61 lines
1.8 KiB
Diff
61 lines
1.8 KiB
Diff
From 0fb8c1bd205397ee2efd070dc525a17e9a787857 Mon Sep 17 00:00:00 2001
|
|
From: Zhigang Wang <wangzhigang17@huawei.com>
|
|
Date: Mon, 1 Jan 2024 21:51:25 +0800
|
|
Subject: [PATCH 5/5] mount: Reduce the mount points with namespace isolation
|
|
|
|
This patch can reduce load on systemd process, and
|
|
increase the k8s deployment density when using go runtime.
|
|
|
|
Signed-off-by: Zhigang Wang <wangzhigang17@huawei.com>
|
|
Signed-off-by: Liu Wenyuan <liuwenyuan9@huawei.com>
|
|
---
|
|
src/runtime/pkg/containerd-shim-v2/service.go | 25 +++++++++++++++++++
|
|
1 file changed, 25 insertions(+)
|
|
|
|
diff --git a/src/runtime/pkg/containerd-shim-v2/service.go b/src/runtime/pkg/containerd-shim-v2/service.go
|
|
index 26d4c21..7b06429 100644
|
|
--- a/src/runtime/pkg/containerd-shim-v2/service.go
|
|
+++ b/src/runtime/pkg/containerd-shim-v2/service.go
|
|
@@ -191,6 +191,27 @@ func newCommand(ctx context.Context, id, containerdBinary, containerdAddress str
|
|
return cmd, nil
|
|
}
|
|
|
|
+func setupMntNs() error {
|
|
+ err := unix.Unshare(unix.CLONE_NEWNS)
|
|
+ if err != nil {
|
|
+ return err
|
|
+ }
|
|
+
|
|
+ err = unix.Mount("", "/", "", unix.MS_REC|unix.MS_SLAVE, "")
|
|
+ if err != nil {
|
|
+ err = fmt.Errorf("failed to mount with slave: %v", err)
|
|
+ return err
|
|
+ }
|
|
+
|
|
+ err = unix.Mount("", "/", "", unix.MS_REC|unix.MS_SHARED, "")
|
|
+ if err != nil {
|
|
+ err = fmt.Errorf("failed to mount with shared: %v", err)
|
|
+ return err
|
|
+ }
|
|
+
|
|
+ return nil
|
|
+}
|
|
+
|
|
// StartShim is a binary call that starts a kata shimv2 service which will
|
|
// implement the ShimV2 APIs such as create/start/update etc containers.
|
|
func (s *service) StartShim(ctx context.Context, opts cdshim.StartOpts) (_ string, retErr error) {
|
|
@@ -255,6 +276,10 @@ func (s *service) StartShim(ctx context.Context, opts cdshim.StartOpts) (_ strin
|
|
}
|
|
}
|
|
|
|
+ if err := setupMntNs(); err != nil {
|
|
+ return "", err
|
|
+ }
|
|
+
|
|
if err := cmd.Start(); err != nil {
|
|
return "", err
|
|
}
|
|
--
|
|
2.34.1
|
|
|