# 将rootfs.tar.gz和runc拷贝到目标机器上
# 创建config.json文件，文件内容如下：
{
        "ociVersion": "1.0.2-dev",
        "process": {
                "terminal": false,
                "user": {
                        "uid": 0,
                        "gid": 0
                },
                "args": [
                        "tail",
                        "-f",
                        "/etc/hosts"
                ],
                "env": [
                        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                        "TERM=xterm"
                ],
                "cwd": "/",
                "capabilities": {
                        "bounding":[
                                "CAP_CHOWN",
                                "CAP_DAC_OVERRIDE",
                                "CAP_FSETID",
                                "CAP_FOWNER",
                                "CAP_MKNOD",
                                "CAP_NET_RAW",            //// 不加这个，会报：ping: socket: Operation not permitted
                                "CAP_SETGID",
                                "CAP_SETUID",
                                "CAP_SETFCAP",
                                "CAP_SETPCAP",
                                "CAP_NET_BIND_SERVICE",
                                "CAP_SYS_CHROOT",
                                "CAP_KILL",
                                "CAP_AUDIT_WRITE"
                        ],
                        "effective":[
                                "CAP_CHOWN",
                                "CAP_DAC_OVERRIDE",
                                "CAP_FSETID",
                                "CAP_FOWNER",
                                "CAP_MKNOD",
                                "CAP_NET_RAW",
                                "CAP_SETGID",
                                "CAP_SETUID",
                                "CAP_SETFCAP",
                                "CAP_SETPCAP",
                                "CAP_NET_BIND_SERVICE",
                                "CAP_SYS_CHROOT",
                                "CAP_KILL",
                                "CAP_AUDIT_WRITE"
                        ],
                        "permitted":[
                                "CAP_CHOWN",
                                "CAP_DAC_OVERRIDE",
                                "CAP_FSETID",
                                "CAP_FOWNER",
                                "CAP_MKNOD",
                                "CAP_NET_RAW",
                                "CAP_SETGID",
                                "CAP_SETUID",
                                "CAP_SETFCAP",
                                "CAP_SETPCAP",
                                "CAP_NET_BIND_SERVICE",
                                "CAP_SYS_CHROOT",
                                "CAP_KILL",
                                "CAP_AUDIT_WRITE"
                        ]
                },
                "rlimits": [
                        {
                                "type": "RLIMIT_NOFILE",
                                "hard": 1024,
                                "soft": 1024
                        }
                ],
                "noNewPrivileges": true
        },
        "root": {
                "path": "rootfs",
                "readonly": false
        },
        "hostname": "runc",
        "mounts": [
                {
                        "destination": "/proc",
                        "type": "proc",
                        "source": "proc"
                },
                {
                        "destination": "/dev",
                        "type": "tmpfs",
                        "source": "tmpfs",
                        "options": [
                                "nosuid",
                                "strictatime",
                                "mode=755",
                                "size=65536k"
                        ]
                },
                {
                        "destination": "/dev/pts",
                        "type": "devpts",
                        "source": "devpts",
                        "options": [
                                "nosuid",
                                "noexec",
                                "newinstance",
                                "ptmxmode=0666",
                                "mode=0620",
                                "gid=5"
                        ]
                },
                {
                        "destination": "/dev/shm",
                        "type": "tmpfs",
                        "source": "shm",
                        "options": [
                                "nosuid",
                                "noexec",
                                "nodev",
                                "mode=1777",
                                "size=65536k"
                        ]
                },
                {
                        "destination": "/dev/mqueue",
                        "type": "mqueue",
                        "source": "mqueue",
                        "options": [
                                "nosuid",
                                "noexec",
                                "nodev"
                        ]
                },
                {
                        "destination": "/sys",
                        "type": "sysfs",
                        "source": "sysfs",
                        "options": [
                                "nosuid",
                                "noexec",
                                "nodev",
                                "ro"
                        ]
                },
                {
                        "destination": "/etc/resolv.conf",
                        "options": [
                                "rbind",
                                "rprivate"
                        ],
                        "source": "/etc/resolv.conf",
                        "type": "bind"
                },
                {
                        "destination": "/etc/hostname",
                        "options": [
                                "rbind",
                                "rprivate"
                        ],
                        "source": "/etc/hostname",
                        "type": "bind"
                },
                {
                        "destination": "/etc/hosts",
                        "options": [
                                "rbind",
                                "rprivate"
                        ],
                        "source": "/etc/hosts",
                        "type": "bind"
                },
                {
                        "destination": "/sys/fs/cgroup",
                        "type": "cgroup",
                        "source": "cgroup",
                        "options": [
                                "nosuid",
                                "noexec",
                                "nodev",
                                "relatime",
                                "ro"
                        ]
                }
        ],
        "linux": {
                "resources": {
                        "devices": [
                                {
                                        "allow": false,
                                        "access": "rwm"
                                }
                        ]
                },
                "namespaces": [
                        {
                                "type": "pid"
                        },
                        {
                                "type": "ipc"
                        },
                        {
                                "type": "uts"
                        },
                        {
                                "type": "mount"
                        }
                ],
                "maskedPaths": [
                        "/proc/acpi",
                        "/proc/asound",
                        "/proc/kcore",
                        "/proc/keys",
                        "/proc/latency_stats",
                        "/proc/timer_list",
                        "/proc/timer_stats",
                        "/proc/sched_debug",
                        "/sys/firmware",
                        "/proc/scsi"
                ],
                "readonlyPaths": [
                        "/proc/bus",
                        "/proc/fs",
                        "/proc/irq",
                        "/proc/sys",
                        "/proc/sysrq-trigger"
                ]
        }
}
 
tar -xzf rootfs.tar.gz
./runc run -d --pid-file init.pid   supervisord
./runc exec -t supervisord bash
# yum clean, yum clean all (= yum clean packages; yum clean oldheaders)
# yum clean headers      清除header
# yum clean oldheaders   清除缓存目录(/var/cache/yum)下旧的 headers
# yum clean packages     清除下载的rpm包
yum clean all; yum clean headers

runc在arm64 麒麟系统中，有个bug：

unable to start container process: error adding pid 2047088 to cgroups: failed to write 2047088: open /sys/fs/cgroup/blkio/system.slice/supervisord/cgroup.procs: no such file or directory

需要改runc的代码，并重新编译，改动分支release-1.1，改动如下：

diff --git a/Makefile b/Makefile
index e3af9bc..0c0a2fd 100644
--- a/Makefile
+++ b/Makefile
@@ -68,15 +68,16 @@ recvtty sd-helper seccompagent:
 static:
        $(GO_BUILD_STATIC) -o runc .
 
-releaseall: RELEASE_ARGS := "-a arm64 -a armel -a armhf -a ppc64le -a riscv64 -a s390x"
+releaseall: RELEASE_ARGS := "-a arm64"
 releaseall: release
 
-release: runcimage
+release:
        $(CONTAINER_ENGINE) run $(CONTAINER_ENGINE_RUN_FLAGS) \
                --rm -v $(CURDIR):/go/src/$(PROJECT) \
                -e RELEASE_ARGS=$(RELEASE_ARGS) \
+               --pull never \
                $(RUNC_IMAGE) make localrelease
-       script/release_sign.sh -S $(GPG_KEYID) -r release/$(VERSION) -v $(VERSION)
+       #script/release_sign.sh -S $(GPG_KEYID) -r release/$(VERSION) -v $(VERSION)
 
 localrelease: verify-changelog
        script/release_build.sh -r release/$(VERSION) -v $(VERSION) $(RELEASE_ARGS)
diff --git a/libcontainer/cgroups/utils.go b/libcontainer/cgroups/utils.go
index fc4ae44..e84295d 100644
--- a/libcontainer/cgroups/utils.go
+++ b/libcontainer/cgroups/utils.go
@@ -393,6 +393,10 @@ func WriteCgroupProc(dir string, pid int) error {
                return nil
        }
 
+       if err := os.MkdirAll(dir, 0o755); err != nil {
+               return err
+       }
+
        file, err := OpenFile(dir, CgroupProcesses, os.O_WRONLY)
        if err != nil {
                return fmt.Errorf("failed to write %v: %w", pid, err)

编译命令：

# runc_dev-main.tar 使用 make runcimage 命令生成，生成时间较长，一般10h
$ docker load -i runc_dev-main.tar
$ docker tag runc_dev:main runc_dev:release-1-1
$ make releaseall

本文发表于 0001-01-01，最后修改于 0001-01-01。

本站永久域名「 jiavvc.top 」，也可搜索「后浪笔记一零二四」找到我。

推荐阅读