sameo

Overview

Build an initramfs

(Copied from Manohar's gist: https://gist.github.com/mcastelino/74dc46bdfddc9943f2c04466d605a65b which is copied from https://gist.github.com/pacalet/660fa6472e0bcd53f71fc31f167c628f)

• Use a busybox based rootfs for ease of use

git clone https://github.com/mirror/busybox
cd busybox

sameo

Measuring Firecracker boot time

Firecracker comes with an internal way of logging a timestamp that measures time elapsed between the very start of the guest VM and the moment a specific IO port has been written to.

That allows for marking specific moment along the boot process by having code writing to this port.

Artifacts build

Here we're going to measure the time it takes for a Firecracker guest VM to reach userspace. To do so we're going to build 3 components:

sameo

From http://unix.stackexchange.com/questions/33381/getting-information-about-a-process-memory-usage-from-proc-pid-smaps

For a given process in /proc/<pid>/smaps, for a given mapping entry what are:

    Shared_Clean
    Shared_Dirty
    Private_Clean
    Private_Dirty

sameo

VFIO

Not KVM bound. The VFIO API deconstructs a device into regions, irqs, etc. The userspace application (QEMU, cloud-hypervisor, etc..) is responsible for reconstructing it into a device for e.g. a guest VM to consume.

Boot with intel_iommu=on.

IOMMU groups

Devices are bound together for isolation, IOMMU capabilities and platform topology reasons. It is not configurable.

sameo

Terminology

• UDS: Unique Device Secret. This is a per-device hardware-level secret accessible to the DICE but not accessible after the DICE runs.
• CDI: Compound Device Identifier. This value represents the hardware/software combination measured by the DICE. This is the DICE output and is passed to the software which has been measured. This is a secret.

Definitions

Hash Function

A hash function (e.g. SHA2-384):

sameo

func (k *kataAgent) createContainer

sameo

Table of Contents

• Requirements
• Install the latest k8s packages
• Install, patch, build and start CRI-O
  • Using runc as the CRI-O container runtime
  • Using COR as the CRI-O container runtime
• Modify kubelet systemd service to use the ocid socket
• Install, patch and build Clear Containers

sameo

Description

qboot is a simple x86 firmware that can boot Linux.

It is Paolo Bonzini's answer to the Clear Containers claim that QEMU takes too long to boot a Linux kernel.

qboot only works as a QEMU firmware as it's bound to QEMU's fw_cfg NVRAM firmware configuration device emulation mode.

sameo

sandbox_cgroup_only = false

Sandbox creation

• No sandbox cgroup manager is created
• Cgroup for sandbox container is created
• Takes linux:cgroup_parent as the cgroup root
• Creates v1 cgroup hierearchy: /sys/fs/cgroup/memory/vc/<linux:cgroup_parent>/kata_<sandbox_id>/, etc
• Add the process linked to the sandbox container to the cgroups.
• Only adds the CPU resources at first

sameo

{
	"ociVersion": "1.0.0",
	"process": {
		"terminal": true,
		"user": {
			"uid": 0,
			"gid": 0
		},
		"args": [
			"/docker-entrypoint.sh",