ref, estargztoc-ref, tar-rafs, tar-tarfs, targz-rafs, targz-ref, stargz_index]
-B, --bootstrap
File path to save the generated RAFS metadata blob
-l, --log-level
Log level: [default: info] [possible values: trace, debug, info, warn, error]
-D, --blob-dir
Directory path to save generated RAFS metadata and data blobs
-b, --blob
File path to save the generated RAFS data blob
--blob-inline-meta
Inline RAFS metadata and blob metadata into the data blob
--blob-id
OSS object id for the generated RAFS data blob
--blob-data-size
Set data blob size for 'estargztoc-ref' conversion
--chunk-size
Set the size of data chunks, must be power of two and between 0x1000-0x1000000:
--batch-size
Set the batch size to merge small chunks, must be power of two, between 0x1000-0x1000000 or be zero: [default: 0]
--compressor
Algorithm to compress data chunks: [default: zstd] [possible values: none, lz4_block, zstd]
--digester
Algorithm to digest data chunks: [default: blake3] [possible values: blake3, sha256]
-C, --config
Configuration file for storage backend, cache and RAFS FUSE filesystem.
-v, --fs-version
Set RAFS format version number: [default: 6] [possible values: 5, 6]
--features
Enable/disable features [possible values: blob-toc]
--chunk-dict
File path of chunk dictionary for data deduplication
--parent-bootstrap
File path of the parent/referenced RAFS metadata blob (optional)
--aligned-chunk
Align uncompressed data chunks to 4K, only for RAFS V5
--repeatable
Generate reproducible RAFS metadata
--whiteout-spec
Set the type of whiteout specification: [default: oci] [possible values: oci, overlayfs, none]
--prefetch-policy
Set data prefetch policy [default: none] [possible values: fs, blob, none]
-J, --output-json
File path to save operation result in JSON format
-E, --encrypt
Encrypt the generated RAFS metadata and data blobs
-h, --help
Print help information
`),
},
{
name: "'--type tar-rafs' is not supported in v2.1.4",
feature: FeatureTar2Rafs,
expect: false,
helpMsg: []byte(`
nydus-image-create
Creates a nydus image from source
USAGE:
nydus-image create [FLAGS] [OPTIONS] ... --blob --bootstrap --fs-version --whiteout-spec
FLAGS:
-A, --aligned-chunk Align data chunks to 4K
--disable-check disable validation of metadata after building
-h, --help Prints help information
--inline-bootstrap append bootstrap data to blob
-R, --repeatable generate reproducible nydus image
-V, --version Prints version information
OPTIONS:
--backend-config
[deprecated!] Blob storage backend config - JSON string, only support localfs for compatibility
--backend-type
[deprecated!] Blob storage backend type, only support localfs for compatibility. Try use --blob instead.
[possible values: localfs]
-b, --blob path to store nydus image's data blob
-D, --blob-dir directory to store nydus image's metadata and data blob
--blob-id blob id (as object id in backend/oss)
--blob-meta path to store nydus blob metadata
--blob-offset
add an offset for compressed blob (is only used to put the blob in the tarball) [default: 0]
-B, --bootstrap path to store the nydus image's metadata blob
-M, --chunk-dict Specify a chunk dictionary for chunk deduplication
-S, --chunk-size
size of nydus image data chunk, must be power of two and between 0x1000-0x100000: [default: 0x100000]
-c, --compressor
algorithm to compress image data blob: [default: lz4_block] [possible values: none, lz4_block, gzip, zstd]
-d, --digester
algorithm to digest inodes and data chunks: [default: blake3] [possible values: blake3, sha256]
-v, --fs-version
version number of nydus image format: [default: 5] [possible values: 5, 6]
-o, --log-file Specify log file name
-l, --log-level
Specify log level: [default: info] [possible values: trace, debug, info, warn, error]
-J, --output-json JSON file output path for result
-p, --parent-bootstrap path to parent/referenced image's metadata blob (optional)
-P, --prefetch-policy
blob data prefetch policy [default: none] [possible values: fs, blob, none]
-t, --source-type
type of the source: [default: directory] [possible values: directory, stargz_index]
-W, --whiteout-spec
type of whiteout specification: [default: oci] [possible values: oci, overlayfs, none]
ARGS:
... source path to build the nydus image from
`),
},
{
name: "'--batch-size' is not supported in v1.1.2",
feature: FeatureBatchSize,
expect: false,
helpMsg: []byte(`
nydus-image-create
Create a nydus format accelerated container image
USAGE:
nydus-image create [FLAGS] [OPTIONS] --blob --bootstrap --whiteout-spec
FLAGS:
--aligned-chunk Whether to align chunks into blobcache
--disable-check Disable to validate bootstrap file after building
-h, --help Prints help information
--repeatable Produce environment independent image
-V, --version Prints version information
OPTIONS:
--backend-config
[deprecated!] Blob storage backend config - JSON string, only support localfs for compatibility
--backend-type
[deprecated!] Blob storage backend type, only support localfs for compatibility. Try use --blob instead.
[possible values: localfs]
--blob A path to blob file which stores nydus image data portion
--blob-dir
A directory where blob files are saved named as their sha256 digest. It's very useful when multiple layers
are built at the same time.
--blob-id blob id (as object id in backend/oss)
--bootstrap A path to bootstrap file which stores nydus image metadata portion
--chunk-dict
specify a chunk dictionary file in bootstrap/db format for chunk deduplication.
--compressor
how blob will be compressed: none, lz4_block (default) [default: lz4_block]
--digester
how inode and blob chunk will be digested: blake3 (default), sha256 [default: blake3]
--log-level
Specify log level: trace, debug, info, warn, error [default: info] [possible values: trace, debug, info,
warn, error]
--output-json JSON output path for build result
--parent-bootstrap bootstrap file path of parent (optional)
--prefetch-policy
Prefetch policy: fs(issued from Fs layer), blob(issued from backend/blob layer), none(no readahead is
needed) [default: none]
--source-type
source type [default: directory] [possible values: directory, stargz_index]
--whiteout-spec
decide which whiteout spec to follow: "oci" or "overlayfs" [default: oci] [possible values: oci, overlayfs]
ARGS:
source path
`),
},
{
name: "'--type tar-rafs' is not supported in v0.1.0",
feature: FeatureTar2Rafs,
expect: false,
helpMsg: []byte(`
nydus-image-create
dump image bootstrap and upload blob to storage backend
USAGE:
nydus-image create [FLAGS] [OPTIONS] --bootstrap --whiteout-spec
FLAGS:
--aligned-chunk Whether to align chunks into blobcache
--disable-check Disable to validate bootstrap file after building
-h, --help Prints help information
--repeatable Produce environment independent image
-V, --version Prints version information
OPTIONS:
--backend-config blob storage backend config (JSON string)
--backend-config-file blob storage backend config (JSON file)
--backend-type blob storage backend type (enable blob upload if specified)
--blob blob file path
--blob-id blob id (as object id in backend)
--bootstrap bootstrap file path (required)
--compressor
how blob will be compressed: none, lz4_block (default) [default: lz4_block]
--digester
how inode and blob chunk will be digested: blake3 (default), sha256 [default: blake3]
--log-level
Specify log level: trace, debug, info, warn, error [default: info] [possible values: trace, debug, info,
warn, error]
--output-json JSON output path for build result
--parent-bootstrap bootstrap file path of parent (optional)
--prefetch-policy
Prefetch policy: fs(issued from Fs layer), blob(issued from backend/blob layer), none(no readahead is
needed) [default: none]
--source-type
source type [default: directory] [possible values: directory, stargz_index]
--whiteout-spec
decide which whiteout spec to follow: "oci" or "overlayfs" [default: oci] [possible values: oci, overlayfs]
ARGS:
source path
`),
},
{
name: "'--encrypt' is not supported in v2.2.0",
feature: FeatureEncrypt,
expect: false,
helpMsg: []byte(`
Create RAFS filesystems from directories, tar files or OCI images
Usage: nydus-image create [OPTIONS]
Arguments:
source from which to build the RAFS filesystem
Options:
-L, --log-file
Log file path
-t, --type
Conversion type: [default: dir-rafs] [possible values: directory, dir-rafs, estargz-rafs, estargz-ref, estargztoc-ref, tar-rafs, tar-tarfs, targz-rafs, targz-ref, stargz_index]
-B, --bootstrap
File path to save the generated RAFS metadata blob
-l, --log-level
Log level: [default: info] [possible values: trace, debug, info, warn, error]
-D, --blob-dir
Directory path to save generated RAFS metadata and data blobs
-b, --blob
File path to save the generated RAFS data blob
--blob-inline-meta
Inline RAFS metadata and blob metadata into the data blob
--blob-id
OSS object id for the generated RAFS data blob
--blob-data-size
Set data blob size for 'estargztoc-ref' conversion
--chunk-size
Set the size of data chunks, must be power of two and between 0x1000-0x1000000:
--batch-size
Set the batch size to merge small chunks, must be power of two, between 0x1000-0x1000000 or be zero: [default: 0]
--compressor
Algorithm to compress data chunks: [default: zstd] [possible values: none, lz4_block, zstd]
--digester
Algorithm to digest data chunks: [default: blake3] [possible values: blake3, sha256]
-C, --config
Configuration file for storage backend, cache and RAFS FUSE filesystem.
-v, --fs-version
Set RAFS format version number: [default: 6] [possible values: 5, 6]
--features
Enable/disable features [possible values: blob-toc]
--chunk-dict
File path of chunk dictionary for data deduplication
--parent-bootstrap
File path of the parent/referenced RAFS metadata blob (optional)
--aligned-chunk
Align uncompressed data chunks to 4K, only for RAFS V5
--repeatable
Generate reproducible RAFS metadata
--whiteout-spec
Set the type of whiteout specification: [default: oci] [possible values: oci, overlayfs, none]
--prefetch-policy
Set data prefetch policy [default: none] [possible values: fs, blob, none]
-J, --output-json
File path to save operation result in JSON format
-h, --help
Print help information
`),
},
{
name: "detectFeature should support empty input",
feature: "",
expect: false,
helpMsg: []byte(`
OPTIONS:
--type
[deprecated!] Conversion type.
[possible values: tar-rafs]
`),
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
require.Equal(t, tt.expect, detectFeature(tt.helpMsg, tt.feature))
})
}
}
func TestDetectFeatures(t *testing.T) {
testsCompare := []struct {
name string
resetGlobal bool
disableTar2Rafs bool
helpText []byte
required Features
detected Features
expectErr bool
}{
{
name: "should satisfy required features in v2.2.0-239-gf5c08fcf",
resetGlobal: true,
disableTar2Rafs: false,
helpText: []byte(`
Options:
-t, --type
Conversion type: [default: dir-rafs] [possible values: directory, dir-rafs, estargz-rafs, estargz-ref, estargztoc-ref, tar-rafs, tar-tarfs, targz-rafs, targz-ref, stargz_index]
--batch-size
Set the batch size to merge small chunks, must be power of two, between 0x1000-0x1000000 or be zero: [default: 0]
`),
required: Features{FeatureTar2Rafs: {}, FeatureBatchSize: {}},
detected: Features{FeatureTar2Rafs: {}, FeatureBatchSize: {}},
expectErr: false,
},
{
name: "should not support '--encrypt', '--batch-size' or '--type tar-rafs' in v2.1.4",
resetGlobal: true,
disableTar2Rafs: true,
helpText: []byte(`
nydus-image-create
Creates a nydus image from source
USAGE:
nydus-image create [FLAGS] [OPTIONS] ... --blob --bootstrap --fs-version --whiteout-spec
FLAGS:
-A, --aligned-chunk Align data chunks to 4K
--disable-check disable validation of metadata after building
-h, --help Prints help information
--inline-bootstrap append bootstrap data to blob
-R, --repeatable generate reproducible nydus image
-V, --version Prints version information
OPTIONS:
--backend-config
[deprecated!] Blob storage backend config - JSON string, only support localfs for compatibility
--backend-type
[deprecated!] Blob storage backend type, only support localfs for compatibility. Try use --blob instead.
[possible values: localfs]
-b, --blob path to store nydus image's data blob
-D, --blob-dir directory to store nydus image's metadata and data blob
--blob-id blob id (as object id in backend/oss)
--blob-meta path to store nydus blob metadata
--blob-offset
add an offset for compressed blob (is only used to put the blob in the tarball) [default: 0]
-B, --bootstrap path to store the nydus image's metadata blob
-M, --chunk-dict Specify a chunk dictionary for chunk deduplication
-S, --chunk-size
size of nydus image data chunk, must be power of two and between 0x1000-0x100000: [default: 0x100000]
-c, --compressor
algorithm to compress image data blob: [default: lz4_block] [possible values: none, lz4_block, gzip, zstd]
-d, --digester
algorithm to digest inodes and data chunks: [default: blake3] [possible values: blake3, sha256]
-v, --fs-version
version number of nydus image format: [default: 5] [possible values: 5, 6]
-o, --log-file Specify log file name
-l, --log-level
Specify log level: [default: info] [possible values: trace, debug, info, warn, error]
-J, --output-json JSON file output path for result
-p, --parent-bootstrap path to parent/referenced image's metadata blob (optional)
-P, --prefetch-policy
blob data prefetch policy [default: none] [possible values: fs, blob, none]
-t, --source-type
type of the source: [default: directory] [possible values: directory, stargz_index]
-W, --whiteout-spec
type of whiteout specification: [default: oci] [possible values: oci, overlayfs, none]
ARGS:
... source path to build the nydus image from
`),
required: Features{FeatureTar2Rafs: {}, FeatureBatchSize: {}, FeatureEncrypt: {}},
detected: Features{},
expectErr: false,
},
{
name: "should ignore '--type tar-rafs' if disabled",
resetGlobal: true,
disableTar2Rafs: true,
helpText: []byte(`
Options:
-t, --type
Conversion type: [default: dir-rafs] [possible values: directory, dir-rafs, estargz-rafs, estargz-ref, estargztoc-ref, tar-rafs, tar-tarfs, targz-rafs, targz-ref, stargz_index]
--batch-size
Set the batch size to merge small chunks, must be power of two, between 0x1000-0x1000000 or be zero: [default: 0]
`),
required: Features{FeatureTar2Rafs: {}, FeatureBatchSize: {}},
detected: Features{FeatureBatchSize: {}},
expectErr: false,
},
{
name: "should return error if required features changed in different calls",
resetGlobal: false,
disableTar2Rafs: false,
helpText: nil,
required: Features{},
detected: nil,
expectErr: true,
},
}
for _, tt := range testsCompare {
t.Run(tt.name, func(t *testing.T) {
if tt.resetGlobal {
// Reset global variables.
requiredFeatures = Features{}
detectedFeatures = Features{}
detectFeaturesOnce = sync.Once{}
disableTar2Rafs = tt.disableTar2Rafs
}
detected, err := DetectFeatures("", tt.required, func(_ string) []byte { return tt.helpText })
require.Equal(t, tt.expectErr, err != nil)
require.Equal(t, tt.detected, detected)
})
}
}
nydus-snapshotter-0.13.4/pkg/converter/types.go 0000664 0000000 0000000 00000014302 14533742372 0021606 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package converter
import (
"context"
"errors"
"fmt"
"strings"
"time"
"github.com/containerd/containerd/content"
"github.com/containerd/nydus-snapshotter/pkg/converter/tool"
"github.com/opencontainers/go-digest"
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
)
type Compressor = uint32
type Encrypter = func(context.Context, content.Store, ocispec.Descriptor) (ocispec.Descriptor, error)
const (
CompressorNone Compressor = 0x0000_0001
CompressorZstd Compressor = 0x0000_0002
CompressorLz4Block Compressor = 0x0000_0004
CompressorMask Compressor = 0x0000_000f
)
var (
ErrNotFound = errors.New("data not found")
)
type Layer struct {
// Digest represents the hash of whole tar blob.
Digest digest.Digest
// Digest represents the original OCI tar(.gz) blob.
OriginalDigest *digest.Digest
// ReaderAt holds the reader of whole tar blob.
ReaderAt content.ReaderAt
}
// Backend uploads blobs generated by nydus-image builder to a backend storage.
type Backend interface {
// Push pushes specified blob file to remote storage backend.
Push(ctx context.Context, cs content.Store, desc ocispec.Descriptor) error
// Check checks whether a blob exists in remote storage backend,
// blob exists -> return (blobPath, nil)
// blob not exists -> return ("", err)
Check(blobDigest digest.Digest) (string, error)
// Type returns backend type name.
Type() string
}
type PackOption struct {
// WorkDir is used as the work directory during layer pack.
WorkDir string
// BuilderPath holds the path of `nydus-image` binary tool.
BuilderPath string
// FsVersion specifies nydus RAFS format version, possible
// values: `5`, `6` (EROFS-compatible), default is `6`.
FsVersion string
// ChunkDictPath holds the bootstrap path of chunk dict image.
ChunkDictPath string
// PrefetchPatterns holds file path pattern list want to prefetch.
PrefetchPatterns string
// Compressor specifies nydus blob compression algorithm.
Compressor string
// OCIRef enables converting OCI tar(.gz) blob to nydus referenced blob.
OCIRef bool
// AlignedChunk aligns uncompressed data chunks to 4K, only for RAFS V5.
AlignedChunk bool
// ChunkSize sets the size of data chunks, must be power of two and between 0x1000-0x1000000.
ChunkSize string
// BacthSize sets the size of batch data chunks, must be power of two and between 0x1000-0x1000000 or zero.
BatchSize string
// Backend uploads blobs generated by nydus-image builder to a backend storage.
Backend Backend
// Timeout cancels execution once exceed the specified time.
Timeout *time.Duration
// Whether the generated Nydus blobs should be encrypted.
Encrypt bool
// Features keeps a feature list supported by newer version of builder,
// It is detected automatically, so don't export it.
features tool.Features
}
type MergeOption struct {
// WorkDir is used as the work directory during layer merge.
WorkDir string
// BuilderPath holds the path of `nydus-image` binary tool.
BuilderPath string
// FsVersion specifies nydus RAFS format version, possible
// values: `5`, `6` (EROFS-compatible), default is `6`.
FsVersion string
// ChunkDictPath holds the bootstrap path of chunk dict image.
ChunkDictPath string
// ParentBootstrapPath holds the bootstrap path of parent image.
ParentBootstrapPath string
// PrefetchPatterns holds file path pattern list want to prefetch.
PrefetchPatterns string
// WithTar puts bootstrap into a tar stream (no gzip).
WithTar bool
// OCI converts docker media types to OCI media types.
OCI bool
// OCIRef enables converting OCI tar(.gz) blob to nydus referenced blob.
OCIRef bool
// WithReferrer associates a reference to the original OCI manifest.
// See the `subject` field description in
// https://github.com/opencontainers/image-spec/blob/main/manifest.md#image-manifest-property-descriptions
//
// With this association, we can track all nydus images associated with
// an OCI image. For example, in Harbor we can cascade to show nydus
// images linked to an OCI image, deleting the OCI image can also delete
// the corresponding nydus images. At runtime, nydus snapshotter can also
// automatically upgrade an OCI image run to nydus image.
WithReferrer bool
// Backend uploads blobs generated by nydus-image builder to a backend storage.
Backend Backend
// Timeout cancels execution once exceed the specified time.
Timeout *time.Duration
// Encrypt encrypts the bootstrap layer if it's specified.
Encrypt Encrypter
}
type UnpackOption struct {
// WorkDir is used as the work directory during layer unpack.
WorkDir string
// BuilderPath holds the path of `nydus-image` binary tool.
BuilderPath string
// Timeout cancels execution once exceed the specified time.
Timeout *time.Duration
// Stream enables streaming mode, which doesn't unpack the blob data to disk,
// but setup a http server to serve the blob data.
Stream bool
}
type TOCEntry struct {
// Feature flags of entry
Flags uint32
Reserved1 uint32
// Name of entry data
Name [16]byte
// Sha256 of uncompressed entry data
UncompressedDigest [32]byte
// Offset of compressed entry data
CompressedOffset uint64
// Size of compressed entry data
CompressedSize uint64
// Size of uncompressed entry data
UncompressedSize uint64
Reserved2 [44]byte
}
func (entry *TOCEntry) GetCompressor() (Compressor, error) {
switch entry.Flags & CompressorMask {
case CompressorNone:
return CompressorNone, nil
case CompressorZstd:
return CompressorZstd, nil
case CompressorLz4Block:
return CompressorLz4Block, nil
}
return 0, fmt.Errorf("unsupported compressor, entry flags %x", entry.Flags)
}
func (entry *TOCEntry) GetName() string {
var name strings.Builder
name.Grow(16)
for _, c := range entry.Name {
if c == 0 {
break
}
fmt.Fprintf(&name, "%c", c)
}
return name.String()
}
func (entry *TOCEntry) GetUncompressedDigest() string {
return fmt.Sprintf("%x", entry.UncompressedDigest)
}
func (entry *TOCEntry) GetCompressedOffset() uint64 {
return entry.CompressedOffset
}
func (entry *TOCEntry) GetCompressedSize() uint64 {
return entry.CompressedSize
}
func (entry *TOCEntry) GetUncompressedSize() uint64 {
return entry.UncompressedSize
}
nydus-snapshotter-0.13.4/pkg/converter/utils.go 0000664 0000000 0000000 00000010340 14533742372 0021600 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package converter
import (
"archive/tar"
"bytes"
"compress/gzip"
"context"
"encoding/json"
"fmt"
"io"
"os"
"path/filepath"
"github.com/containerd/containerd/content"
"github.com/opencontainers/go-digest"
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
)
type writeCloser struct {
closed bool
io.WriteCloser
action func() error
}
func (c *writeCloser) Close() error {
if c.closed {
return nil
}
if err := c.WriteCloser.Close(); err != nil {
return err
}
c.closed = true
if err := c.action(); err != nil {
return err
}
return nil
}
func newWriteCloser(wc io.WriteCloser, action func() error) *writeCloser {
return &writeCloser{
WriteCloser: wc,
action: action,
}
}
type seekReader struct {
io.ReaderAt
pos int64
}
func (ra *seekReader) Read(p []byte) (int, error) {
n, err := ra.ReaderAt.ReadAt(p, ra.pos)
ra.pos += int64(n)
return n, err
}
func (ra *seekReader) Seek(offset int64, whence int) (int64, error) {
switch {
case whence == io.SeekCurrent:
ra.pos += offset
case whence == io.SeekStart:
ra.pos = offset
default:
return 0, fmt.Errorf("unsupported whence %d", whence)
}
return ra.pos, nil
}
func newSeekReader(ra io.ReaderAt) *seekReader {
return &seekReader{
ReaderAt: ra,
pos: 0,
}
}
// packToTar makes .tar(.gz) stream of file named `name` and return reader.
func packToTar(src string, name string, compress bool) (io.ReadCloser, error) {
fi, err := os.Stat(src)
if err != nil {
return nil, err
}
dirHdr := &tar.Header{
Name: filepath.Dir(name),
Mode: 0755,
Typeflag: tar.TypeDir,
}
hdr := &tar.Header{
Name: name,
Mode: 0444,
Size: fi.Size(),
}
reader, writer := io.Pipe()
go func() {
// Prepare targz writer
var tw *tar.Writer
var gw *gzip.Writer
var err error
var file *os.File
if compress {
gw = gzip.NewWriter(writer)
tw = tar.NewWriter(gw)
} else {
tw = tar.NewWriter(writer)
}
defer func() {
err1 := tw.Close()
var err2 error
if gw != nil {
err2 = gw.Close()
}
var finalErr error
// Return the first error encountered to the other end and ignore others.
switch {
case err != nil:
finalErr = err
case err1 != nil:
finalErr = err1
case err2 != nil:
finalErr = err2
}
writer.CloseWithError(finalErr)
}()
file, err = os.Open(src)
if err != nil {
return
}
defer file.Close()
// Write targz stream
if err = tw.WriteHeader(dirHdr); err != nil {
return
}
if err = tw.WriteHeader(hdr); err != nil {
return
}
if _, err = io.Copy(tw, file); err != nil {
return
}
}()
return reader, nil
}
// Copied from containerd/containerd project, copyright The containerd Authors.
// https://github.com/containerd/containerd/blob/4902059cb554f4f06a8d06a12134c17117809f4e/images/converter/default.go#L385
func readJSON(ctx context.Context, cs content.Store, x interface{}, desc ocispec.Descriptor) (map[string]string, error) {
info, err := cs.Info(ctx, desc.Digest)
if err != nil {
return nil, err
}
labels := info.Labels
if labels == nil {
labels = map[string]string{}
}
b, err := content.ReadBlob(ctx, cs, desc)
if err != nil {
return nil, err
}
if err := json.Unmarshal(b, x); err != nil {
return nil, err
}
return labels, nil
}
// Copied from containerd/containerd project, copyright The containerd Authors.
// https://github.com/containerd/containerd/blob/4902059cb554f4f06a8d06a12134c17117809f4e/images/converter/default.go#L401
func writeJSON(ctx context.Context, cs content.Store, x interface{}, oldDesc ocispec.Descriptor, labels map[string]string) (*ocispec.Descriptor, error) {
b, err := json.Marshal(x)
if err != nil {
return nil, err
}
dgst := digest.SHA256.FromBytes(b)
ref := fmt.Sprintf("converter-write-json-%s", dgst.String())
w, err := content.OpenWriter(ctx, cs, content.WithRef(ref))
if err != nil {
return nil, err
}
if err := content.Copy(ctx, w, bytes.NewReader(b), int64(len(b)), dgst, content.WithLabels(labels)); err != nil {
return nil, err
}
if err := w.Close(); err != nil {
return nil, err
}
newDesc := oldDesc
newDesc.Size = int64(len(b))
newDesc.Digest = dgst
return &newDesc, nil
}
nydus-snapshotter-0.13.4/pkg/daemon/ 0000775 0000000 0000000 00000000000 14533742372 0017347 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/pkg/daemon/client.go 0000664 0000000 0000000 00000021421 14533742372 0021154 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package daemon
import (
"bytes"
"context"
"encoding/json"
"fmt"
"io"
"io/fs"
"net"
"net/http"
"net/url"
"os"
"time"
"github.com/pkg/errors"
"github.com/containerd/containerd/log"
"github.com/containerd/nydus-snapshotter/pkg/daemon/types"
"github.com/containerd/nydus-snapshotter/pkg/metrics/tool"
"github.com/containerd/nydus-snapshotter/pkg/utils/retry"
)
const (
// Get information about nydus daemon
endpointDaemonInfo = "/api/v1/daemon"
// Mount or umount filesystems.
endpointMount = "/api/v1/mount"
// Fetch generic filesystem metrics.
endpointMetrics = "/api/v1/metrics"
// Fetch metrics relevant to caches usage.
endpointCacheMetrics = "/api/v1/metrics/blobcache"
// Fetch metrics about inflighting operations.
endpointInflightMetrics = "/api/v1/metrics/inflight"
// Request nydus daemon to retrieve its runtime states from the supervisor, recovering states for failover.
endpointTakeOver = "/api/v1/daemon/fuse/takeover"
// Request nydus daemon to send its runtime states to the supervisor, preparing for failover.
endpointSendFd = "/api/v1/daemon/fuse/sendfd"
// Request nydus daemon to start filesystem service.
endpointStart = "/api/v1/daemon/start"
// Request nydus daemon to exit
endpointExit = "/api/v1/daemon/exit"
// --- V2 API begins
// Add/remove blobs managed by the blob cache manager.
endpointBlobs = "/api/v2/blobs"
defaultHTTPClientTimeout = 30 * time.Second
jsonContentType = "application/json"
)
// Nydusd HTTP client to query nydusd runtime status, operate file system instances.
// Control nydusd workflow like failover and upgrade.
type NydusdClient interface {
GetDaemonInfo() (*types.DaemonInfo, error)
Mount(mountpoint, bootstrap, daemonConfig string) error
Umount(mountpoint string) error
BindBlob(daemonConfig string) error
UnbindBlob(domainID, blobID string) error
GetFsMetrics(sid string) (*types.FsMetrics, error)
GetInflightMetrics() (*types.InflightMetrics, error)
GetCacheMetrics(sid string) (*types.CacheMetrics, error)
TakeOver() error
SendFd() error
Start() error
Exit() error
}
// Nydusd API server http client used to command nydusd's action and
// query nydusd working status.
type nydusdClient struct {
httpClient *http.Client
}
type query = url.Values
func (c *nydusdClient) url(path string, query query) (url string) {
url = fmt.Sprintf("http://unix%s", path)
if len(query) != 0 {
url += "?" + query.Encode()
}
return
}
// A simple http client request wrapper with capability to take
// request body and handle or process http response if result is expected.
func (c *nydusdClient) request(method string, url string,
body io.Reader, respHandler func(resp *http.Response) error) error {
req, err := http.NewRequest(method, url, body)
if err != nil {
return errors.Wrapf(err, "construct request %s", url)
}
if body != nil {
req.Header.Add("Content-Type", jsonContentType)
}
resp, err := c.httpClient.Do(req)
if err != nil {
return err
}
defer resp.Body.Close()
if succeeded(resp) {
if respHandler != nil {
if err = respHandler(resp); err != nil {
return errors.Wrapf(err, "handle response")
}
}
return nil
}
return parseErrorMessage(resp)
}
func succeeded(resp *http.Response) bool {
return resp.StatusCode == http.StatusNoContent || resp.StatusCode == http.StatusOK
}
func decode(resp *http.Response, v any) error {
if err := json.NewDecoder(resp.Body).Decode(&v); err != nil {
return errors.Wrap(err, "decode response")
}
return nil
}
// Parse http response to get the specific error message formatted by nydusd API server.
// So it will be clear what's wrong in nydusd during processing http requests.
func parseErrorMessage(resp *http.Response) error {
var errMessage types.ErrorMessage
err := decode(resp, &errMessage)
if err != nil {
return err
}
return errors.Errorf("http response: %d, error code: %s, error message: %s",
resp.StatusCode, errMessage.Code, errMessage.Message)
}
func buildTransport(sock string) http.RoundTripper {
return &http.Transport{
MaxIdleConns: 10,
IdleConnTimeout: 10 * time.Second,
ExpectContinueTimeout: 1 * time.Second,
DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
dialer := &net.Dialer{
Timeout: 5 * time.Second,
KeepAlive: 5 * time.Second,
}
return dialer.DialContext(ctx, "unix", sock)
},
}
}
func WaitUntilSocketExisted(sock string, pid int) error {
return retry.Do(func() (err error) {
var st fs.FileInfo
if st, err = os.Stat(sock); err != nil {
return
}
if st.Mode()&os.ModeSocket == 0 {
return errors.Errorf("file %s is not socket file", sock)
}
return nil
},
retry.Attempts(100), // totally wait for 10 seconds, should be enough
retry.LastErrorOnly(true),
retry.Delay(100*time.Millisecond),
retry.OnlyRetryIf(func(error) bool {
zombie, err := tool.IsZombieProcess(pid)
if err != nil {
return false
}
// Stop retry if nydus daemon process is already in Zombie state.
if zombie {
log.L.Errorf("Process %d has been a zombie", pid)
return true
}
return false
}),
)
}
func NewNydusClient(sock string) (NydusdClient, error) {
transport := buildTransport(sock)
return &nydusdClient{
httpClient: &http.Client{
Timeout: defaultHTTPClientTimeout,
Transport: transport,
},
}, nil
}
func (c *nydusdClient) GetDaemonInfo() (*types.DaemonInfo, error) {
url := c.url(endpointDaemonInfo, query{})
var info types.DaemonInfo
err := c.request(http.MethodGet, url, nil, func(resp *http.Response) error {
if err := decode(resp, &info); err != nil {
return err
}
return nil
})
if err != nil {
return nil, err
}
return &info, nil
}
func (c *nydusdClient) Mount(mp, bootstrap, mountConfig string) error {
cmd, err := json.Marshal(types.NewMountRequest(bootstrap, mountConfig))
if err != nil {
return errors.Wrap(err, "construct mount request")
}
query := query{}
query.Add("mountpoint", mp)
url := c.url(endpointMount, query)
return c.request(http.MethodPost, url, bytes.NewBuffer(cmd), nil)
}
func (c *nydusdClient) Umount(mp string) error {
query := query{}
query.Add("mountpoint", mp)
url := c.url(endpointMount, query)
return c.request(http.MethodDelete, url, nil, nil)
}
func (c *nydusdClient) BindBlob(daemonConfig string) error {
url := c.url(endpointBlobs, query{})
return c.request(http.MethodPut, url, bytes.NewBuffer([]byte(daemonConfig)), nil)
}
// Delete /api/v2/blobs implements different functions according to different parameters
// 1. domainID , delete all blob entries in the domain.
// 2. domainID + blobID, delete the blob entry, if the blob is bootstrap
// also delete blob entries belong to it.
// 3. blobID, try to find and cull blob cache files by blobID in all domains.
func (c *nydusdClient) UnbindBlob(domainID, blobID string) error {
query := query{}
if domainID != "" {
query.Add("domain_id", domainID)
if domainID != blobID {
query.Add("blob_id", blobID)
}
} else {
query.Add("blob_id", blobID)
}
url := c.url(endpointBlobs, query)
return c.request(http.MethodDelete, url, nil, nil)
}
func (c *nydusdClient) GetFsMetrics(sid string) (*types.FsMetrics, error) {
query := query{}
if sid != "" {
query.Add("id", "/"+sid)
}
url := c.url(endpointMetrics, query)
var m types.FsMetrics
if err := c.request(http.MethodGet, url, nil, func(resp *http.Response) error {
return decode(resp, &m)
}); err != nil {
return nil, err
}
return &m, nil
}
func (c *nydusdClient) GetInflightMetrics() (*types.InflightMetrics, error) {
url := c.url(endpointInflightMetrics, query{})
var m types.InflightMetrics
if err := c.request(http.MethodGet, url, nil, func(resp *http.Response) error {
if resp.StatusCode != http.StatusNoContent {
return decode(resp, &m.Values)
}
return nil
}); err != nil {
return nil, err
}
return &m, nil
}
func (c *nydusdClient) GetCacheMetrics(sid string) (*types.CacheMetrics, error) {
query := query{}
if sid != "" {
query.Add("id", "/"+sid)
}
url := c.url(endpointCacheMetrics, query)
var m types.CacheMetrics
if err := c.request(http.MethodGet, url, nil, func(resp *http.Response) error {
return decode(resp, &m)
}); err != nil {
return nil, err
}
return &m, nil
}
func (c *nydusdClient) TakeOver() error {
url := c.url(endpointTakeOver, query{})
return c.request(http.MethodPut, url, nil, nil)
}
func (c *nydusdClient) SendFd() error {
url := c.url(endpointSendFd, query{})
return c.request(http.MethodPut, url, nil, nil)
}
func (c *nydusdClient) Start() error {
url := c.url(endpointStart, query{})
return c.request(http.MethodPut, url, nil, nil)
}
func (c *nydusdClient) Exit() error {
url := c.url(endpointExit, query{})
return c.request(http.MethodPut, url, nil, nil)
}
nydus-snapshotter-0.13.4/pkg/daemon/client_test.go 0000664 0000000 0000000 00000003250 14533742372 0022213 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package daemon
import (
"encoding/json"
"net"
"net/http"
"net/http/httptest"
"os"
"path/filepath"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/containerd/nydus-snapshotter/pkg/daemon/types"
)
var BTI = types.BuildTimeInfo{
PackageVer: "1.1.0",
GitCommit: "67f4ecc7acee6dd37234e6a697e72ac09d6cc8ba",
BuildTime: "Thu, 28 Jan 2021 14:02:39 +0000",
Profile: "debug",
Rustc: "rustc 1.46.0 (04488afe3 2020-08-24)",
}
func prepareNydusServer(t *testing.T) (string, func()) {
dir, _ := os.MkdirTemp("", "nydus-snapshotter-test")
mockSocket := filepath.Join(dir, "nydusd.sock")
_, err := os.Stat(mockSocket)
if err == nil {
_ = os.Remove(mockSocket)
}
ts := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(200)
info := types.DaemonInfo{
ID: "testid",
Version: BTI,
State: "RUNNING",
}
w.Header().Set("Content-Type", "application/json")
j, _ := json.Marshal(info)
_, err := w.Write(j)
assert.Nil(t, err)
}))
unixListener, err := net.Listen("unix", mockSocket)
require.Nil(t, err)
ts.Listener = unixListener
ts.Start()
return mockSocket, func() {
ts.Close()
}
}
func TestNydusClient_CheckStatus(t *testing.T) {
sock, dispose := prepareNydusServer(t)
defer dispose()
client, err := NewNydusClient(sock)
require.Nil(t, err)
info, err := client.GetDaemonInfo()
require.Nil(t, err)
assert.Equal(t, info.DaemonState(), types.DaemonStateRunning)
assert.Equal(t, "testid", info.ID)
assert.Equal(t, BTI, info.Version)
}
nydus-snapshotter-0.13.4/pkg/daemon/command/ 0000775 0000000 0000000 00000000000 14533742372 0020765 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/pkg/daemon/command/command.go 0000664 0000000 0000000 00000007730 14533742372 0022741 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package command
import (
"fmt"
"reflect"
"strconv"
"github.com/pkg/errors"
)
type Opt = func(cmd *DaemonCommand)
// Define how to build a command line to start a nydusd daemon
type DaemonCommand struct {
// "singleton" "fuse"
Mode string `type:"subcommand"`
// "blobcache" "fscache" "virtiofs"
FscacheDriver string `type:"param" name:"fscache"`
FscacheThreads string `type:"param" name:"fscache-threads"`
Upgrade bool `type:"flag" name:"upgrade" default:""`
ThreadNum string `type:"param" name:"thread-num"`
// `--id` is required by `--supervisor` when starting nydusd
ID string `type:"param" name:"id"`
Config string `type:"param" name:"config"`
Bootstrap string `type:"param" name:"bootstrap"`
Mountpoint string `type:"param" name:"mountpoint"`
APISock string `type:"param" name:"apisock"`
LogLevel string `type:"param" name:"log-level"`
LogRotationSize int `type:"param" name:"log-rotation-size"`
Supervisor string `type:"param" name:"supervisor"`
LogFile string `type:"param" name:"log-file"`
PrefetchFiles string `type:"param" name:"prefetch-files"`
}
// Build exec style command line
func BuildCommand(opts []Opt) ([]string, error) {
var cmd DaemonCommand
var subcommand string
for _, o := range opts {
o(&cmd)
}
args := make([]string, 0, 32)
t := reflect.TypeOf(cmd)
v := reflect.ValueOf(cmd)
for i := 0; i < t.NumField(); i++ {
tag := t.Field(i).Tag
argType := tag.Get("type")
switch argType {
case "param":
// Zero value will be skipped appending to command line
if v.Field(i).IsZero() {
continue
}
value := v.Field(i).Interface()
pair := []string{fmt.Sprintf("--%s", tag.Get("name")), fmt.Sprintf("%v", value)}
args = append(args, pair...)
case "subcommand":
// Zero value will be skipped appending to command line
if v.Field(i).IsZero() {
continue
}
subcommand = v.Field(i).String()
case "flag":
kind := v.Field(i).Kind()
if kind != reflect.Bool {
return nil, errors.Errorf("flag must be boolean")
}
v := v.Field(i).Bool()
if v {
flag := fmt.Sprintf("--%s", tag.Get("name"))
args = append(args, flag)
} else {
continue
}
default:
return nil, errors.Errorf("unknown tag type: %s ", argType)
}
}
if subcommand != "" {
// Ensure subcommand is at the first place.
args = append([]string{subcommand}, args...)
}
return args, nil
}
func WithMode(m string) Opt {
return func(cmd *DaemonCommand) {
cmd.Mode = m
}
}
func WithPrefetchFiles(p string) Opt {
return func(cmd *DaemonCommand) {
cmd.PrefetchFiles = p
}
}
func WithFscacheDriver(w string) Opt {
return func(cmd *DaemonCommand) {
cmd.FscacheDriver = w
}
}
func WithFscacheThreads(num int) Opt {
return func(cmd *DaemonCommand) {
cmd.FscacheThreads = strconv.Itoa(num)
}
}
func WithThreadNum(num int) Opt {
return func(cmd *DaemonCommand) {
cmd.ThreadNum = strconv.Itoa(num)
}
}
func WithConfig(config string) Opt {
return func(cmd *DaemonCommand) {
cmd.Config = config
}
}
func WithBootstrap(b string) Opt {
return func(cmd *DaemonCommand) {
cmd.Bootstrap = b
}
}
func WithMountpoint(m string) Opt {
return func(cmd *DaemonCommand) {
cmd.Mountpoint = m
}
}
func WithAPISock(api string) Opt {
return func(cmd *DaemonCommand) {
cmd.APISock = api
}
}
func WithLogFile(l string) Opt {
return func(cmd *DaemonCommand) {
cmd.LogFile = l
}
}
func WithLogLevel(l string) Opt {
return func(cmd *DaemonCommand) {
cmd.LogLevel = l
}
}
func WithLogRotationSize(l int) Opt {
return func(cmd *DaemonCommand) {
cmd.LogRotationSize = l
}
}
func WithSupervisor(s string) Opt {
return func(cmd *DaemonCommand) {
cmd.Supervisor = s
}
}
func WithID(id string) Opt {
return func(cmd *DaemonCommand) {
cmd.ID = id
}
}
func WithUpgrade() Opt {
return func(cmd *DaemonCommand) {
cmd.Upgrade = true
}
}
nydus-snapshotter-0.13.4/pkg/daemon/command/command_builder_test.go 0000664 0000000 0000000 00000002533 14533742372 0025502 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package command
import (
"strings"
"testing"
"github.com/stretchr/testify/assert"
)
func TestBuildCommand(t *testing.T) {
c := []Opt{WithMode("singleton"),
WithFscacheDriver("fs_cache_dir"),
WithFscacheThreads(4),
WithAPISock("/dummy/apisock"),
WithUpgrade()}
args, err := BuildCommand(c)
assert.Nil(t, err)
actual := strings.Join(args, " ")
assert.Equal(t, "singleton --fscache fs_cache_dir --fscache-threads 4 --upgrade --apisock /dummy/apisock", actual)
c1 := []Opt{WithMode("singleton"),
WithFscacheDriver("fs_cache_dir"),
WithFscacheThreads(4),
WithAPISock("/dummy/apisock")}
args1, err := BuildCommand(c1)
assert.Nil(t, err)
actual1 := strings.Join(args1, " ")
assert.Equal(t, "singleton --fscache fs_cache_dir --fscache-threads 4 --apisock /dummy/apisock", actual1)
}
// cpu: Intel(R) Xeon(R) Platinum 8260 CPU @ 2.40GHz
// BenchmarkBuildCommand-8 394146 3084 ns/op
// BenchmarkXxx-8 3933902 281.4 ns/op
// PASS
func BenchmarkBuildCommand(b *testing.B) {
c := []Opt{WithMode("singleton"),
WithFscacheDriver("fs_cache_dir"),
WithFscacheThreads(4),
WithAPISock("/dummy/apisock"),
WithUpgrade()}
for n := 0; n < b.N; n++ {
_, err := BuildCommand(c)
assert.Nil(b, err)
}
}
nydus-snapshotter-0.13.4/pkg/daemon/config.go 0000664 0000000 0000000 00000004735 14533742372 0021154 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package daemon
import (
"os"
"path"
"path/filepath"
"github.com/pkg/errors"
"github.com/containerd/nydus-snapshotter/config"
"github.com/containerd/nydus-snapshotter/internal/constant"
)
// Build runtime nydusd daemon object, which might be persisted later
func WithSocketDir(dir string) NewDaemonOpt {
return func(d *Daemon) error {
s := filepath.Join(dir, d.ID())
// this may be failed, should handle that
if err := os.MkdirAll(s, 0755); err != nil {
return errors.Wrapf(err, "create socket dir %s", s)
}
d.States.APISocket = path.Join(s, "api.sock")
return nil
}
}
func WithRef(ref int32) NewDaemonOpt {
return func(d *Daemon) error {
d.ref = ref
return nil
}
}
func WithLogDir(dir string) NewDaemonOpt {
return func(d *Daemon) error {
if err := os.MkdirAll(dir, 0755); err != nil {
return errors.Wrapf(err, "create logging dir %s", dir)
}
d.States.LogDir = filepath.Join(dir, d.ID())
return nil
}
}
func WithLogToStdout(logToStdout bool) NewDaemonOpt {
return func(d *Daemon) error {
d.States.LogToStdout = logToStdout
return nil
}
}
func WithLogLevel(logLevel string) NewDaemonOpt {
return func(d *Daemon) error {
if logLevel == "" {
d.States.LogLevel = constant.DefaultLogLevel
} else {
d.States.LogLevel = logLevel
}
return nil
}
}
func WithLogRotationSize(logRotationSize int) NewDaemonOpt {
return func(d *Daemon) error {
d.States.LogRotationSize = logRotationSize
return nil
}
}
func WithConfigDir(dir string) NewDaemonOpt {
return func(d *Daemon) error {
s := filepath.Join(dir, d.ID())
// this may be failed, should handle that
if err := os.MkdirAll(s, 0755); err != nil {
return errors.Wrapf(err, "failed to create config dir %s", s)
}
d.States.ConfigDir = s
return nil
}
}
func WithMountpoint(mountpoint string) NewDaemonOpt {
return func(d *Daemon) error {
d.States.Mountpoint = mountpoint
return nil
}
}
func WithNydusdThreadNum(nydusdThreadNum int) NewDaemonOpt {
return func(d *Daemon) error {
d.States.ThreadNum = nydusdThreadNum
return nil
}
}
func WithFsDriver(fsDriver string) NewDaemonOpt {
return func(d *Daemon) error {
d.States.FsDriver = fsDriver
return nil
}
}
func WithDaemonMode(daemonMode config.DaemonMode) NewDaemonOpt {
return func(d *Daemon) error {
d.States.DaemonMode = daemonMode
return nil
}
}
nydus-snapshotter-0.13.4/pkg/daemon/daemon.go 0000664 0000000 0000000 00000040770 14533742372 0021151 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package daemon
import (
"os"
"path/filepath"
"sort"
"sync"
"sync/atomic"
"syscall"
"time"
"github.com/pkg/errors"
"github.com/containerd/containerd/log"
"github.com/containerd/nydus-snapshotter/config"
"github.com/containerd/nydus-snapshotter/config/daemonconfig"
"github.com/containerd/nydus-snapshotter/pkg/daemon/types"
"github.com/containerd/nydus-snapshotter/pkg/errdefs"
"github.com/containerd/nydus-snapshotter/pkg/rafs"
"github.com/containerd/nydus-snapshotter/pkg/supervisor"
"github.com/containerd/nydus-snapshotter/pkg/utils/erofs"
"github.com/containerd/nydus-snapshotter/pkg/utils/mount"
"github.com/containerd/nydus-snapshotter/pkg/utils/retry"
)
const (
APISocketFileName = "api.sock"
SharedNydusDaemonID = "shared_daemon"
)
type NewDaemonOpt func(d *Daemon) error
// Fields in this structure should be write-once, and caller should hold `Daemon.mu` when updating fields.
type ConfigState struct {
// A unique ID generated by daemon manager to identify the nydusd instance.
ID string
ProcessID int
APISocket string
DaemonMode config.DaemonMode
FsDriver string
LogDir string
LogLevel string
LogRotationSize int
LogToStdout bool
Mountpoint string
SupervisorPath string
ThreadNum int
// Where the configuration file resides, all rafs instances share the same configuration template
ConfigDir string
}
// TODO: Record queried nydusd state
type Daemon struct {
States ConfigState
mu sync.Mutex
// Host all RAFS filesystems managed by this daemon:
// fusedev dedicated mode: one and only one RAFS instance
// fusedev shared mode: zero, one or more RAFS instances
// fscache shared mode: zero, one or more RAFS instances
RafsCache rafs.Cache
// Protect nydusd http client
cmu sync.Mutex
// client will be rebuilt on Reconnect, skip marshal/unmarshal
client NydusdClient
// Nil means this daemon object has no supervisor
Supervisor *supervisor.Supervisor
Config daemonconfig.DaemonConfig
// How much CPU nydusd is utilizing when starts since full prefetch might
// consume many CPU cycles
StartupCPUUtilization float64
Version types.BuildTimeInfo
ref int32
// Cache the nydusd daemon state to avoid frequently querying nydusd by API.
state types.DaemonState
}
func (d *Daemon) Lock() {
d.mu.Lock()
}
func (d *Daemon) Unlock() {
d.mu.Unlock()
}
func (d *Daemon) ID() string {
return d.States.ID
}
func (d *Daemon) Pid() int {
return d.States.ProcessID
}
func (d *Daemon) IncRef() {
atomic.AddInt32(&d.ref, 1)
}
func (d *Daemon) DecRef() int32 {
return atomic.AddInt32(&d.ref, -1)
}
func (d *Daemon) GetRef() int32 {
return atomic.LoadInt32(&d.ref)
}
func (d *Daemon) HostMountpoint() (mnt string) {
mnt = d.States.Mountpoint
return
}
// Each nydusd daemon has a copy of configuration json file.
func (d *Daemon) ConfigFile(instanceID string) string {
if instanceID == "" {
return filepath.Join(d.States.ConfigDir, "config.json")
}
return filepath.Join(d.States.ConfigDir, instanceID, "config.json")
}
// NydusdThreadNum returns how many working threads are needed of a single nydusd
func (d *Daemon) NydusdThreadNum() int {
return d.States.ThreadNum
}
func (d *Daemon) GetAPISock() string {
return d.States.APISocket
}
func (d *Daemon) LogFile() string {
return filepath.Join(d.States.LogDir, "nydusd.log")
}
func (d *Daemon) AddRafsInstance(r *rafs.Rafs) {
d.RafsCache.Add(r)
d.IncRef()
r.DaemonID = d.ID()
}
func (d *Daemon) RemoveRafsInstance(snapshotID string) {
d.RafsCache.Remove(snapshotID)
d.DecRef()
}
// Get and cache daemon current working state by querying nydusd:
// 1. INIT
// 2. READY: All needed resources are ready.
// 3. RUNNING
func (d *Daemon) GetState() (types.DaemonState, error) {
c, err := d.GetClient()
if err != nil {
return types.DaemonStateUnknown, errors.Wrapf(err, "get daemon state")
}
info, err := c.GetDaemonInfo()
if err != nil {
return types.DaemonStateUnknown, err
}
st := info.DaemonState()
d.Lock()
d.state = st
d.Version = info.DaemonVersion()
d.Unlock()
return st, nil
}
// Return the cached nydusd working status, no API is invoked.
func (d *Daemon) State() types.DaemonState {
d.Lock()
defer d.Unlock()
return d.state
}
// Reset the cached nydusd working status
func (d *Daemon) ResetState() {
d.Lock()
defer d.Unlock()
d.state = types.DaemonStateUnknown
}
// Wait for the nydusd daemon to reach specified state with timeout.
func (d *Daemon) WaitUntilState(expected types.DaemonState) error {
return retry.Do(func() error {
if expected == d.State() {
return nil
}
state, err := d.GetState()
if err != nil {
return errors.Wrapf(err, "wait until daemon is %s", expected)
}
if state != expected {
return errors.Errorf("daemon %s is not %s yet, current state %s",
d.ID(), expected, state)
}
return nil
},
retry.LastErrorOnly(true),
retry.Attempts(20), // totally wait for 2 seconds, should be enough
retry.Delay(100*time.Millisecond),
)
}
func (d *Daemon) IsSharedDaemon() bool {
if d.States.DaemonMode != "" {
return d.States.DaemonMode == config.DaemonModeShared
}
return d.HostMountpoint() == config.GetRootMountpoint()
}
func (d *Daemon) SharedMount(rafs *rafs.Rafs) error {
defer d.SendStates()
switch d.States.FsDriver {
case config.FsDriverFscache:
if err := d.sharedErofsMount(rafs); err != nil {
return errors.Wrapf(err, "mount erofs")
}
return nil
case config.FsDriverFusedev:
return d.sharedFusedevMount(rafs)
default:
return errors.Errorf("unsupported fs driver %s", d.States.FsDriver)
}
}
func (d *Daemon) sharedFusedevMount(rafs *rafs.Rafs) error {
client, err := d.GetClient()
if err != nil {
return errors.Wrapf(err, "mount instance %s", rafs.SnapshotID)
}
bootstrap, err := rafs.BootstrapFile()
if err != nil {
return err
}
c, err := daemonconfig.NewDaemonConfig(d.States.FsDriver, d.ConfigFile(rafs.SnapshotID))
if err != nil {
return errors.Wrapf(err, "Failed to reload instance configuration %s",
d.ConfigFile(rafs.SnapshotID))
}
cfg, err := c.DumpString()
if err != nil {
return errors.Wrap(err, "dump instance configuration")
}
err = client.Mount(rafs.RelaMountpoint(), bootstrap, cfg)
if err != nil {
return errors.Wrapf(err, "mount rafs instance")
}
return nil
}
func (d *Daemon) sharedErofsMount(ra *rafs.Rafs) error {
client, err := d.GetClient()
if err != nil {
return errors.Wrapf(err, "bind blob %s", d.ID())
}
// TODO: Why fs cache needing this work dir?
if err := os.MkdirAll(ra.FscacheWorkDir(), 0755); err != nil {
return errors.Wrapf(err, "failed to create fscache work dir %s", ra.FscacheWorkDir())
}
c, err := daemonconfig.NewDaemonConfig(d.States.FsDriver, d.ConfigFile(ra.SnapshotID))
if err != nil {
log.L.Errorf("Failed to reload daemon configuration %s, %s", d.ConfigFile(ra.SnapshotID), err)
return err
}
cfgStr, err := c.DumpString()
if err != nil {
return err
}
if err := client.BindBlob(cfgStr); err != nil {
return errors.Wrapf(err, "request to bind fscache blob")
}
mountPoint := ra.GetMountpoint()
if err := os.MkdirAll(mountPoint, 0755); err != nil {
return errors.Wrapf(err, "create mountpoint %s", mountPoint)
}
bootstrapPath, err := ra.BootstrapFile()
if err != nil {
return err
}
fscacheID := erofs.FscacheID(ra.SnapshotID)
cfg := c.(*daemonconfig.FscacheDaemonConfig)
ra.AddAnnotation(rafs.AnnoFsCacheDomainID, cfg.DomainID)
ra.AddAnnotation(rafs.AnnoFsCacheID, fscacheID)
if err := erofs.Mount(bootstrapPath, cfg.DomainID, fscacheID, mountPoint); err != nil {
if !errdefs.IsErofsMounted(err) {
return errors.Wrapf(err, "mount erofs to %s", mountPoint)
}
// When snapshotter exits (either normally or abnormally), it will not have a
// chance to umount erofs mountpoint, so if snapshotter resumes running and mount
// again (by a new request to create container), it will need to ignore the mount
// error `device or resource busy`.
log.L.Warnf("erofs mountpoint %s has been mounted", mountPoint)
}
return nil
}
func (d *Daemon) SharedUmount(rafs *rafs.Rafs) error {
defer d.SendStates()
switch d.States.FsDriver {
case config.FsDriverFscache:
if err := d.sharedErofsUmount(rafs); err != nil {
return errors.Wrapf(err, "failed to erofs mount")
}
return nil
case config.FsDriverFusedev:
c, err := d.GetClient()
if err != nil {
return errors.Wrapf(err, "umount instance %s", rafs.SnapshotID)
}
return c.Umount(rafs.RelaMountpoint())
default:
return errors.Errorf("unsupported fs driver %s", d.States.FsDriver)
}
}
func (d *Daemon) sharedErofsUmount(ra *rafs.Rafs) error {
c, err := d.GetClient()
if err != nil {
return errors.Wrapf(err, "unbind blob %s", d.ID())
}
domainID := ra.Annotations[rafs.AnnoFsCacheDomainID]
fscacheID := ra.Annotations[rafs.AnnoFsCacheID]
if err := c.UnbindBlob(domainID, fscacheID); err != nil {
return errors.Wrapf(err, "request to unbind fscache blob, domain %s, fscache %s", domainID, fscacheID)
}
mountpoint := ra.GetMountpoint()
if err := erofs.Umount(mountpoint); err != nil {
return errors.Wrapf(err, "umount erofs %s mountpoint, %s", err, mountpoint)
}
// delete fscache bootstrap cache file
// erofs generate fscache cache file for bootstrap with fscacheID
if err := c.UnbindBlob("", fscacheID); err != nil {
log.L.Warnf("delete bootstrap %s err %s", fscacheID, err)
}
return nil
}
func (d *Daemon) UmountRafsInstance(r *rafs.Rafs) error {
if d.IsSharedDaemon() {
if err := d.SharedUmount(r); err != nil {
return errors.Wrapf(err, "umount fs instance %s", r.SnapshotID)
}
}
return nil
}
func (d *Daemon) UmountRafsInstances() error {
if d.IsSharedDaemon() {
d.RafsCache.Lock()
defer d.RafsCache.Unlock()
instances := d.RafsCache.ListLocked()
for _, r := range instances {
if err := d.SharedUmount(r); err != nil {
return errors.Wrapf(err, "umount fs instance %s", r.SnapshotID)
}
}
}
return nil
}
func (d *Daemon) SendStates() {
su := d.Supervisor
if su != nil {
// TODO: This should be optional by checking snapshotter's configuration.
// FIXME: Is it possible the states are overwritten during two API mounts.
// FIXME: What if nydusd does not support sending states.
err := su.FetchDaemonStates(func() error {
if err := d.doSendStates(); err != nil {
return errors.Wrapf(err, "send daemon %s states", d.ID())
}
return nil
})
if err != nil {
log.L.Warnf("Daemon %s does not support sending states, %v", d.ID(), err)
}
}
}
func (d *Daemon) doSendStates() error {
c, err := d.GetClient()
if err != nil {
return errors.Wrapf(err, "send states %s", d.ID())
}
if err := c.SendFd(); err != nil {
return errors.Wrap(err, "request to send states")
}
return nil
}
func (d *Daemon) TakeOver() error {
c, err := d.GetClient()
if err != nil {
return errors.Wrapf(err, "takeover daemon %s", d.ID())
}
if err := c.TakeOver(); err != nil {
return errors.Wrap(err, "request to take over")
}
return nil
}
func (d *Daemon) Start() error {
c, err := d.GetClient()
if err != nil {
return errors.Wrapf(err, "start service")
}
if err := c.Start(); err != nil {
return errors.Wrap(err, "request to start service")
}
return nil
}
func (d *Daemon) Exit() error {
c, err := d.GetClient()
if err != nil {
return errors.Wrapf(err, "start service")
}
if err := c.Exit(); err != nil {
return errors.Wrap(err, "request to exit service")
}
return nil
}
func (d *Daemon) GetDaemonInfo() (*types.DaemonInfo, error) {
c, err := d.GetClient()
if err != nil {
return nil, errors.Wrapf(err, "get daemon information")
}
return c.GetDaemonInfo()
}
func (d *Daemon) GetFsMetrics(sid string) (*types.FsMetrics, error) {
c, err := d.GetClient()
if err != nil {
return nil, errors.Wrapf(err, "get fs metrics")
}
return c.GetFsMetrics(sid)
}
func (d *Daemon) GetInflightMetrics() (*types.InflightMetrics, error) {
c, err := d.GetClient()
if err != nil {
return nil, errors.Wrapf(err, "get inflight metrics")
}
return c.GetInflightMetrics()
}
func (d *Daemon) GetCacheMetrics(sid string) (*types.CacheMetrics, error) {
c, err := d.GetClient()
if err != nil {
return nil, errors.Wrapf(err, "get cache metrics")
}
return c.GetCacheMetrics(sid)
}
func (d *Daemon) GetClient() (NydusdClient, error) {
d.cmu.Lock()
defer d.cmu.Unlock()
if d.client == nil {
sock := d.GetAPISock()
// The socket file may be residual from a dead nydusd
err := WaitUntilSocketExisted(sock, d.Pid())
if err != nil {
return nil, errors.Wrapf(errdefs.ErrNotFound, "daemon socket %s", sock)
}
client, err := NewNydusClient(sock)
if err != nil {
return nil, errors.Wrapf(err, "create daemon %s client", d.ID())
}
d.client = client
}
return d.client, nil
}
func (d *Daemon) ResetClient() {
d.cmu.Lock()
d.client = nil
d.cmu.Unlock()
}
func (d *Daemon) Terminate() error {
// if we found pid here, we need to kill and wait process to exit, Pid=0 means somehow we lost
// the daemon pid, so that we can't kill the process, just roughly umount the mountpoint
d.Lock()
defer d.Unlock()
if d.Pid() > 0 {
p, err := os.FindProcess(d.Pid())
if err != nil {
return errors.Wrapf(err, "find process %d", d.Pid())
}
if err = p.Signal(syscall.SIGTERM); err != nil {
return errors.Wrapf(err, "send SIGTERM signal to process %d", d.Pid())
}
}
return nil
}
func (d *Daemon) Wait() error {
// if we found pid here, we need to kill and wait process to exit, Pid=0 means somehow we lost
// the daemon pid, so that we can't kill the process, just roughly umount the mountpoint
d.Lock()
defer d.Unlock()
if d.Pid() > 0 {
p, err := os.FindProcess(d.Pid())
if err != nil {
return errors.Wrapf(err, "find process %d", d.Pid())
}
// if nydus-snapshotter restarts, it will break the relationship between nydusd and
// nydus-snapshotter, p.Wait() will return err, so here should exclude this case
if _, err = p.Wait(); err != nil && !errors.Is(err, syscall.ECHILD) {
log.L.Errorf("failed to process wait, %v", err)
} else if d.HostMountpoint() != "" && config.GetFsDriver() == config.FsDriverFusedev {
// No need to umount if the nydusd never performs mount. In other word, it does not
// associate with a host mountpoint.
if err := mount.WaitUntilUnmounted(d.HostMountpoint()); err != nil {
log.L.WithError(err).Errorf("umount %s", d.HostMountpoint())
}
}
}
return nil
}
// When daemon dies, clean up its vestige before start a new one.
func (d *Daemon) ClearVestige() {
mounter := mount.Mounter{}
if d.States.FsDriver == config.FsDriverFscache {
instances := d.RafsCache.List()
for _, i := range instances {
if err := mounter.Umount(i.GetMountpoint()); err != nil {
log.L.Warnf("Can't umount %s, %v", d.States.Mountpoint, err)
}
}
} else {
log.L.Infof("Unmounting %s when clear vestige", d.HostMountpoint())
if err := mounter.Umount(d.HostMountpoint()); err != nil {
log.L.Warnf("Can't umount %s, %v", d.States.Mountpoint, err)
}
}
// Nydusd judges if it should enter failover phrase by checking
// if unix socket is existed and it can't be connected.
if err := os.Remove(d.GetAPISock()); err != nil {
log.L.Warnf("Can't delete residual unix socket %s, %v", d.GetAPISock(), err)
}
// `CheckStatus->ensureClient` only checks if socket file is existed when building http client.
// But the socket file may be residual and will be cleared before starting a new nydusd.
// So clear the client by assigning nil
d.ResetClient()
}
func (d *Daemon) CloneRafsInstances(src *Daemon) {
instances := src.RafsCache.List()
d.RafsCache.SetIntances(instances)
}
// Daemon must be started and reach RUNNING state before call this method
func (d *Daemon) RecoverRafsInstances() error {
if d.IsSharedDaemon() {
d.RafsCache.Lock()
defer d.RafsCache.Unlock()
instances := make([]*rafs.Rafs, 0, 16)
for _, r := range d.RafsCache.ListLocked() {
instances = append(instances, r)
}
sort.Slice(instances, func(i, j int) bool {
return instances[i].Seq < instances[j].Seq
})
for _, i := range instances {
if d.HostMountpoint() != i.GetMountpoint() {
log.L.Infof("Recovered mount instance %s", i.SnapshotID)
if err := d.SharedMount(i); err != nil {
return err
}
}
}
}
return nil
}
// Instantiate a daemon object
func NewDaemon(opt ...NewDaemonOpt) (*Daemon, error) {
d := &Daemon{}
d.States.ID = newID()
d.States.DaemonMode = config.DaemonModeDedicated
d.RafsCache = rafs.NewRafsCache()
for _, o := range opt {
err := o(d)
if err != nil {
return nil, err
}
}
return d, nil
}
nydus-snapshotter-0.13.4/pkg/daemon/idgen.go 0000664 0000000 0000000 00000000315 14533742372 0020763 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package daemon
import (
"github.com/rs/xid"
)
func newID() string {
return xid.New().String()
}
nydus-snapshotter-0.13.4/pkg/daemon/types/ 0000775 0000000 0000000 00000000000 14533742372 0020513 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/pkg/daemon/types/types.go 0000664 0000000 0000000 00000006207 14533742372 0022213 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package types
type BuildTimeInfo struct {
PackageVer string `json:"package_ver"`
GitCommit string `json:"git_commit"`
BuildTime string `json:"build_time"`
Profile string `json:"profile"`
Rustc string `json:"rustc"`
}
type DaemonState string
const (
DaemonStateUnknown DaemonState = "UNKNOWN"
DaemonStateInit DaemonState = "INIT"
DaemonStateReady DaemonState = "READY"
DaemonStateRunning DaemonState = "RUNNING"
DaemonStateDied DaemonState = "DIED"
DaemonStateDestroyed DaemonState = "DESTROYED"
)
type DaemonInfo struct {
ID string `json:"id"`
Version BuildTimeInfo `json:"version"`
State DaemonState `json:"state"`
}
func (info *DaemonInfo) DaemonState() DaemonState {
return info.State
}
func (info *DaemonInfo) DaemonVersion() BuildTimeInfo {
return info.Version
}
type ErrorMessage struct {
Code string `json:"code"`
Message string `json:"message"`
}
type MountRequest struct {
FsType string `json:"fs_type"`
Source string `json:"source"`
Config string `json:"config"`
}
func NewMountRequest(source, config string) MountRequest {
return MountRequest{
FsType: "rafs",
Source: source,
Config: config,
}
}
type FsMetrics struct {
FilesAccountEnabled bool `json:"files_account_enabled"`
AccessPatternEnabled bool `json:"access_pattern_enabled"`
MeasureLatency bool `json:"measure_latency"`
ID string `json:"id"`
DataRead uint64 `json:"data_read"`
BlockCountRead []uint64 `json:"block_count_read"`
FopHits []uint64 `json:"fop_hits"`
FopErrors []uint64 `json:"fop_errors"`
FopCumulativeLatencyTotal []uint64 `json:"fop_cumulative_latency_total"`
ReadLatencyDist []uint64 `json:"read_latency_dist"`
NrOpens uint64 `json:"nr_opens"`
}
type InflightMetrics struct {
Values []struct {
Inode uint64 `json:"inode"`
Opcode uint32 `json:"opcode"`
Unique uint64 `json:"unique"`
TimestampSecs uint64 `json:"timestamp_secs"`
}
}
type CacheMetrics struct {
ID string `json:"id"`
UnderlyingFiles []string `json:"underlying_files"`
StorePath string `json:"store_path"`
PartialHits uint64 `json:"partial_hits"`
WholeHits uint64 `json:"whole_hits"`
Total uint64 `json:"total"`
EntriesCount uint64 `json:"entries_count"`
PrefetchDataAmount uint64 `json:"prefetch_data_amount"`
PrefetchRequestsCount uint64 `json:"prefetch_requests_count"`
PrefetchWorkers uint `json:"prefetch_workers"`
PrefetchCumulativeTimeMillis uint64 `json:"prefetch_cumulative_time_millis"`
PrefetchBeginTimeSecs uint64 `json:"prefetch_begin_time_secs"`
PrefetchEndTimeSecs uint64 `json:"prefetch_end_time_secs"`
BufferedBackendSize uint64 `json:"buffered_backend_size"`
}
nydus-snapshotter-0.13.4/pkg/encryption/ 0000775 0000000 0000000 00000000000 14533742372 0020276 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/pkg/encryption/encryption.go 0000664 0000000 0000000 00000021022 14533742372 0023014 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2023. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package encryption
import (
"context"
"fmt"
"io"
"math/rand"
"github.com/containerd/containerd/content"
"github.com/containerd/containerd/errdefs"
"github.com/containerd/containerd/images"
"github.com/containers/ocicrypt"
encconfig "github.com/containers/ocicrypt/config"
enchelpers "github.com/containers/ocicrypt/helpers"
encocispec "github.com/containers/ocicrypt/spec"
"github.com/opencontainers/go-digest"
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
)
// Copied from containerd/imgcrypt project, copyright The imgcrypt Authors.
// https://github.com/containerd/imgcrypt/blob/e7500301cabcc9f3cab3daee3f541079b509e95f/images/encryption/encryption.go#LL82C5-L82C5
// encryptLayer encrypts the layer using the CryptoConfig and creates a new OCI Descriptor.
// A call to this function may also only manipulate the wrapped keys list.
// The caller is expected to store the returned encrypted data and OCI Descriptor
func encryptLayer(cc *encconfig.CryptoConfig, dataReader content.ReaderAt, desc ocispec.Descriptor) (ocispec.Descriptor, io.Reader, ocicrypt.EncryptLayerFinalizer, error) {
var (
size int64
d digest.Digest
err error
)
encLayerReader, encLayerFinalizer, err := ocicrypt.EncryptLayer(cc.EncryptConfig, ocicrypt.ReaderFromReaderAt(dataReader), desc)
if err != nil {
return ocispec.Descriptor{}, nil, nil, err
}
// were data touched ?
if encLayerReader != nil {
size = 0
d = ""
} else {
size = desc.Size
d = desc.Digest
}
newDesc := ocispec.Descriptor{
Digest: d,
Size: size,
Platform: desc.Platform,
}
switch desc.MediaType {
case images.MediaTypeDockerSchema2LayerGzip:
newDesc.MediaType = encocispec.MediaTypeLayerGzipEnc
case images.MediaTypeDockerSchema2Layer:
newDesc.MediaType = encocispec.MediaTypeLayerEnc
case encocispec.MediaTypeLayerGzipEnc:
newDesc.MediaType = encocispec.MediaTypeLayerGzipEnc
case encocispec.MediaTypeLayerZstdEnc:
newDesc.MediaType = encocispec.MediaTypeLayerZstdEnc
case encocispec.MediaTypeLayerEnc:
newDesc.MediaType = encocispec.MediaTypeLayerEnc
// TODO: Mediatypes to be added in ocispec
case ocispec.MediaTypeImageLayerGzip:
newDesc.MediaType = encocispec.MediaTypeLayerGzipEnc
case ocispec.MediaTypeImageLayerZstd:
newDesc.MediaType = encocispec.MediaTypeLayerZstdEnc
case ocispec.MediaTypeImageLayer:
newDesc.MediaType = encocispec.MediaTypeLayerEnc
default:
return ocispec.Descriptor{}, nil, nil, fmt.Errorf("unsupporter layer MediaType: %s", desc.MediaType)
}
return newDesc, encLayerReader, encLayerFinalizer, nil
}
// Copied from containerd/imgcrypt project, copyright The imgcrypt Authors.
// https://github.com/containerd/imgcrypt/blob/e7500301cabcc9f3cab3daee3f541079b509e95f/images/encryption/encryption.go#LL164C11-L164C11
// decryptLayer decrypts the layer using the CryptoConfig and creates a new OCI Descriptor.
// The caller is expected to store the returned plain data and OCI Descriptor
func decryptLayer(cc *encconfig.CryptoConfig, dataReader content.ReaderAt, desc ocispec.Descriptor, unwrapOnly bool) (ocispec.Descriptor, io.Reader, error) {
resultReader, d, err := ocicrypt.DecryptLayer(cc.DecryptConfig, ocicrypt.ReaderFromReaderAt(dataReader), desc, unwrapOnly)
if err != nil || unwrapOnly {
return ocispec.Descriptor{}, nil, err
}
newDesc := ocispec.Descriptor{
Digest: d,
Size: 0,
Platform: desc.Platform,
}
switch desc.MediaType {
case encocispec.MediaTypeLayerGzipEnc:
newDesc.MediaType = images.MediaTypeDockerSchema2LayerGzip
case encocispec.MediaTypeLayerZstdEnc:
newDesc.MediaType = ocispec.MediaTypeImageLayerZstd
case encocispec.MediaTypeLayerEnc:
newDesc.MediaType = images.MediaTypeDockerSchema2Layer
default:
return ocispec.Descriptor{}, nil, fmt.Errorf("unsupporter layer MediaType: %s", desc.MediaType)
}
return newDesc, resultReader, nil
}
// Copied from containerd/imgcrypt project, copyright The imgcrypt Authors.
// https://github.com/containerd/imgcrypt/blob/e7500301cabcc9f3cab3daee3f541079b509e95f/images/encryption/encryption.go#LL250C5-L250C5
func ingestReader(ctx context.Context, cs content.Ingester, ref string, r io.Reader) (digest.Digest, int64, error) {
cw, err := content.OpenWriter(ctx, cs, content.WithRef(ref))
if err != nil {
return "", 0, fmt.Errorf("failed to open writer: %w", err)
}
defer cw.Close()
if _, err := content.CopyReader(cw, r); err != nil {
return "", 0, fmt.Errorf("copy failed: %w", err)
}
st, err := cw.Status()
if err != nil {
return "", 0, fmt.Errorf("failed to get state: %w", err)
}
if err := cw.Commit(ctx, st.Offset, ""); err != nil {
if !errdefs.IsAlreadyExists(err) {
return "", 0, fmt.Errorf("failed commit on ref %q: %w", ref, err)
}
}
return cw.Digest(), st.Offset, nil
}
// Encrypt Nydus bootstrap layer
func EncryptNydusBootstrap(ctx context.Context, cs content.Store, desc ocispec.Descriptor, encryptRecipients []string) (ocispec.Descriptor, error) {
var (
resultReader io.Reader
newDesc ocispec.Descriptor
encLayerFinalizer ocicrypt.EncryptLayerFinalizer
)
dataReader, err := cs.ReaderAt(ctx, desc)
if err != nil {
return ocispec.Descriptor{}, err
}
defer dataReader.Close()
cc, err := enchelpers.CreateCryptoConfig(encryptRecipients, []string{})
if err != nil {
return ocispec.Descriptor{}, fmt.Errorf("create encrypt config failed: %w", err)
}
newDesc, resultReader, encLayerFinalizer, err = encryptLayer(&cc, dataReader, desc)
if err != nil {
return ocispec.Descriptor{}, fmt.Errorf("failed to encrypt bootstrap layer: %w", err)
}
newDesc.Annotations = ocicrypt.FilterOutAnnotations(desc.Annotations)
// some operations, such as changing recipients, may not touch the layer at all
if resultReader != nil {
var ref string
// If we have the digest, write blob with checks
haveDigest := newDesc.Digest.String() != ""
if haveDigest {
ref = fmt.Sprintf("encrypted-bootstrap-%s", newDesc.Digest.String())
} else {
ref = fmt.Sprintf("encrypted-bootstrap-%d-%d", rand.Int(), rand.Int())
}
if haveDigest {
// Write blob if digest is known beforehand
if err := content.WriteBlob(ctx, cs, ref, resultReader, newDesc); err != nil {
return ocispec.Descriptor{}, fmt.Errorf("failed to write config: %w", err)
}
} else {
newDesc.Digest, newDesc.Size, err = ingestReader(ctx, cs, ref, resultReader)
if err != nil {
return ocispec.Descriptor{}, err
}
}
}
// After performing encryption, call finalizer to get annotations
if encLayerFinalizer != nil {
annotations, err := encLayerFinalizer()
if err != nil {
return ocispec.Descriptor{}, fmt.Errorf("error getting annotations from encLayer finalizer: %w", err)
}
for k, v := range annotations {
newDesc.Annotations[k] = v
}
}
return newDesc, err
}
// Decrypt the Nydus boostrap layer.
// If unwrapOnly is set we will only try to decrypt the layer encryption key and return,
// the layer itself won't be decrypted actually.
func DeryptNydusBootstrap(ctx context.Context, cs content.Store, desc ocispec.Descriptor, decryptKeys []string, unwrapOnly bool) (ocispec.Descriptor, error) {
var (
resultReader io.Reader
newDesc ocispec.Descriptor
)
dataReader, err := cs.ReaderAt(ctx, desc)
if err != nil {
return ocispec.Descriptor{}, err
}
defer dataReader.Close()
cc, err := enchelpers.CreateCryptoConfig([]string{}, decryptKeys)
if err != nil {
return ocispec.Descriptor{}, fmt.Errorf("create decrypt config failed: %w", err)
}
newDesc, resultReader, err = decryptLayer(&cc, dataReader, desc, unwrapOnly)
if err != nil || unwrapOnly {
return ocispec.Descriptor{}, fmt.Errorf("failed to decrypt bootstrap layer: %w", err)
}
newDesc.Annotations = ocicrypt.FilterOutAnnotations(desc.Annotations)
// some operations, such as changing recipients, may not touch the layer at all
if resultReader != nil {
var ref string
// If we have the digest, write blob with checks
haveDigest := newDesc.Digest.String() != ""
if haveDigest {
ref = fmt.Sprintf("decrypted-bootstrap-%s", newDesc.Digest.String())
} else {
ref = fmt.Sprintf("decrypted-bootstrap-%d-%d", rand.Int(), rand.Int())
}
if haveDigest {
// Write blob if digest is known beforehand
if err := content.WriteBlob(ctx, cs, ref, resultReader, newDesc); err != nil {
return ocispec.Descriptor{}, fmt.Errorf("failed to write config: %w", err)
}
} else {
newDesc.Digest, newDesc.Size, err = ingestReader(ctx, cs, ref, resultReader)
if err != nil {
return ocispec.Descriptor{}, err
}
}
}
return newDesc, err
}
nydus-snapshotter-0.13.4/pkg/errdefs/ 0000775 0000000 0000000 00000000000 14533742372 0017536 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/pkg/errdefs/errors.go 0000664 0000000 0000000 00000002447 14533742372 0021410 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package errdefs
import (
stderrors "errors"
"net"
"syscall"
"github.com/containerd/containerd/errdefs"
"github.com/pkg/errors"
)
var (
ErrAlreadyExists = errdefs.ErrAlreadyExists
ErrNotFound = errdefs.ErrNotFound
ErrInvalidArgument = errors.New("invalid argument")
ErrUnavailable = errors.New("unavailable")
ErrNotImplemented = errors.New("not implemented") // represents not supported and unimplemented
ErrDeviceBusy = errors.New("device busy") // represents not supported and unimplemented
)
// IsAlreadyExists returns true if the error is due to already exists
func IsAlreadyExists(err error) bool {
return errors.Is(err, ErrAlreadyExists)
}
// IsNotFound returns true if the error is due to a missing object
func IsNotFound(err error) bool {
return errors.Is(err, ErrNotFound)
}
// IsConnectionClosed returns true if error is due to connection closed
// this is used when snapshotter closed by sig term
func IsConnectionClosed(err error) bool {
switch err := err.(type) {
case *net.OpError:
return err.Err.Error() == "use of closed network connection"
default:
return false
}
}
func IsErofsMounted(err error) bool {
return stderrors.Is(err, syscall.EBUSY)
}
nydus-snapshotter-0.13.4/pkg/fanotify/ 0000775 0000000 0000000 00000000000 14533742372 0017723 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/pkg/fanotify/conn/ 0000775 0000000 0000000 00000000000 14533742372 0020660 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/pkg/fanotify/conn/conn.go 0000664 0000000 0000000 00000001134 14533742372 0022143 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2023. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package conn
import (
"bufio"
"encoding/json"
)
type Client struct {
Reader *bufio.Reader
}
type EventInfo struct {
Path string `json:"path"`
Size uint32 `json:"size"`
Elapsed uint64 `json:"elapsed"`
}
func (c *Client) GetEventInfo() (*EventInfo, error) {
eventInfo := EventInfo{}
eventByte, err := c.Reader.ReadBytes('\n')
if err != nil {
return nil, err
}
if err := json.Unmarshal(eventByte, &eventInfo); err != nil {
return nil, err
}
return &eventInfo, nil
}
nydus-snapshotter-0.13.4/pkg/fanotify/fanotify.go 0000664 0000000 0000000 00000007443 14533742372 0022101 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2023. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package fanotify
import (
"bufio"
"encoding/csv"
"fmt"
"io"
"log/syslog"
"os"
"os/exec"
"syscall"
"time"
"github.com/containerd/nydus-snapshotter/pkg/fanotify/conn"
"github.com/containerd/nydus-snapshotter/pkg/utils/display"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
)
type Server struct {
BinaryPath string
ContainerPid uint32
ImageName string
PersistFile string
Readable bool
Overwrite bool
Timeout time.Duration
Client *conn.Client
Cmd *exec.Cmd
LogWriter *syslog.Writer
}
func NewServer(binaryPath string, containerPid uint32, imageName string, persistFile string, readable bool, overwrite bool, timeout time.Duration, logWriter *syslog.Writer) *Server {
return &Server{
BinaryPath: binaryPath,
ContainerPid: containerPid,
ImageName: imageName,
PersistFile: persistFile,
Readable: readable,
Overwrite: overwrite,
Timeout: timeout,
LogWriter: logWriter,
}
}
func (fserver *Server) RunServer() error {
if !fserver.Overwrite {
if file, err := os.Stat(fserver.PersistFile); err == nil && !file.IsDir() {
return nil
}
}
cmd := exec.Command(fserver.BinaryPath)
cmd.SysProcAttr = &syscall.SysProcAttr{
Cloneflags: syscall.CLONE_NEWNS,
Setpgid: true,
}
cmd.Env = append(cmd.Env, "_MNTNS_PID="+fmt.Sprint(fserver.ContainerPid))
cmd.Env = append(cmd.Env, "_TARGET=/")
cmd.Stderr = fserver.LogWriter
notifyR, err := cmd.StdoutPipe()
if err != nil {
return err
}
fserver.Client = &conn.Client{
Reader: bufio.NewReader(notifyR),
}
if err := cmd.Start(); err != nil {
return err
}
fserver.Cmd = cmd
go func() {
if err := fserver.RunReceiver(); err != nil {
logrus.WithError(err).Errorf("Failed to receive event information from server")
}
}()
if fserver.Timeout > 0 {
go func() {
time.Sleep(fserver.Timeout)
fserver.StopServer()
}()
}
return nil
}
func (fserver *Server) RunReceiver() error {
f, err := os.OpenFile(fserver.PersistFile, os.O_CREATE|os.O_WRONLY, 0644)
if err != nil {
return errors.Wrapf(err, "failed to open file %q", fserver.PersistFile)
}
defer f.Close()
persistCsvFile := fmt.Sprintf("%s.csv", fserver.PersistFile)
fCsv, err := os.Create(persistCsvFile)
if err != nil {
return errors.Wrapf(err, "failed to create file %q", persistCsvFile)
}
defer fCsv.Close()
csvWriter := csv.NewWriter(fCsv)
if err := csvWriter.Write([]string{"path", "size", "elapsed"}); err != nil {
return errors.Wrapf(err, "failed to write csv header")
}
csvWriter.Flush()
for {
eventInfo, err := fserver.Client.GetEventInfo()
if err != nil {
if err == io.EOF {
logrus.Infoln("Get EOF from fanotify server, break event receiver")
break
}
return fmt.Errorf("failed to get event information: %v", err)
}
if eventInfo != nil {
fmt.Fprintln(f, eventInfo.Path)
var line []string
if fserver.Readable {
line = []string{eventInfo.Path, display.ByteToReadableIEC(eventInfo.Size), display.MicroSecondToReadable(eventInfo.Elapsed)}
} else {
line = []string{eventInfo.Path, fmt.Sprint(eventInfo.Size), fmt.Sprint(eventInfo.Elapsed)}
}
if err := csvWriter.Write(line); err != nil {
return errors.Wrapf(err, "failed to write csv")
}
csvWriter.Flush()
}
}
return nil
}
func (fserver *Server) StopServer() {
if fserver.Cmd != nil {
logrus.Infof("Send SIGTERM signal to process group %d", fserver.Cmd.Process.Pid)
if err := syscall.Kill(-fserver.Cmd.Process.Pid, syscall.SIGTERM); err != nil {
logrus.WithError(err).Errorf("Stop process group %d failed!", fserver.Cmd.Process.Pid)
}
if _, err := fserver.Cmd.Process.Wait(); err != nil {
logrus.WithError(err).Errorf("Failed to wait for fanotify server")
}
}
}
nydus-snapshotter-0.13.4/pkg/filesystem/ 0000775 0000000 0000000 00000000000 14533742372 0020270 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/pkg/filesystem/config.go 0000664 0000000 0000000 00000004027 14533742372 0022067 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package filesystem
import (
"github.com/containerd/nydus-snapshotter/pkg/cache"
"github.com/containerd/nydus-snapshotter/pkg/manager"
"github.com/containerd/nydus-snapshotter/pkg/referrer"
"github.com/containerd/nydus-snapshotter/pkg/signature"
"github.com/containerd/nydus-snapshotter/pkg/stargz"
"github.com/containerd/nydus-snapshotter/pkg/tarfs"
"github.com/pkg/errors"
)
type NewFSOpt func(d *Filesystem) error
func WithNydusImageBinaryPath(p string) NewFSOpt {
return func(fs *Filesystem) error {
fs.nydusImageBinaryPath = p
return nil
}
}
func WithManagers(managers []*manager.Manager) NewFSOpt {
return func(fs *Filesystem) error {
if fs.enabledManagers == nil {
fs.enabledManagers = map[string]*manager.Manager{}
}
for _, pm := range managers {
fs.enabledManagers[pm.FsDriver] = pm
}
return nil
}
}
func WithCacheManager(cm *cache.Manager) NewFSOpt {
return func(fs *Filesystem) error {
if cm == nil {
return errors.New("cache manager cannot be nil")
}
fs.cacheMgr = cm
return nil
}
}
func WithReferrerManager(rm *referrer.Manager) NewFSOpt {
return func(fs *Filesystem) error {
if rm == nil {
return errors.New("referrer manager cannot be nil")
}
fs.referrerMgr = rm
return nil
}
}
func WithTarfsManager(tm *tarfs.Manager) NewFSOpt {
return func(fs *Filesystem) error {
if tm == nil {
return errors.New("tarfs manager cannot be nil")
}
fs.tarfsMgr = tm
return nil
}
}
func WithVerifier(verifier *signature.Verifier) NewFSOpt {
return func(fs *Filesystem) error {
fs.verifier = verifier
return nil
}
}
func WithRootMountpoint(mountpoint string) NewFSOpt {
return func(fs *Filesystem) error {
fs.rootMountpoint = mountpoint
return nil
}
}
func WithEnableStargz(enable bool) NewFSOpt {
return func(fs *Filesystem) error {
if enable {
fs.stargzResolver = stargz.NewResolver()
}
return nil
}
}
nydus-snapshotter-0.13.4/pkg/filesystem/fs.go 0000664 0000000 0000000 00000054671 14533742372 0021244 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
// Abstraction layer of underlying file systems. The file system could be mounted by one
// or more nydusd daemons. fs package hides the details
package filesystem
import (
"context"
"os"
"path"
snpkg "github.com/containerd/containerd/pkg/snapshotters"
"github.com/mohae/deepcopy"
"github.com/opencontainers/go-digest"
"github.com/pkg/errors"
"golang.org/x/sync/errgroup"
"github.com/containerd/containerd/log"
"github.com/containerd/containerd/snapshots"
"github.com/containerd/containerd/snapshots/storage"
"github.com/containerd/nydus-snapshotter/config"
"github.com/containerd/nydus-snapshotter/config/daemonconfig"
"github.com/containerd/nydus-snapshotter/pkg/cache"
"github.com/containerd/nydus-snapshotter/pkg/daemon"
"github.com/containerd/nydus-snapshotter/pkg/daemon/types"
"github.com/containerd/nydus-snapshotter/pkg/errdefs"
"github.com/containerd/nydus-snapshotter/pkg/label"
"github.com/containerd/nydus-snapshotter/pkg/manager"
racache "github.com/containerd/nydus-snapshotter/pkg/rafs"
"github.com/containerd/nydus-snapshotter/pkg/referrer"
"github.com/containerd/nydus-snapshotter/pkg/signature"
"github.com/containerd/nydus-snapshotter/pkg/stargz"
"github.com/containerd/nydus-snapshotter/pkg/tarfs"
)
type Filesystem struct {
fusedevSharedDaemon *daemon.Daemon
fscacheSharedDaemon *daemon.Daemon
enabledManagers map[string]*manager.Manager
cacheMgr *cache.Manager
referrerMgr *referrer.Manager
stargzResolver *stargz.Resolver
tarfsMgr *tarfs.Manager
verifier *signature.Verifier
nydusImageBinaryPath string
rootMountpoint string
}
// NewFileSystem initialize Filesystem instance
// It does mount image layers by starting nydusd doing FUSE mount or not.
func NewFileSystem(ctx context.Context, opt ...NewFSOpt) (*Filesystem, error) {
var fs Filesystem
for _, o := range opt {
err := o(&fs)
if err != nil {
return nil, err
}
}
recoveringDaemons := make(map[string]*daemon.Daemon, 0)
liveDaemons := make(map[string]*daemon.Daemon, 0)
for _, fsManager := range fs.enabledManagers {
err := fsManager.Recover(ctx, &recoveringDaemons, &liveDaemons)
if err != nil {
return nil, errors.Wrap(err, "reconnect daemons and recover filesystem instance")
}
}
var hasFscacheSharedDaemon = false
var hasFusedevSharedDaemon = false
for _, daemon := range liveDaemons {
if daemon.States.FsDriver == config.FsDriverFscache {
hasFscacheSharedDaemon = true
} else if daemon.States.FsDriver == config.FsDriverFusedev && daemon.IsSharedDaemon() {
hasFusedevSharedDaemon = true
}
}
for _, daemon := range recoveringDaemons {
if daemon.States.FsDriver == config.FsDriverFscache {
hasFscacheSharedDaemon = true
} else if daemon.States.FsDriver == config.FsDriverFusedev && daemon.IsSharedDaemon() {
hasFusedevSharedDaemon = true
}
}
// Try to bring up the shared daemon early.
// With found recovering daemons, it must be the case that snapshotter is being restarted.
// Situations that shared daemon is not found:
// 1. The first time this nydus-snapshotter runs
// 2. Daemon record is wrongly deleted from DB. Above reconnecting already gathers
// all daemons but still not found shared daemon. The best workaround is to start
// a new nydusd for it.
// TODO: We still need to consider shared daemon the time sequence of initializing daemon,
// start daemon commit its state to DB and retrieving its state.
if fscacheManager, ok := fs.enabledManagers[config.FsDriverFscache]; ok {
if !hasFscacheSharedDaemon && fs.fscacheSharedDaemon == nil {
log.L.Infof("initializing shared nydus daemon for fscache")
if err := fs.initSharedDaemon(fscacheManager); err != nil {
return nil, errors.Wrap(err, "start shared nydusd daemon for fscache")
}
}
} else if hasFscacheSharedDaemon {
return nil, errors.Errorf("shared fscache daemon is present, but manager is missing")
}
if fusedevManager, ok := fs.enabledManagers[config.FsDriverFusedev]; ok {
if config.IsFusedevSharedModeEnabled() && !hasFusedevSharedDaemon && fs.fusedevSharedDaemon == nil {
log.L.Infof("initializing shared nydus daemon for fusedev")
if err := fs.initSharedDaemon(fusedevManager); err != nil {
return nil, errors.Wrap(err, "start shared nydusd daemon for fusedev")
}
}
} else if hasFusedevSharedDaemon {
return nil, errors.Errorf("shared fusedev daemon is present, but manager is missing")
}
// Try to bring all persisted and stopped nydusd up and remount Rafs
eg, _ := errgroup.WithContext(context.Background())
for _, d := range recoveringDaemons {
d := d
eg.Go(func() error {
d.ClearVestige()
fsManager, err := fs.getManager(d.States.FsDriver)
if err != nil {
return errors.Wrapf(err, "get filesystem manager for daemon %s", d.States.ID)
}
if err := fsManager.StartDaemon(d); err != nil {
return errors.Wrapf(err, "start daemon %s", d.ID())
}
if err := d.WaitUntilState(types.DaemonStateRunning); err != nil {
return errors.Wrapf(err, "wait for daemon %s", d.ID())
}
if err := d.RecoverRafsInstances(); err != nil {
return errors.Wrapf(err, "recover mounts for daemon %s", d.ID())
}
fs.TryRetainSharedDaemon(d)
return nil
})
}
if err := eg.Wait(); err != nil {
return nil, err
}
for _, d := range liveDaemons {
fs.TryRetainSharedDaemon(d)
}
return &fs, nil
}
func (fs *Filesystem) TryRetainSharedDaemon(d *daemon.Daemon) {
if d.States.FsDriver == config.FsDriverFscache {
if fs.fscacheSharedDaemon == nil {
log.L.Debug("retain fscache shared daemon")
fs.fscacheSharedDaemon = d
d.IncRef()
}
} else if d.States.FsDriver == config.FsDriverFusedev {
if fs.fusedevSharedDaemon == nil && d.HostMountpoint() == fs.rootMountpoint {
log.L.Debug("retain fusedev shared daemon")
fs.fusedevSharedDaemon = d
d.IncRef()
}
}
}
func (fs *Filesystem) TryStopSharedDaemon() {
if fs.fusedevSharedDaemon != nil {
if fs.fusedevSharedDaemon.GetRef() == 1 {
if fusedevManager, ok := fs.enabledManagers[config.FsDriverFusedev]; ok {
if err := fusedevManager.DestroyDaemon(fs.fusedevSharedDaemon); err != nil {
log.L.WithError(err).Errorf("Terminate shared daemon %s failed", fs.fusedevSharedDaemon.ID())
} else {
fs.fusedevSharedDaemon = nil
}
}
}
}
if fs.fscacheSharedDaemon != nil {
if fs.fscacheSharedDaemon.GetRef() == 1 {
if fscacheManager, ok := fs.enabledManagers[config.FsDriverFscache]; ok {
if err := fscacheManager.DestroyDaemon(fs.fscacheSharedDaemon); err != nil {
log.L.WithError(err).Errorf("Terminate shared daemon %s failed", fs.fscacheSharedDaemon.ID())
} else {
fs.fscacheSharedDaemon = nil
}
}
}
}
}
// WaitUntilReady wait until daemon ready by snapshotID, it will wait until nydus domain socket established
// and the status of nydusd daemon must be ready
func (fs *Filesystem) WaitUntilReady(snapshotID string) error {
rafs := racache.RafsGlobalCache.Get(snapshotID)
if rafs == nil {
// If NoneDaemon mode, there's no need to wait for daemon ready
if config.GetDaemonMode() == config.DaemonModeNone {
return nil
}
return errors.Wrapf(errdefs.ErrNotFound, "no instance %s", snapshotID)
}
if rafs.GetFsDriver() == config.FsDriverFscache || rafs.GetFsDriver() == config.FsDriverFusedev {
d, err := fs.getDaemonByRafs(rafs)
if err != nil {
return errors.Wrapf(err, "snapshot id %s daemon id %s", snapshotID, rafs.DaemonID)
}
if err := d.WaitUntilState(types.DaemonStateRunning); err != nil {
return err
}
log.L.Debugf("Nydus remote snapshot %s is ready", snapshotID)
}
return nil
}
// Mount will be called when containerd snapshotter prepare remote snapshotter
// this method will fork nydus daemon and manage it in the internal store, and indexed by snapshotID
// It must set up all necessary resources during Mount procedure and revoke any step if necessary.
func (fs *Filesystem) Mount(ctx context.Context, snapshotID string, labels map[string]string, s *storage.Snapshot) (err error) {
rafs := racache.RafsGlobalCache.Get(snapshotID)
if rafs != nil {
// Instance already exists, how could this happen? Can containerd handle this case?
return nil
}
fsDriver := config.GetFsDriver()
if label.IsTarfsDataLayer(labels) {
fsDriver = config.FsDriverBlockdev
}
isSharedFusedev := fsDriver == config.FsDriverFusedev && config.GetDaemonMode() == config.DaemonModeShared
useSharedDaemon := fsDriver == config.FsDriverFscache || isSharedFusedev
var imageID string
imageID, ok := labels[snpkg.TargetRefLabel]
if !ok {
// FIXME: Buildkit does not pass labels defined in containerd‘s fashion. So
// we have to use stargz snapshotter specific labels until Buildkit generalize it the necessary
// labels for all remote snapshotters.
imageID, ok = labels["containerd.io/snapshot/remote/stargz.reference"]
if !ok {
return errors.Errorf("failed to find image ref of snapshot %s, labels %v", snapshotID, labels)
}
}
rafs, err = racache.NewRafs(snapshotID, imageID, fsDriver)
if err != nil {
return errors.Wrapf(err, "create rafs instance %s", snapshotID)
}
defer func() {
if err != nil {
racache.RafsGlobalCache.Remove(snapshotID)
}
}()
fsManager, err := fs.getManager(fsDriver)
if err != nil {
return errors.Wrapf(err, "get filesystem manager for snapshot %s", snapshotID)
}
var d *daemon.Daemon
if fsDriver == config.FsDriverFscache || fsDriver == config.FsDriverFusedev {
bootstrap, err := rafs.BootstrapFile()
if err != nil {
return errors.Wrapf(err, "find bootstrap file snapshot %s", snapshotID)
}
if useSharedDaemon {
d, err = fs.getSharedDaemon(fsDriver)
if err != nil {
return err
}
} else {
mp, err := fs.decideDaemonMountpoint(fsDriver, false, rafs)
if err != nil {
return err
}
d, err = fs.createDaemon(fsManager, config.DaemonModeDedicated, mp, 0)
// if daemon already exists for snapshotID, just return
if err != nil && !errdefs.IsAlreadyExists(err) {
return err
}
}
// Nydusd uses cache manager's directory to store blob caches. So cache
// manager knows where to find those blobs.
cacheDir := fs.cacheMgr.CacheDir()
// Fscache driver stores blob cache bitmap and blob header files here
workDir := rafs.FscacheWorkDir()
params := map[string]string{
daemonconfig.Bootstrap: bootstrap,
daemonconfig.WorkDir: workDir,
daemonconfig.CacheDir: cacheDir,
}
cfg := deepcopy.Copy(*fsManager.DaemonConfig).(daemonconfig.DaemonConfig)
err = daemonconfig.SupplementDaemonConfig(cfg, imageID, snapshotID, false, labels, params)
if err != nil {
return errors.Wrap(err, "supplement configuration")
}
// TODO: How to manage rafs configurations on-disk? separated json config file or DB record?
// In order to recover erofs mount, the configuration file has to be persisted.
var configSubDir string
if useSharedDaemon {
configSubDir = snapshotID
} else {
// Associate daemon config object when creating a new daemon object to avoid
// reading disk file again and again.
// For shared daemon, each rafs instance has its own configuration, so we don't
// attach a config interface to daemon in this case.
d.Config = cfg
}
err = cfg.DumpFile(d.ConfigFile(configSubDir))
if err != nil {
if errors.Is(err, errdefs.ErrAlreadyExists) {
log.L.Debugf("Configuration file %s already exits", d.ConfigFile(configSubDir))
} else {
return errors.Wrap(err, "dump daemon configuration file")
}
}
d.AddRafsInstance(rafs)
// if publicKey is not empty we should verify bootstrap file of image
err = fs.verifier.Verify(labels, bootstrap)
if err != nil {
return errors.Wrapf(err, "verify signature of daemon %s", d.ID())
}
}
switch fsDriver {
case config.FsDriverFscache:
err = fs.mountRemote(fsManager, useSharedDaemon, d, rafs)
if err != nil {
err = errors.Wrapf(err, "mount file system by daemon %s, snapshot %s", d.ID(), snapshotID)
}
case config.FsDriverFusedev:
err = fs.mountRemote(fsManager, useSharedDaemon, d, rafs)
if err != nil {
err = errors.Wrapf(err, "mount file system by daemon %s, snapshot %s", d.ID(), snapshotID)
}
case config.FsDriverBlockdev:
err = fs.tarfsMgr.MountTarErofs(snapshotID, s, labels, rafs)
if err != nil {
err = errors.Wrapf(err, "mount tarfs for snapshot %s", snapshotID)
}
case config.FsDriverNodev:
// Nothing to do
case config.FsDriverProxy:
if label.IsNydusProxyMode(labels) {
if v, ok := labels[label.CRILayerDigest]; ok {
rafs.AddAnnotation(label.CRILayerDigest, v)
}
rafs.AddAnnotation(label.NydusProxyMode, "true")
rafs.SetMountpoint(path.Join(rafs.GetSnapshotDir(), "fs"))
}
default:
err = errors.Errorf("unknown filesystem driver %s for snapshot %s", fsDriver, snapshotID)
}
// Persist it after associate instance after all the states are calculated.
if err == nil {
if err := fsManager.AddRafsInstance(rafs); err != nil {
return errors.Wrapf(err, "create instance %s", snapshotID)
}
}
if err != nil {
_ = fs.Umount(ctx, snapshotID)
return err
}
return nil
}
func (fs *Filesystem) Umount(ctx context.Context, snapshotID string) error {
rafs := racache.RafsGlobalCache.Get(snapshotID)
if rafs == nil {
log.L.Debugf("no RAFS filesystem instance associated with snapshot %s", snapshotID)
return nil
}
fsDriver := rafs.GetFsDriver()
if fsDriver == config.FsDriverNodev {
return nil
}
fsManager, err := fs.getManager(fsDriver)
if err != nil {
return errors.Wrapf(err, "get manager for filesystem instance %s", rafs.DaemonID)
}
switch fsDriver {
case config.FsDriverFscache, config.FsDriverFusedev:
daemon, err := fs.getDaemonByRafs(rafs)
if err != nil {
log.L.Debugf("snapshot %s has no associated nydusd", snapshotID)
return errors.Wrapf(err, "get daemon with ID %s for snapshot %s", rafs.DaemonID, snapshotID)
}
daemon.RemoveRafsInstance(snapshotID)
if err := fsManager.RemoveRafsInstance(snapshotID); err != nil {
return errors.Wrapf(err, "remove snapshot %s", snapshotID)
}
if err := daemon.UmountRafsInstance(rafs); err != nil {
return errors.Wrapf(err, "umount instance %s", snapshotID)
}
// Once daemon's reference reaches 0, destroy the whole daemon
if daemon.GetRef() == 0 {
if err := fsManager.DestroyDaemon(daemon); err != nil {
return errors.Wrapf(err, "destroy daemon %s", daemon.ID())
}
}
case config.FsDriverBlockdev:
if err := fs.tarfsMgr.UmountTarErofs(snapshotID); err != nil {
return errors.Wrapf(err, "umount tar erofs on snapshot %s", snapshotID)
}
if err := fsManager.RemoveRafsInstance(snapshotID); err != nil {
return errors.Wrapf(err, "remove snapshot %s", snapshotID)
}
case config.FsDriverNodev, config.FsDriverProxy:
// Nothing to do
default:
return errors.Errorf("unknown filesystem driver %s for snapshot %s", fsDriver, snapshotID)
}
return nil
}
// How much space the layer/blob cache filesystem is occupying
// The blob digest mush have `sha256:` prefixed, otherwise, throw errors.
func (fs *Filesystem) CacheUsage(ctx context.Context, blobDigest string) (snapshots.Usage, error) {
log.L.Infof("cache usage %s", blobDigest)
digest := digest.Digest(blobDigest)
if err := digest.Validate(); err != nil {
return snapshots.Usage{}, errors.Wrapf(err, "invalid blob digest from label %q, digest=%s",
snpkg.TargetLayerDigestLabel, blobDigest)
}
blobID := digest.Hex()
return fs.cacheMgr.CacheUsage(ctx, blobID)
}
func (fs *Filesystem) RemoveCache(blobDigest string) error {
log.L.Infof("remove cache %s", blobDigest)
digest := digest.Digest(blobDigest)
if err := digest.Validate(); err != nil {
return errors.Wrapf(err, "invalid blob digest from label %q, digest=%s",
snpkg.TargetLayerDigestLabel, blobDigest)
}
blobID := digest.Hex()
if fscacheManager, ok := fs.enabledManagers[config.FsDriverFscache]; ok {
if fscacheManager != nil {
c, err := fs.fscacheSharedDaemon.GetClient()
if err != nil {
return err
}
// delete fscache blob cache file
// TODO: skip error for blob not existing
if err := c.UnbindBlob("", blobID); err != nil {
return err
}
return nil
}
}
return fs.cacheMgr.RemoveBlobCache(blobID)
}
// Try to stop all the running daemons if they are not referenced by any snapshots
// Clean up resources along with the daemons.
func (fs *Filesystem) Teardown(ctx context.Context) error {
for _, fsManager := range fs.enabledManagers {
if fsManager.FsDriver == config.FsDriverFscache || fsManager.FsDriver == config.FsDriverFusedev {
for _, d := range fsManager.ListDaemons() {
for _, instance := range d.RafsCache.List() {
err := fs.Umount(ctx, instance.SnapshotID)
if err != nil {
log.L.Errorf("Failed to umount snapshot %s, %s", instance.SnapshotID, err)
}
}
}
// } else if fsManager.FsDriver == config.FsDriverBlockdev {
// TODO: support tarfs
}
}
return nil
}
func (fs *Filesystem) MountPoint(snapshotID string) (string, error) {
rafs := racache.RafsGlobalCache.Get(snapshotID)
if rafs != nil {
return rafs.GetMountpoint(), nil
}
return "", errdefs.ErrNotFound
}
func (fs *Filesystem) BootstrapFile(id string) (string, error) {
rafs := racache.RafsGlobalCache.Get(id)
if rafs == nil {
return "", errors.Errorf("no RAFS instance for %s", id)
}
return rafs.BootstrapFile()
}
// daemon mountpoint to rafs mountpoint
// calculate rafs mountpoint for snapshots mount slice.
func (fs *Filesystem) mountRemote(fsManager *manager.Manager, useSharedDaemon bool,
d *daemon.Daemon, r *racache.Rafs) error {
if useSharedDaemon {
if fsManager.FsDriver == config.FsDriverFusedev {
r.SetMountpoint(path.Join(d.HostMountpoint(), r.SnapshotID))
} else {
r.SetMountpoint(path.Join(r.GetSnapshotDir(), "mnt"))
}
if err := d.SharedMount(r); err != nil {
return errors.Wrapf(err, "failed to mount")
}
} else {
r.SetMountpoint(path.Join(d.HostMountpoint()))
err := fsManager.StartDaemon(d)
if err != nil {
return errors.Wrapf(err, "start daemon")
}
}
return nil
}
func (fs *Filesystem) decideDaemonMountpoint(fsDriver string, isSharedDaemonMode bool, rafs *racache.Rafs) (string, error) {
m := ""
if fsDriver == config.FsDriverFscache || fsDriver == config.FsDriverFusedev {
if isSharedDaemonMode {
m = fs.rootMountpoint
} else {
m = path.Join(rafs.GetSnapshotDir(), "mnt")
}
if err := os.MkdirAll(m, 0755); err != nil {
return "", errors.Wrapf(err, "create directory %s", m)
}
}
return m, nil
}
// 1. Create a daemon instance
// 2. Build command line
// 3. Start daemon
func (fs *Filesystem) initSharedDaemon(fsManager *manager.Manager) (err error) {
var daemonMode config.DaemonMode
switch fsManager.FsDriver {
case config.FsDriverFscache:
daemonMode = config.DaemonModeShared
case config.FsDriverFusedev:
daemonMode = config.DaemonModeShared
default:
return errors.Errorf("unsupported filesystem driver %s", fsManager.FsDriver)
}
mp, err := fs.decideDaemonMountpoint(fsManager.FsDriver, true, nil)
if err != nil {
return err
} else if mp == "" {
return errors.Errorf("got null mountpoint for fsDriver %s", fsManager.FsDriver)
}
d, err := fs.createDaemon(fsManager, daemonMode, mp, 0)
if err != nil {
return errors.Wrap(err, "initialize shared daemon")
}
// FIXME: Daemon record should not be removed after starting daemon failure.
defer func() {
if err != nil {
if err := fsManager.DeleteDaemon(d); err != nil {
log.L.Errorf("Start nydusd daemon error %v", err)
}
}
}()
// Shared nydusd daemon does not need configuration to start process but
// it is loaded when requesting mount api
// Dump the configuration file since it is reloaded when recovering the nydusd
d.Config = *fsManager.DaemonConfig
err = d.Config.DumpFile(d.ConfigFile(""))
if err != nil && !errors.Is(err, errdefs.ErrAlreadyExists) {
return errors.Wrapf(err, "dump configuration file %s", d.ConfigFile(""))
}
if err := fsManager.StartDaemon(d); err != nil {
return errors.Wrap(err, "start shared daemon")
}
fs.TryRetainSharedDaemon(d)
return
}
// createDaemon create new nydus daemon by snapshotID and imageID
func (fs *Filesystem) createDaemon(fsManager *manager.Manager, daemonMode config.DaemonMode,
mountpoint string, ref int32) (d *daemon.Daemon, err error) {
opts := []daemon.NewDaemonOpt{
daemon.WithRef(ref),
daemon.WithSocketDir(config.GetSocketRoot()),
daemon.WithConfigDir(config.GetConfigRoot()),
daemon.WithLogDir(config.GetLogDir()),
daemon.WithLogLevel(config.GetLogLevel()),
daemon.WithLogRotationSize(config.GetDaemonLogRotationSize()),
daemon.WithLogToStdout(config.GetLogToStdout()),
daemon.WithNydusdThreadNum(config.GetDaemonThreadsNumber()),
daemon.WithFsDriver(fsManager.FsDriver),
daemon.WithDaemonMode(daemonMode),
}
// For fscache driver, no need to provide mountpoint to nydusd daemon.
if mountpoint != "" {
opts = append(opts, daemon.WithMountpoint(mountpoint))
}
d, err = daemon.NewDaemon(opts...)
if err != nil {
return nil, errors.Wrapf(err, "new daemon")
}
if err = fsManager.AddDaemon(d); err != nil {
return nil, err
}
if fsManager.SupervisorSet != nil {
// Supervisor is strongly associated with real running nydusd daemon.
su := fsManager.SupervisorSet.NewSupervisor(d.ID())
if su == nil {
_ = fsManager.DeleteDaemon(d)
return nil, errors.Errorf("create supervisor for daemon %s", d.ID())
}
d.Supervisor = su
}
return d, nil
}
func (fs *Filesystem) getManager(fsDriver string) (*manager.Manager, error) {
if fsManager, ok := fs.enabledManagers[fsDriver]; ok {
return fsManager, nil
}
return nil, errors.Errorf("no manager for filesystem driver %s", fsDriver)
}
func (fs *Filesystem) getSharedDaemon(fsDriver string) (*daemon.Daemon, error) {
switch fsDriver {
case config.FsDriverFscache:
if fs.fscacheSharedDaemon != nil {
return fs.fscacheSharedDaemon, nil
}
case config.FsDriverFusedev:
if fs.fusedevSharedDaemon != nil {
return fs.fusedevSharedDaemon, nil
}
}
return nil, errors.Errorf("no shared daemon for filesystem driver %s", fsDriver)
}
func (fs *Filesystem) getDaemonByRafs(rafs *racache.Rafs) (*daemon.Daemon, error) {
switch rafs.GetFsDriver() {
case config.FsDriverFscache, config.FsDriverFusedev:
if fsManager, ok := fs.enabledManagers[rafs.GetFsDriver()]; ok {
if d := fsManager.GetByDaemonID(rafs.DaemonID); d != nil {
return d, nil
}
}
}
return nil, errdefs.ErrNotFound
}
func (fs *Filesystem) GetDaemonByID(id string) (*daemon.Daemon, error) {
for _, manager := range fs.enabledManagers {
if d := manager.GetByDaemonID(id); d != nil {
return d, nil
}
}
return nil, errdefs.ErrNotFound
}
nydus-snapshotter-0.13.4/pkg/filesystem/referer_adaptor.go 0000664 0000000 0000000 00000002651 14533742372 0023767 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2023. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package filesystem
import (
"context"
"fmt"
snpkg "github.com/containerd/containerd/pkg/snapshotters"
"github.com/opencontainers/go-digest"
"github.com/pkg/errors"
)
func (fs *Filesystem) ReferrerDetectEnabled() bool {
return fs.referrerMgr != nil
}
func (fs *Filesystem) CheckReferrer(ctx context.Context, labels map[string]string) bool {
if !fs.ReferrerDetectEnabled() {
return false
}
ref, ok := labels[snpkg.TargetRefLabel]
if !ok {
return false
}
manifestDigest := digest.Digest(labels[snpkg.TargetManifestDigestLabel])
if manifestDigest.Validate() != nil {
return false
}
if _, err := fs.referrerMgr.CheckReferrer(ctx, ref, manifestDigest); err != nil {
return false
}
return true
}
func (fs *Filesystem) TryFetchMetadata(ctx context.Context, labels map[string]string, metadataPath string) error {
ref, ok := labels[snpkg.TargetRefLabel]
if !ok {
return fmt.Errorf("empty label %s", snpkg.TargetRefLabel)
}
manifestDigest := digest.Digest(labels[snpkg.TargetManifestDigestLabel])
if err := manifestDigest.Validate(); err != nil {
return fmt.Errorf("invalid label %s=%s", snpkg.TargetManifestDigestLabel, manifestDigest)
}
if err := fs.referrerMgr.TryFetchMetadata(ctx, ref, manifestDigest, metadataPath); err != nil {
return errors.Wrap(err, "try fetch metadata")
}
return nil
}
nydus-snapshotter-0.13.4/pkg/filesystem/stargz_adaptor.go 0000664 0000000 0000000 00000017132 14533742372 0023647 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package filesystem
import (
"context"
"fmt"
"io"
"os"
"os/exec"
"path/filepath"
"strings"
"time"
"github.com/KarpelesLab/reflink"
"github.com/containerd/containerd/log"
"github.com/containerd/containerd/snapshots/storage"
"github.com/containerd/nydus-snapshotter/config"
"github.com/containerd/nydus-snapshotter/pkg/auth"
"github.com/containerd/nydus-snapshotter/pkg/label"
"github.com/containerd/nydus-snapshotter/pkg/stargz"
"github.com/containerd/nydus-snapshotter/pkg/utils/registry"
"github.com/opencontainers/go-digest"
"github.com/pkg/errors"
)
func (fs *Filesystem) UpperPath(id string) string {
return filepath.Join(config.GetSnapshotsRootDir(), id, "fs")
}
func (fs *Filesystem) StargzEnabled() bool {
return fs.stargzResolver != nil
}
// Detect if the blob is type of estargz by downloading its footer since estargz image does not
// have any characteristic annotation.
func (fs *Filesystem) IsStargzDataLayer(labels map[string]string) (bool, *stargz.Blob) {
ref, layerDigest := registry.ParseLabels(labels)
if ref == "" || layerDigest == "" {
return false, nil
}
log.L.Infof("Checking stargz image ref %s digest %s", ref, layerDigest)
keychain, err := auth.GetKeyChainByRef(ref, labels)
if err != nil {
log.L.WithError(err).Warn("get keychain from image reference")
return false, nil
}
blob, err := fs.stargzResolver.GetBlob(ref, layerDigest, keychain)
if err != nil {
log.L.WithError(err).Warn("get stargz blob")
return false, nil
}
off, err := blob.GetTocOffset()
if err != nil {
log.L.WithError(err).Warn("get toc offset")
return false, nil
}
if off <= 0 {
log.L.WithError(err).Warnf("Invalid stargz toc offset %d", off)
return false, nil
}
return true, blob
}
func (fs *Filesystem) MergeStargzMetaLayer(ctx context.Context, s storage.Snapshot) error {
mergedDir := fs.UpperPath(s.ParentIDs[0])
mergedBootstrap := filepath.Join(mergedDir, "image.boot")
if _, err := os.Stat(mergedBootstrap); err == nil {
return nil
}
bootstraps := []string{}
for idx, snapshotID := range s.ParentIDs {
files, err := os.ReadDir(fs.UpperPath(snapshotID))
if err != nil {
return errors.Wrap(err, "read snapshot dir")
}
bootstrapName := ""
blobMetaName := ""
for _, file := range files {
if digest.Digest(fmt.Sprintf("sha256:%s", file.Name())).Validate() == nil {
bootstrapName = file.Name()
}
if strings.HasSuffix(file.Name(), "blob.meta") {
blobMetaName = file.Name()
}
}
if bootstrapName == "" {
return fmt.Errorf("can't find bootstrap for snapshot %s", snapshotID)
}
// The blob meta file is generated in corresponding snapshot dir for each layer,
// but we need copy them to fscache work dir for nydusd use. This is not an
// efficient method, but currently nydusd only supports reading blob meta files
// from the same dir, so it is a workaround. If performance is a concern, it is
// best to convert the estargz image TOC file to a bootstrap / blob meta file
// at build time.
if blobMetaName != "" && idx != 0 {
sourcePath := filepath.Join(fs.UpperPath(snapshotID), blobMetaName)
// This path is same with `d.FscacheWorkDir()`, it's for fscache work dir.
targetPath := filepath.Join(fs.UpperPath(s.ParentIDs[0]), blobMetaName)
if err := reflink.Auto(sourcePath, targetPath); err != nil {
return errors.Wrap(err, "copy source blob.meta to target")
}
}
bootstrapPath := filepath.Join(fs.UpperPath(snapshotID), bootstrapName)
bootstraps = append([]string{bootstrapPath}, bootstraps...)
}
if len(bootstraps) == 1 {
if err := reflink.Auto(bootstraps[0], mergedBootstrap); err != nil {
return errors.Wrap(err, "copy source meta blob to target")
}
} else {
tf, err := os.CreateTemp(mergedDir, "merging-stargz")
if err != nil {
return errors.Wrap(err, "create temp file for merging stargz layers")
}
defer func() {
if err != nil {
os.Remove(tf.Name())
}
tf.Close()
}()
options := []string{
"merge",
"--bootstrap", tf.Name(),
}
options = append(options, bootstraps...)
cmd := exec.Command(fs.nydusImageBinaryPath, options...)
cmd.Stderr = os.Stderr
cmd.Stdout = os.Stdout
log.G(ctx).Infof("nydus image command %v", options)
err = cmd.Run()
if err != nil {
return errors.Wrap(err, "merging stargz layers")
}
err = os.Rename(tf.Name(), mergedBootstrap)
if err != nil {
return errors.Wrap(err, "rename merged stargz layers")
}
if err := os.Chmod(mergedBootstrap, 0440); err != nil {
return err
}
}
return nil
}
// Generate nydus bootstrap from stargz layers
// Download estargz TOC part from each layer as `nydus-image` conversion source.
// After conversion, a nydus metadata or bootstrap is used to pointing to each estargz blob
func (fs *Filesystem) PrepareStargzMetaLayer(blob *stargz.Blob, storagePath string, labels map[string]string) error {
ref := blob.GetImageReference()
layerDigest := blob.GetDigest()
if !fs.StargzEnabled() {
return fmt.Errorf("stargz compatibility is not enabled")
}
blobID := digest.Digest(layerDigest).Hex()
convertedBootstrap := filepath.Join(storagePath, blobID)
stargzFile := filepath.Join(storagePath, stargz.TocFileName)
if _, err := os.Stat(convertedBootstrap); err == nil {
return nil
}
start := time.Now()
defer func() {
duration := time.Since(start)
log.L.Infof("total stargz prepare layer duration %d", duration.Milliseconds())
}()
r, err := blob.ReadToc()
if err != nil {
return errors.Wrapf(err, "read TOC, image reference: %s, layer digest: %s", ref, layerDigest)
}
starGzToc, err := os.OpenFile(stargzFile, os.O_CREATE|os.O_RDWR, 0640)
if err != nil {
return errors.Wrap(err, "create stargz index")
}
defer starGzToc.Close()
_, err = io.Copy(starGzToc, r)
if err != nil {
return errors.Wrap(err, "save stargz index")
}
err = os.Chmod(stargzFile, 0440)
if err != nil {
return err
}
blobMetaPath := filepath.Join(fs.cacheMgr.CacheDir(), fmt.Sprintf("%s.blob.meta", blobID))
if config.GetFsDriver() == config.FsDriverFscache {
// For fscache, the cache directory is managed linux fscache driver, so the blob.meta file
// can't be stored there.
if err := os.MkdirAll(storagePath, 0750); err != nil {
return errors.Wrapf(err, "failed to create fscache work dir %s", storagePath)
}
blobMetaPath = filepath.Join(storagePath, fmt.Sprintf("%s.blob.meta", blobID))
}
tf, err := os.CreateTemp(storagePath, "converting-stargz")
if err != nil {
return errors.Wrap(err, "create temp file for merging stargz layers")
}
defer func() {
if err != nil {
os.Remove(tf.Name())
}
tf.Close()
}()
options := []string{
"create",
"--source-type", "stargz_index",
"--bootstrap", tf.Name(),
"--blob-id", blobID,
"--repeatable",
"--disable-check",
// FIXME: allow user to specify fs version and automatically detect
// chunk size and compressor from estargz TOC file.
"--fs-version", "6",
"--chunk-size", "0x400000",
"--blob-meta", blobMetaPath,
}
options = append(options, filepath.Join(storagePath, stargz.TocFileName))
cmd := exec.Command(fs.nydusImageBinaryPath, options...)
cmd.Stderr = os.Stderr
cmd.Stdout = os.Stdout
log.L.Infof("nydus image command %v", options)
err = cmd.Run()
if err != nil {
return errors.Wrap(err, "converting stargz layer")
}
err = os.Rename(tf.Name(), convertedBootstrap)
if err != nil {
return errors.Wrap(err, "rename converted stargz layer")
}
if err := os.Chmod(convertedBootstrap, 0440); err != nil {
return err
}
return nil
}
func (fs *Filesystem) StargzLayer(labels map[string]string) bool {
return labels[label.StargzLayer] != ""
}
nydus-snapshotter-0.13.4/pkg/filesystem/tarfs_adaptor.go 0000775 0000000 0000000 00000005005 14533742372 0023453 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2023. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package filesystem
import (
"context"
"github.com/containerd/containerd/log"
snpkg "github.com/containerd/containerd/pkg/snapshotters"
"github.com/containerd/containerd/snapshots/storage"
"github.com/containerd/nydus-snapshotter/pkg/label"
"github.com/opencontainers/go-digest"
"github.com/pkg/errors"
)
func (fs *Filesystem) TarfsEnabled() bool {
return fs.tarfsMgr != nil
}
func (fs *Filesystem) PrepareTarfsLayer(ctx context.Context, labels map[string]string, snapshotID, upperDirPath string) error {
ref, ok := labels[snpkg.TargetRefLabel]
if !ok {
return errors.Errorf("not found image reference label")
}
layerDigest := digest.Digest(labels[snpkg.TargetLayerDigestLabel])
if layerDigest.Validate() != nil {
return errors.Errorf("not found layer digest label")
}
manifestDigest := digest.Digest(labels[snpkg.TargetManifestDigestLabel])
if manifestDigest.Validate() != nil {
return errors.Errorf("not found manifest digest label")
}
ok, err := fs.tarfsMgr.CheckTarfsHintAnnotation(ctx, ref, manifestDigest)
if err != nil {
return errors.Wrapf(err, "check tarfs hint annotaion")
}
if !ok {
return errors.Errorf("this image is not recommended for tarfs")
}
limiter := fs.tarfsMgr.GetConcurrentLimiter(ref)
if limiter != nil {
if err := limiter.Acquire(context.Background(), 1); err != nil {
return errors.Wrapf(err, "concurrent limiter acquire")
}
}
if err := fs.tarfsMgr.PrepareLayer(snapshotID, ref, manifestDigest, layerDigest, upperDirPath); err != nil {
log.L.WithError(err).Errorf("async prepare tarfs layer of snapshot ID %s", snapshotID)
}
if limiter != nil {
limiter.Release(1)
}
layerBlobID := layerDigest.Hex()
labels[label.NydusTarfsLayer] = layerBlobID
return nil
}
func (fs *Filesystem) MergeTarfsLayers(s storage.Snapshot, storageLocater func(string) string) error {
return fs.tarfsMgr.MergeLayers(s, storageLocater)
}
func (fs *Filesystem) DetachTarfsLayer(snapshotID string) error {
return fs.tarfsMgr.DetachLayer(snapshotID)
}
func (fs *Filesystem) ExportBlockData(s storage.Snapshot, perLayer bool, labels map[string]string,
storageLocater func(string) string) ([]string, error) {
return fs.tarfsMgr.ExportBlockData(s, perLayer, labels, storageLocater)
}
func (fs *Filesystem) GetTarfsImageDiskFilePath(id string) (string, error) {
if fs.tarfsMgr == nil {
return "", errors.New("tarfs mode is not enabled")
}
return fs.tarfsMgr.ImageDiskFilePath(id), nil
}
nydus-snapshotter-0.13.4/pkg/filesystem/testdata/ 0000775 0000000 0000000 00000000000 14533742372 0022101 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/pkg/filesystem/testdata/invalid-bootstrap-file-size-133513.tar.gz 0000664 0000000 0000000 00000135624 14533742372 0031326 0 ustar 00root root 0000000 0000000 YkȚ~;sz {GTlWDAAT2 EZ5UsԇmJKd
"s_P ޮq4 1`8F/ }tTEi/yG۹g
I'1oi /`17S
(
Ba3RTA g;a;njvON t »O+}i0}aqo=?>,?z|t (;=uN:heAՆr[,STva">ڍںG/iIPS5a> )&hUh|{Vύ[ c"/y_ePKn* ub80|xԹ?6U "TXFE((,:_Y:(nEwP?nIpS`9OŹ( (ߗ[?>5ʰĆ]89BAđP0ҳXLJ+g]h0>U
'|( e Οi?讯 n6<e' t o7\6w3zI i[wCFꇿ ?vϝv`s!?ϼ3o?q ^{5vNXu w wM6 ca\]%vf 3_M*-\gr6<1u K,PiR8hMkK_P9x*Y`/tDgbIӵ`#cAR=/IYI^M xkAFG ( Q)fgH{YF
a?e;'GA/i=p c7C!Ff i,Nqtס;h/^漛Zi& K^z .Tyqf#kFe- u^[tm^^fQ49.ח.b_@5afWZ7Od'o5{=X2VDZ l1`'Kae&жQEDtN}ҏtOr>Rdd|E8 v $:=eTdFl3㨭A(*kJ|vZEexT<ħ8ra.ˁ>~_w mk6B3rrЫ~p _&zx 8@*882t%
d 2;FA֪cૈa "cwCR~߰>tVM49
єdBw2:hfI
5jc{')fRI*2},16`
E$Aوf# 4Cm}v>a]e{3s 1,2b|fĕy}efD H^8D=WaN e
ʍ
`Y-p0-IRޥiXkNEo?0拆1(\.3> +FַyV`.\cذxme% cp
.m Av\
<FIU6b9mY3d>g|\{*wPz&yp 1lºW-6nD
q8
(c\sLlxC`
NԈ cQK $M;I5$% (:X'
M
[AZޜI`J e
0]@0Ѯp ZIX$ڣa q_]T\ OͅSu hk 6sLqFygQuIw.Dz/%
MWk~w"#>{ip3t:uS;YXTY8+][T$i 0šTXG'`&Sty# j-pTe L#hn%Kt
YL9ZD0ScBԶrAJHG` ~erBMfD;פVo/ԝ jM0CF8Wx+ne} XT;=].qrԐu գBH%k:E*5}hvʓU%,bP8_`߅)L<. !}qF`r9'1%mEhR. %\Bw/]_. E
"E> rs*K* ɦt;&J`7NŴr #2n/7y Y%.`\ F{)ll"
yyt,0s
' ,\V[^eVqmdTK8v@];AkZpH1"@ϗ$Bcd 2]b0 6\WHBYl=7
9(`,A(ơ K6jF
qj
n fn(`1鎧x W3psG 1Co+o'/]m {#{3O E]1, 5ځ{҂ 1>ybSbŭp
$ayMQ8p(]
WPc9KjrTed,dxd.Gҹ cOuUPtH^ۼE2]LKk&ZJv`5-%$.ki S)V2uP"3CX>͑.Y/-~9p:jY\ nJD$V=UⰦ[TnDoVz( mqʌuF$cC}R7J +t"\ei=vۄ
UY0
7bKg[ٓG6DNv~65=8?r$u ="k)IMwnNx6+}&g(ǫ 8=7+fc2pJR`ˑ`{ˉ]VJ_02φ#Io6#)7vcM=>kFk~{ uM]p(1]KeqQ 9X}{ f(f?ѥ+w;)r PI:VST3
^ jz)aሧ 3%9כD* r
ԻovT~ڠs.ES$em!j "=}YQ`M`ѨH0prv=\N|݇mv6JdOhroy|M˹S/LJL{mʱ#6p^Om3v.{Qxiy HFR# [ZVN~ ʄ[0pFWՅ/fֲiTKTdV{@ U :uW3a.e &ܶ}L2BuNGpb kܘ&ä]6s:8nv^cq ' qP 6U^O=_ryUt+bks #ᇁy~8p 0m#+stDF~fZX/T X*~!
fUiANT9v? J(\ڶm03 !',\[vjwP~ ZT+DAY&K PAX}ΰl1{ kl]a;\$ˆM19V6N
'*r'T0-}ap扷(fVE맸TBm5*D8ƄF&(8Fޚi{\\ň\oC ng}yڪc$r&Gq|vBO3<`'+DE([!g mEQbQ
/3k
h7}2y.IB{61dn:5e*[$3_߸g̾aVg'ɝ<<{spr._:66H|\Bw|JJ©%2 P G| `pHI^/Ɉ.CZ/?X(\{ˎ+s wNDڷ
>h!a}F|{Ԭ.W WBV쬃^=K
١DVI\<˚j³bϪǏsEyGs%_;M|$Ől|xSbl:jqv:d(<]cl{XCpٌCa~;I3]/z hN:O\Z1UGJ˨ۑۭn#WY~y6*h> #kYA] Gh۷Ĕp>Aex J[h1W P_ v.eފ¨` vc0C0 _-ߗ?~>G:Dh |d E|瑗Egpx'kuaJU )n^{1~L 4F,a|m m\xU{NbSBD2Yc+M +xR( EJ0 1pa *dw*SU 'xt,&lˉs߇:? }cDGH<ݍc ŬnqYn6y6^*o_>ӨÎE*KV{6ry^ZҊt@ȈX#=ր_1f 388 ro}
Y⃚}}3#(%`
#5R }r[)Y_ljv(MYMQ80 +q hչTKY^MlCVULU,}PC_ec)d|(6g=kB c+9*aMTbM5qV '%ktӽqp
÷W|I9[: ڿ q]Y \;$5b1O!_I6[т"E C#^@ t/ˋUK3R+ \c}<
<[CRXBk) dIP:Lw~4[. bRJG.>~UM͊ t0HץxN.}t;LyVG.>hOޏp#%y Q)مČa8L,q @r-{D<߾$nK1 RJNxԷrtz| /qhϧr/]^g#1E\\' h;ɜ ] ]T{ ·(/"@wFGF'L^Ӵ=F<+x$oO!}Etԡi$$R|ܧJuث'/%@f4K~<ɻ^c
_wnNkl
ݙ .
y| MC[z);\@\q }Z{1Kkc7#qASҭO5ϐ>;_@R_ FN0>0 ǩ4hgacHq%5#jDan aN# 9En^ `hS .E ^cxϡGM F@ n ^@M#LScS}_a@|1
Ɩ`$4
D ףP >@6 / ] G`Un9k\kq#P (ѡ|slr6eY ;O˲duX>vR/ axQ |PY>I2;?cɻ]=/9nQx4n 绪 ^UU1D0.V =E+)_WDne(6|qAɹ [
J<A$Pj8_a1a 87I!gA ` ]
;gS(k@aW,[wd f]
{v;_E@A%EZ$=wYxƛR35/0P5+MiWs!Aʧ0 |K1Ә<{"v݁&R='rX%xǂc ZzzY {8n30
ĒS[mһNӧ!jy<o7"`%.MӾMRX1zո m sikyE}]?` -~mt[:`-p(~e=˳>r9HgWp5DDo3\ 68= MOlQ
n 5s 7
R_opvma¶G+XxB
V6vPU R6ίm^&ٍBÿ,8|nQ T J߷NquOļKev쐅7us@Y6M3tΙGh!%
B$eÔWH]lnY %zOZ<%Z@^x[;8T8 :."\;0l p_2ytL=8 ֣Na+{tΘ+]_ccMpCsOfu ڧ-țڞ/~<{Ծd!m;(4SM;8GgƇذ*XS;_O5!{MZZJ'0Ks0ib_Qoc`ml @ZQp%nw|5\=O!?-ST p/ADh;D
$ l= oFyDd u³ #qOϷ ï9vZ[Y"
Tw2EBJo&%`JgO[esŻ.%9wWNG-*'0Ԁ8cK@X(n=
FrIh[L%y؝1W}`nq\Q=Tq-ܫ(DޝB&>9Glk'r.hgu2- dTFAR3i6>}, \ʴԾ9#9~ IUs0pidw;~O G$y0 cy!]Ӯ2bY馩o*FMR/|!pe(8 :ch PHﲂgPu m'=g b&mQH2ਓ(2/ 1vguA(Eڎ : l=%HIZ>5SbToK?@_<-EEaױn)7je}B9'bQo)٣Gʪ#Zm6u0ݣ=:ַ*F,sSUy֯k9Ҩ~-+a؎J
6jXrmDx4qU9OEg7!,e|rbaj:ު&UvlV^Jߞ_qB,2 |lSK;Ott-R9 H.mU^jZ"r ŮAPwYe9 " \Q z
t:l`\ L^0M@% Ӝ3"BN]~w*r+o;J̯`xJirpBXYE
uɊ`nԳqXG8xFHXӤWPʝkq6ZYe"o}Y5QD1\GDtzqHq-sH
wjUf
ߖ^ }GJ)9kaPl+ <}+T?]Mfɾ҅h+U%Zmږ)Yi^:s?dۥg#WG@͙7' ?h5:|}xo_ x{-tmBhC$ b1F
R*= Bg%Lwc)Z[>9Bޏ?u|
f ~ i+ݓVpnEg(ok/:~R_sj nܦI'hEXmuߴAp1/:sT
zɠ
3>ͨ ÷@nE<]ySUOWO]g?Ic 1^S.OШé4fD8tuS:sLM#@˿=*osdxc7^ l88UX);+itspߖC- 4آ0pS8p s:̶3VM#⭼kk䉺L]@b)~XN_I筮:|%! ٣ Wm %=_v%@X&`rwnSvT#ln۰ʰQi
TM )m:Xf+:dt38z M:+[zdCȮä'18{RɘXo )Re?MOF >0Tjim7%UإO3gZFļe B#3F#&-iv4] Z{wA,( 5>``ӳ^OQOqWvaA1ac=-_- ݵa ~J9|Ԏ
V"8>F!H _ߕUf= }+o7n{IP*)Cqo 3kM#O7QrwOHa#6|Korg ˥lv
g:T$FDNNC»Yʝ荬:x7ň*m;-|.v[|7NzaX*՛l9#4{JRNJrt
vj
Ґw'RkL~S-'4(G|w. oNѫql;O_͑_PpZ|RV$J'&y`N-ʘk5;_y{6rau^1\H
&4
!
}D/(7>BED)<9jo\ W#uVGs {+M^uń0jF :Wiwu^yvR {e;\{SΟĔ#+hHvXd.db~uJymu Pjdy0}' ^a&'U '؟<^О|߀8MF `" _.8v^_XE;<^ 0T^0kkUWK9hn t/CvYN 3<:r'j.(JB%Iu<(<,$8y\S3bb/oWݨD?HG!I B#y71U72#o;5
P7ʼn Aj4 /m$|hD&}9o5fAVyGHX'+m M~ Қ蓠( 0ƈPHR ?pۮ6Ԟv˝JL-!fc&e=k|u
y쬜H77*o{ ǘ4DecGr5.H熧is) $K&
idg6C/$=p߽ rߜyθSb~8Bv\
?b1l6
ЙĄ`gsG<)((7 ^Ol:l} 5 ?~% IZs]T@"EKU!`f _GN+*(#Q1˕/X:8vfIZQ 'G'1)AQ5MlveߘxQ6< B!( ܷBʄMC Db ϯl B zBOni%%&E,afav>
-o S! 82,jgi_'ڈX};u Tuͤ=3? #gFf35..#9\Ml[_4GՓnFlSOD iw|PrK mw$sO; .xcWkRא\K
E\[d~Փ2_t_l }DkjC[ U(3b .Pj"%0 !c^~^skh㚥P$MŚFZtddE (iZ
SPtX3P6BVFF =\OtcMsJEiӻcr uu "9m/L y ?9hz ,Aa4$߆p:s_ CғC!4
W Q}uF296!\zIȥ.( yZdkcEHiqDxγ?֏Lwv$Ȝh-
=:T=CY)Um e]\Ϟrq;i;I0V uaN $šq:O7YzG 8qoUnq`2;vi#!k9;l';kHn"[N Xƣ̞#i ;t܇i aYƜ yK2Dn!s) xk$K3MZխ$ʂ
GȿVTKeL36ATgMI8yټ!@g%{
bp m*JZ2SLm
IEkC3`={q/s@
7]LyD )^&Zph$dl~{uX+{2sZc"eYݻBgi ˵z wF~ygri2M=A k#Nhڪ9g'Lst}mkb 9QP# ),e?G~.Xxi[[]pX&6wҐ3Dc"+ kw2*IDP.{9sǼSّd2Μuo r"VyaU&淖 @SsAo#N+? ]܈"퐏~kyzs69|{9/n@`m=d]W/'y7Zj У
f-f,=?8_A &?}rZQ.rD $@Y :y*UVɾM{tFA{Lߦ SwO ~-A3wފA ^pA5U fJ}vYp'}ME
Hm$aƕ[Dv4 T_'WYƆ6%NZn"t0C R#D
&02h Jk l5a8H|ok5cKAG.^ĆDI+}*QLW
7k2cȋ}YtU9$) 8)!hJ[{Ḇn9/sVKZC!Y(S$HcEhCwiGA~B]kf͓⣩1n0(DBﺮ8q#{FJoE݃{gX:VT׆Ɵ,)8zhsı
,tގ%nͮ/bdW@3p (<=<1sK-d/(F~8~@b8Nq7*;+$rF>*-AP)7]-CpD^!ݕfqT?j5y~ܨ>(ؼS.%urjBi^l12e/Bm>0,5}^rd>)K,ɺz"sV 305$"Ꞁ?c`Y5u߃=Ɓ'tvЃ:\"ot
vɒ
H6慷 V 8EaUh`@vw<'@[Ϲ ?6!>ݳ˛\Ih 곃 Fᨃ=uuFV madRP֧>ɜX@x0Zs1z$T깣f1Vt
xXrN:ybp 2,
gΣ&20:ݭGPXx>D v]rÀl-q˩DnA(xw
0v#"*-p}H gÇ_ /z-Qa˵Wxu [N[5G0z5^_CM@fTJYdvQz6DnU1N̙ 0/gg{ssxƞsfJQ
neof XpQ=V ֗Hl'U6
#Up?jd}~+
H$gi][ C HRa*`'XGLfpsV #̹+E9U0 mAJN9 5_/\ϻ+.jk*q}}(=ƻ I~yϟ}{ȝ2{@wc>Q礨z?*g(DL`4 F<ڃ;
vQǻEZ x1.ؕS< ֶ
إ) \ydb!⻙ÖH )ǚz??u? ,3g J콟hPk1 ~C=c~\Ǘ*fo)A Ds:i0& ,ĀRVrкWnT5`E$0ƤFi3B;%
G6,wn#<暬#$worhSDoLwak:hU##m'9(v}N©dny+ ko6cC':Lca`{0 v*0T_>j2AG0'{'L# xW9m;B*CTI/e=w =C2(|D )3y*%RہuSb =NlM>.Ekѽ/] ]
ur '|(ȯ #wnx2* 1COIFdz|XQ֞.q> #.,δz`Dڂj "|p5跲i NQ;VnwE) ^[Mj%ps _5R~nNضqR@Vxzg W$ {1 غ{7@$s`Im
V{&>*l,:m~Y{!G? ~H[P=
Pݺ<v=oJ\ѭu;7?wn)+ nh9f;cQ\$=e %T Zt_
;
ʚO%l
*AGA
udy:z#@o ^kHO Tpʥ/}x"E5ySj#%#giz*|3CՉq
mp!sq 3 xe0&V,XA,< >h10th'˞>T > V
jԕx[3OӢ{ü>w0B;.D$eU
9LujN~F8 ͏^ҧ|BNH D T6
jb"EAŁ4B0*wbE CH dn_g?#n$a$+A7q&q
VFz_{qN-
]_gMB)KcnJGO`dmz#`1^-cBĉW.'ΒC67·TܹY.i r8荟ǐB:UCdu2.4b zP@ve-! #aqI[xk y)9X9+&ЀLɻܑ;
!nKMZ9|+4г7۬c߹X ]1TnnLJm/z}?'E}6 ?y? h{ b|c* 46@O;+!h3k pä-o44 )<ߑ ЯJǗ]&k(#N( C͓^ ^ȁBQi0,W? _]]%y )gu!͆F@rt`#}{{ MuB2TJb\Eй AL5 3C'.* hmVBfj˸e̴A_%5VW҅.| 7%V *g7+:Ao }".Lr CLlA\Xʠ3/
;#e9i^SGGT~$yF]jӆz:)g%Nn_5jEn{Ո[3ԝ`h
'yڟ9q- Ȳa|gi!ZL0|%]ґ\a31/ sXqlQ/ Ln ZT;Z~ʽ::7-_*GƁj3`L sבmWA^M#4Il6YqIe` }C(aԴւj"|qZ) #Q v9Z m105,'@i,a5R=&wh(-cֶK߁] $jE/>22{>\ G %\O_ s@dM J_ۆF6dWI<#<ԍ"Y 1M;Sne_,#wwƬ )z`zvPstW>u߃~V<Zeݜ.^[xPCmlsE|O1}=_Yt>eLo NumF{Ȳj@eN,?'N&JwRm*SmJ x ~cO~E ;E] $tln5Av~ BsIV? !37K ]DUXi ˬt"zkťc/ Ñt{ n,(B7T ߊe8=]F5MlC(mduk\/ !/
jK2j/[ (YvC>ca[JƶG xj Q~ЁxϛLHE̺d.|At[-5 a KW\ejWd3ѽ.pPfa0{f :M*4nJlk+ gd$(4(t=l/l M?aYWٗGٮK:M-VgyԏEƷ1& y[/>1p
p֮,w:bJ{WeC-|sRnK]+i@6İڌ땞y_>+m_LJU|bndgx $9r0=~IIn S-B]'WuGTJ-jUy3[ '_
8CA{8pb^msHIhר|MX'
NMEmwatKS§Qmx_%>yC}FnCߏ$.P..=kN#s)v6#-*3' ?k%}s%Q
s r?0+ 0庤qŕx߲ If?zڽ"+Y}%>
"J"7B:4 + {>%~ AE~+LA) I F;
'].RC"?Pxk@"~Iv`+[}M-gn}Z3B!1N&f[b
H 0
F7jߐ G )%N9c d~'°7˴ &]8 \^5Kgj,41&H[=i\Sb/<ؐ 3zx8¿jt4q? pD0C{ᨮ"h/Uț0TRq`aԤ!d쐯9kpL8ݬ/頬K*rMk>fZj U!^Pjtn*۫gi/ܤ[Y>^L&E0qlxWM~a{.+&OcjjwPՅqسEЛ`E 51%]]>oݗϧi&>? } 銽8Ы6gQ*YR}6A= V2v Ǽ>V!Q7i_(ٱM_\(t@E}X1xEM2G?ǞQN.]?R@.gP~H
EeW[T [l:L?iǜ2+CaUsw> }ZvyLfL߳^ "'{z8Q0:NږBTT:ϳis4B ߃|yK Ũp`J 4fis]V<^x"R:p OKc| 4wOvx˞Pq7˴EXy9JBe{ ]`Bgl#\*mg\p9al-3@3a0ܩ_cZ
AʄVpg~y¦^ SLO0"~hʘF>B]LH8
澁3/ (7Ff}C] =
6)c|PEj[1K#)L; bgBЋ QV:0$¡?: f%cUnN0gSK `PMA@+>䵐7e^ ۱Hq
H`¨GM$NEkqx_hA5 X{Zk ;wR8#MSh8
!yav% & q 7I0 zo s+
q 7 m//K#ZGcdY )i_{Mx[I(ƒ Y0֙,Ɍ7 'GXklnr_ʨrq8sKn"%
''_tqh [h +MŔL!T
n 3W{De2nÉ 4*
)rZDcO~zYzF 6arZT !ckXhc` 'hksE/SKpK\ vK+kJ?K!' YOS5Ղ-{rjZB)IҶE㖎D ;EF[ޖd}GK-7:OJ\u +9WB 1MNߐ1鯽kv߃QC uc u&Pn9w5k? x^ ZOƳ ͠fګ7.J ήG1<-F=|9ےd ?@nh9+'߰G*w2
Eq{p8=HoDOևt :6>--c^4n;ly!0Jaۤs6Pyy{(\`=ɵȬSq+
/E\hklJ &7EԆ^I`]dx34Y.v rx=] ݧ/Hx6uYF@] .FpWum Z+U'%@
d=tFMʧ t8l7
,'&Ҥ
Lܛ|pYD$MPEbv{êk1GX {+Ht V >3Yo
&*=aOX:4FM#WTC`+^A/֔9Vvÿ1<,\8 O+xi fpwMsrԱ ;WB9awc9Pe (w*$dA8HR$p(^g=y9(abA8_ֻ C?E-" M}8ަY S/R7y. wj
<զ^ {s[GĹV0<#gIh kizhnɓMc:Y(x[Mc4pܭRC0h˟bL$a40{AG._β7y(v%'31YT%]<@9ϡu8OJi>iT- QQQQAdV<( >{>+yik !M:9 "Ԡ4\M@K*k5;4> LS%p{&ce}7gßțh l&~/X8i (fU,[ ot«ϬZm HQ$FJiG 4^&7gly?Ld2o r6` g9Eb.vv V$[ٟ軽bII|,T$*y\/% $yN=TEq^K>ʑS[sϥVRUR4fĶ`\ d%Vl7;2m/qAW$d Eu:. : X%}h˵ ^>j/JBϠfcy3ot<â5 ZO
zAGbg,bs ^yѽ.*sL<˝vP֕c O`p5שּuv-%WBېgaӚkwiLȓrw`ou 077Va,-{hhSx0~ܚ$
ժag
ހMÒ89٦
kfe)VN7(:+õp?K+^0p-+_Ma+{_d +pj4CPf `:+2~| ҚzfY0_9(7)q(;'qnn.q /VٴaSv-ͫęې6Ցyt%a0H~3uV5.qFR-MeLmt 7 p1/撈bqG3ӷhpymrI1yMH/X oOn}<?7l4¼vK? |^nnS ås\uwGj,|i5,:,?V&Umx\^ebO+?;8'sk`tW>q5KFVj,~<!bfn\0՝EL ʭvdH< 3zt٧{x;n]a= d@rX`^GϞ1=ǡ![5J* Q(+Ճ_ߋ 7wNChr
]bj+l#g
VG+v =.+
oA!H +Ծsu]:6yU+!U0qrŊç`FӐt;UN7*RIr`H*A(Ē ~H$?q pE6].7]Pl<{ >9 d-er7`sW./{A-/GtA\2cdY8s)8 :m9P~:mQ l0i˫"⼜ǬP]*G䶚z@(zʃ;
ab bI\4[>l afvx;M gH 4iP@pcznaZWg; 'dzRU˞^\Mzm֮š@ %h 0 ح;N΄N ]
Us3\`ݵitjF\zC zb+a Y"~l@ȝփQ;)iA'x P3pW .K˖HRRn
]b_ՙ{` :Xi sI9uup|4"('v`.%%nC x~6+fYzܱ7\K_zŇ,rBXONq`A}CJk^D)/hl#bC^7zjpE l'B(4#T}f;O'.7E>a}U_c ˀ$$Qnc_a[{(}<ݬ3ىts*
xt[.bS4 KBrqdU/m&
J>EfӏVHe r(.&3Kbfܣ}E#s nd/xٵAD#c\; 6@@~b;zxVi:'>0D%*/y/pزTKke`> 1%8=Aq0fkδqخ-d
t ԥw7ăGO1)#48ć`p w6Mq,|p2 eB8Fɿ؟;}X^=y*$QGM9]N_:A $:|L- 8kr2
L|q⤙Q3o]d-a ys. b#7 :c3ĸ?>R13̛P 8-M+h I
ElH QO>ȳf`!}pO_h̀s t|7~VFc\#yE^# 18.бeKTnʃZn|xi)=غ m
'{ ɾq6b!oNf[}J_4"b?o n
8_:^F٢*xW묢oI,e
xh* t49 jSm__qZmxn|2V3<7(ޞng/]m~| biwT" c)Կa]V0RQC`6l"נam*ڟw 7{{=Wʫ8WkU
}z@VՂa0L\ M7%9~]+/ x6璼N.nfwFa~yF,L{_8WkL&I؛Ͱt 0:Lr4EkJxfRX~5yϕcϋ C;Aƍ[7-aØک{m We[שּׂg z%MdKrCf`j!,g!_IqRͩP\:(KNF+U%2UΠٗN r$kn KpF( ϲ~$ \Kb=TnNa%?68R߾uT_ס/pP]em ´*:x^ɸ^l֪_]*܅ Ii gA4S~FOZ㹤ZZ 
- **Technical Meeting:** Every Wednesday at 06:00 UTC (Beijing, Shanghai 14:00), please see our [HackMD](https://hackmd.io/@Nydus/Bk8u2X0p9) page for more information.
## License
[](https://app.fossa.com/projects/git%2Bgithub.com%2Fcontainerd%2Fnydus-snapshotter?ref=badge_large)
nydus-snapshotter-0.13.4/cmd/ 0000775 0000000 0000000 00000000000 14533742372 0016066 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/cmd/containerd-nydus-grpc/ 0000775 0000000 0000000 00000000000 14533742372 0022305 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/cmd/containerd-nydus-grpc/main.go 0000664 0000000 0000000 00000007367 14533742372 0023575 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package main
import (
"fmt"
"os"
"github.com/containerd/containerd/log"
"github.com/pkg/errors"
"github.com/urfave/cli/v2"
"github.com/containerd/nydus-snapshotter/config"
"github.com/containerd/nydus-snapshotter/internal/flags"
"github.com/containerd/nydus-snapshotter/internal/logging"
"github.com/containerd/nydus-snapshotter/pkg/errdefs"
"github.com/containerd/nydus-snapshotter/version"
)
func main() {
flags := flags.NewFlags()
app := &cli.App{
Name: "containerd-nydus-grpc",
Usage: "Nydus remote snapshotter for containerd",
Version: version.Version,
Flags: flags.F,
HideVersion: true,
Action: func(c *cli.Context) error {
if flags.Args.PrintVersion {
fmt.Println("Version: ", version.Version)
fmt.Println("Revision: ", version.Revision)
fmt.Println("Go version: ", version.GoVersion)
fmt.Println("Build time: ", version.BuildTimestamp)
return nil
}
snapshotterConfigPath := flags.Args.SnapshotterConfigPath
var defaultSnapshotterConfig config.SnapshotterConfig
var snapshotterConfig config.SnapshotterConfig
if err := defaultSnapshotterConfig.FillUpWithDefaults(); err != nil {
return errors.New("failed to generate nydus default configuration")
}
// Once snapshotter's configuration file is provided, parse it and let command line parameters override it.
if snapshotterConfigPath != "" {
if c, err := config.LoadSnapshotterConfig(snapshotterConfigPath); err == nil {
// Command line parameters override the snapshotter's configurations for backwards compatibility
if err := config.ParseParameters(flags.Args, c); err != nil {
return errors.Wrap(err, "failed to parse commandline options")
}
snapshotterConfig = *c
} else {
return errors.Wrapf(err, "failed to load snapshotter configuration from %q", snapshotterConfigPath)
}
} else {
if err := config.ParseParameters(flags.Args, &snapshotterConfig); err != nil {
return errors.Wrap(err, "failed to parse commandline options")
}
}
if err := config.MergeConfig(&snapshotterConfig, &defaultSnapshotterConfig); err != nil {
return errors.Wrap(err, "failed to merge configurations")
}
if err := config.ValidateConfig(&snapshotterConfig); err != nil {
return errors.Wrapf(err, "failed to validate configurations")
}
if err := config.ProcessConfigurations(&snapshotterConfig); err != nil {
return errors.Wrap(err, "failed to process configurations")
}
if err := config.SetUpEnvironment(&snapshotterConfig); err != nil {
return errors.Wrap(err, "failed to setup environment")
}
ctx := logging.WithContext()
logConfig := &snapshotterConfig.LoggingConfig
logRotateArgs := &logging.RotateLogArgs{
RotateLogMaxSize: logConfig.RotateLogMaxSize,
RotateLogMaxBackups: logConfig.RotateLogMaxBackups,
RotateLogMaxAge: logConfig.RotateLogMaxAge,
RotateLogLocalTime: logConfig.RotateLogLocalTime,
RotateLogCompress: logConfig.RotateLogCompress,
}
if err := logging.SetUp(logConfig.LogLevel, logConfig.LogToStdout, logConfig.LogDir, logRotateArgs); err != nil {
return errors.Wrap(err, "failed to setup logger")
}
log.L.Infof("Start nydus-snapshotter. Version: %s, PID: %d, FsDriver: %s, DaemonMode: %s",
version.Version, os.Getpid(), config.GetFsDriver(), snapshotterConfig.DaemonMode)
return Start(ctx, &snapshotterConfig)
},
}
if err := app.Run(os.Args); err != nil {
if errdefs.IsConnectionClosed(err) {
log.L.Info("nydus-snapshotter exited")
} else {
log.L.WithError(err).Fatal("failed to start nydus-snapshotter")
}
}
}
nydus-snapshotter-0.13.4/cmd/containerd-nydus-grpc/snapshotter.go 0000664 0000000 0000000 00000006041 14533742372 0025207 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2020. Ant Group. All rights reserved.
* Copyright (c) 2022. Nydus Developers. All rights reserved.
*
* SPDX-License-Identifier: Apache-2.0
*/
package main
import (
"context"
"net"
"os"
"path/filepath"
"github.com/pkg/errors"
"github.com/containerd/nydus-snapshotter/config"
"github.com/containerd/nydus-snapshotter/pkg/auth"
"github.com/containerd/nydus-snapshotter/pkg/utils/signals"
"github.com/containerd/nydus-snapshotter/snapshot"
api "github.com/containerd/containerd/api/services/snapshots/v1"
"github.com/containerd/containerd/contrib/snapshotservice"
"github.com/containerd/containerd/log"
"github.com/containerd/containerd/snapshots"
"google.golang.org/grpc"
)
func Start(ctx context.Context, cfg *config.SnapshotterConfig) error {
ctx, cancel := context.WithCancel(ctx)
defer cancel()
rs, err := snapshot.NewSnapshotter(ctx, cfg)
if err != nil {
return errors.Wrap(err, "failed to initialize snapshotter")
}
stopSignal := signals.SetupSignalHandler()
opt := ServeOptions{
ListeningSocketPath: cfg.Address,
EnableCRIKeychain: cfg.RemoteConfig.AuthConfig.EnableCRIKeychain,
ImageServiceAddress: cfg.RemoteConfig.AuthConfig.ImageServiceAddress,
}
if cfg.RemoteConfig.AuthConfig.EnableKubeconfigKeychain {
if err := auth.InitKubeSecretListener(ctx, cfg.RemoteConfig.AuthConfig.KubeconfigPath); err != nil {
return err
}
}
return Serve(ctx, rs, opt, stopSignal)
}
type ServeOptions struct {
ListeningSocketPath string
EnableCRIKeychain bool
ImageServiceAddress string
}
func Serve(ctx context.Context, sn snapshots.Snapshotter, options ServeOptions, stop <-chan struct{}) error {
err := ensureSocketNotExists(options.ListeningSocketPath)
if err != nil {
return err
}
rpc := grpc.NewServer()
if rpc == nil {
return errors.New("start gRPC server")
}
api.RegisterSnapshotsServer(rpc, snapshotservice.FromSnapshotter(sn))
listener, err := net.Listen("unix", options.ListeningSocketPath)
if err != nil {
return errors.Wrapf(err, "listen socket %q", options.ListeningSocketPath)
}
if options.EnableCRIKeychain {
auth.AddImageProxy(ctx, rpc, options.ImageServiceAddress)
}
go func() {
<-stop
log.L.Infof("Shutting down nydus-snapshotter!")
if err := sn.Close(); err != nil {
log.L.WithError(err).Errorf("Closing snapshotter error")
}
if err := listener.Close(); err != nil {
log.L.Errorf("Failed to close listener %s, err: %v", options.ListeningSocketPath, err)
}
}()
return rpc.Serve(listener)
}
func ensureSocketNotExists(listeningSocketPath string) error {
if err := os.MkdirAll(filepath.Dir(listeningSocketPath), 0700); err != nil {
return errors.Wrapf(err, "failed to create directory %q", filepath.Dir(listeningSocketPath))
}
finfo, err := os.Stat(listeningSocketPath)
// err is nil means listening socket path exists, remove before serve
if err == nil {
if finfo.Mode()&os.ModeSocket == 0 {
return errors.Errorf("file %s is not a socket", listeningSocketPath)
}
err := os.Remove(listeningSocketPath)
if err != nil {
return err
}
}
return nil
}
nydus-snapshotter-0.13.4/cmd/converter/ 0000775 0000000 0000000 00000000000 14533742372 0020075 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/cmd/converter/main.go 0000664 0000000 0000000 00000000340 14533742372 0021345 0 ustar 00root root 0000000 0000000 package main
// Import the converter package so that it can be compiled during
// `go build` to ensure cross-compilation compatibility.
import (
_ "github.com/containerd/nydus-snapshotter/pkg/converter"
)
func main() {
}
nydus-snapshotter-0.13.4/cmd/nydus-overlayfs/ 0000775 0000000 0000000 00000000000 14533742372 0021240 5 ustar 00root root 0000000 0000000 nydus-snapshotter-0.13.4/cmd/nydus-overlayfs/main.go 0000664 0000000 0000000 00000007271 14533742372 0022522 0 ustar 00root root 0000000 0000000 package main
import (
"fmt"
"log"
"os"
"strings"
"syscall"
"github.com/pkg/errors"
"github.com/urfave/cli/v2"
"golang.org/x/sys/unix"
)
const (
// Extra mount option to pass Nydus specific information from snapshotter to runtime through containerd.
extraOptionKey = "extraoption="
// Kata virtual volume infmation passed from snapshotter to runtime through containerd, superset of `extraOptionKey`.
// Please refer to `KataVirtualVolume` in https://github.com/kata-containers/kata-containers/blob/main/src/libs/kata-types/src/mount.rs
kataVolumeOptionKey = "io.katacontainers.volume="
)
var (
Version = "v0.1"
BuildTime = "unknown"
)
/*
containerd run fuse.mount format: nydus-overlayfs overlay /tmp/ctd-volume107067851
-o lowerdir=/foo/lower2:/foo/lower1,upperdir=/foo/upper,workdir=/foo/work,extraoption={...},dev,suid]
*/
type mountArgs struct {
fsType string
target string
options []string
}
func parseArgs(args []string) (*mountArgs, error) {
margs := &mountArgs{
fsType: args[0],
target: args[1],
}
if margs.fsType != "overlay" {
return nil, errors.Errorf("invalid filesystem type %s for overlayfs", margs.fsType)
}
if len(margs.target) == 0 {
return nil, errors.New("empty overlayfs mount target")
}
if args[2] == "-o" && len(args[3]) != 0 {
for _, opt := range strings.Split(args[3], ",") {
// filter Nydus specific options
if strings.HasPrefix(opt, extraOptionKey) || strings.HasPrefix(opt, kataVolumeOptionKey) {
continue
}
margs.options = append(margs.options, opt)
}
}
if len(margs.options) == 0 {
return nil, errors.New("empty overlayfs mount options")
}
return margs, nil
}
func parseOptions(options []string) (int, string) {
flagsTable := map[string]int{
"async": unix.MS_SYNCHRONOUS,
"atime": unix.MS_NOATIME,
"bind": unix.MS_BIND,
"defaults": 0,
"dev": unix.MS_NODEV,
"diratime": unix.MS_NODIRATIME,
"dirsync": unix.MS_DIRSYNC,
"exec": unix.MS_NOEXEC,
"mand": unix.MS_MANDLOCK,
"noatime": unix.MS_NOATIME,
"nodev": unix.MS_NODEV,
"nodiratime": unix.MS_NODIRATIME,
"noexec": unix.MS_NOEXEC,
"nomand": unix.MS_MANDLOCK,
"norelatime": unix.MS_RELATIME,
"nostrictatime": unix.MS_STRICTATIME,
"nosuid": unix.MS_NOSUID,
"rbind": unix.MS_BIND | unix.MS_REC,
"relatime": unix.MS_RELATIME,
"remount": unix.MS_REMOUNT,
"ro": unix.MS_RDONLY,
"rw": unix.MS_RDONLY,
"strictatime": unix.MS_STRICTATIME,
"suid": unix.MS_NOSUID,
"sync": unix.MS_SYNCHRONOUS,
}
var (
flags int
data []string
)
for _, o := range options {
if f, exist := flagsTable[o]; exist {
flags |= f
} else {
data = append(data, o)
}
}
return flags, strings.Join(data, ",")
}
func run(args cli.Args) error {
margs, err := parseArgs(args.Slice())
if err != nil {
return errors.Wrap(err, "parse mount options")
}
flags, data := parseOptions(margs.options)
err = syscall.Mount(margs.fsType, margs.target, margs.fsType, uintptr(flags), data)
if err != nil {
return errors.Wrapf(err, "mount overlayfs by syscall")
}
return nil
}
func main() {
app := &cli.App{
Name: "NydusOverlayfs",
Usage: "FUSE mount helper for containerd to filter out Nydus specific options",
Version: fmt.Sprintf("%s.%s", Version, BuildTime),
UsageText: "[Usage]: nydus-overlayfs overlay