amshinde

Passing a graphics card to a Clear Container

Host system setup:

The directions below are specific to an Ubuntu 16.04 host system equipped with a GeForce GTX 550 Ti graphics card. While the process should be the same, YMMV.

1. Make sure your system supports IOMMU groups

todo -- get directions from SRIOV page

amshinde

Connecting a veth device to tap

• veth device from CNI/CNM plugin: eth0
• tap device that connects to the VM: tap0

Redirecting traffic between the two devices

tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev tap0

amshinde

Macvlan, Ipvlan and 802.1q Trunk Driver Notes

Contents

• Getting Started - Download and Install the Experimental Driver

• MacVlan Bridge Mode Example Usage

• Ipvlan L2 Mode Example Usage

amshinde

How to use VFIO to assign a device to nested VM

• Here the vfio-pci device is passed in into the L1 VM
• The L1 VM is setup with kernel_irqchip=split
• The L0 exposes a virtual IOMMU to the L1 VM

qemu-system-x86_64 \
    -machine q35,accel=kvm,kernel_irqchip=split \
    -enable-kvm \

amshinde

The netfilter hooks in the kernel and where they hook in the packet flow

The figure below calls out

• The netfilter hooks
• The order of table traversal

amshinde

Setting up a overlay network using point to multi-point GRE tunnels

Multi-Point GRE Tunnels

Typically VxLAN is used to setup a point to multi-point overlay networks. However GRE also offers a similar capability which is often not heavily used. This document calls out how to setup an effient overlay mesh network to link up multiples sits together using multi point GRE tunnels.

Setup

The setup used in this case assumes there is a need to link three sites hosting three different subnets together using a simple overlay mesh network.

amshinde

Create a process with its own network and pid namespace

$ unshare --user --map-root-user --net --mount
[root@incensed-gawain ~]# echo $$
2646

Run the slirp process on the host

amshinde

https://software.intel.com/sites/default/files/managed/c5/15/vt-directed-io-spec.pdf

• Legacy pin interrupts

— For devices that use legacy methods for interrupt routing (such as either through direct wiring to the I/OxAPIC input pins, or through INTx messages), the I/OxAPIC hardware generates the interrupt-request transaction. To identify the source of interrupt requests generated by I/OxAPICs, the interrupt-remapping hardware requires each I/OxAPIC in the platform (enumerated through the ACPI Multiple APIC Descriptor Tables (MADT)) to include a unique 16-bit source-id in its requests. BIOS reports the source-id for these I/OxAPICs via ACPI

amshinde

How to do a Kata Containers Release

Hi if you are reading this document you may also want to create a kata Containers Release.

The Kata Containers Release Process is defined in the follwoing documents.

https://github.com/kata-containers/documentation/blob/master/Releases.md

To simply the process of read each release we have created a checklist for it.

amshinde

for table in $(echo filter nat mangle raw security); do echo $table; iptables -L -v -n --line-numbers -t $table; done

tcpdump -elnXXi