Commits on Jul 29, 2022

1. daemon: support other containerd runtimes (MVP) …

   Contrary to popular belief, the OCI Runtime specification does not
   specify the command-line API for runtimes. Looking at containerd's
   architecture from the lens of the OCI Runtime spec, the _shim_ is the
   OCI Runtime and runC is "just" an implementation detail of the
   io.containerd.runc.v2 runtime. When one configures a non-default runtime
   in Docker, what they're really doing is instructing Docker to create
   containers using the io.containerd.runc.v2 runtime with a configuration
   option telling the runtime that the runC binary is at some non-default
   path. Consequently, only OCI runtimes which are compatible with the
   io.containerd.runc.v2 shim, such as crun, can be used in this manner.
   Other OCI runtimes, including kata-containers v2, come with their own
   containerd shim and are not compatible with io.containerd.runc.v2.
   As Docker has not historically provided a way to select a non-default
   runtime which requires its own shim, runtimes such as kata-containers v2
   could not be used with Docker.
   
   Allow other containerd shims to be used with Docker; no daemon
   configuration required. If the daemon is instructed to create a
   container with a runtime name which does not match any of the configured
   or stock runtimes, it passes the name along to containerd verbatim. A
   user can start a container with the kata-containers runtime, for
   example, simply by calling
   
       docker run --runtime io.containerd.kata.v2
   
   Runtime names which containerd would interpret as a path to an arbitrary
   binary are disallowed. While handy for development and testing it is not
   strictly necessary and would allow anyone with Engine API access to
   trivially execute any binary on the host as root, so we have decided it
   would be safest for our users if it was not allowed.
   
   It is not yet possible to set an alternative containerd shim as the
   default runtime; it can only be configured per-container.
   
   Signed-off-by: Cory Snider <csnider@mirantis.com>
   (cherry picked from commit 547da0d)
   Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

   

   corhere authored and thaJeztah committed Jul 29, 2022
   Configuration menu

   • View commit details
   • Copy full SHA for 6de52a2
   • Browse repository at this point

   Copy the full SHA

   6de52a2 View commit details

   Browse the repository at this point in the history