Support Rootless Docker #12359
Merged
Support Rootless Docker #12359
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
k8s-ci-robot
added
the
cncf-cla: yes
k8s-ci-robot
added
the
size/L
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: AkihiroSuda The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Can one of the admins verify this patch? |
Closed
|
Thanks @AkihiroSuda!! |
Requirements: - Install rootless Docker 20.10 or later, see https://rootlesscontaine.rs/getting-started/docker/ - Enable cgroup v2 delegation, see https://rootlesscontaine.rs/getting-started/common/cgroup2/ Usage: `minikube start --driver=docker --container-runtime=containerd`. The `--container-runtime` flag needs to be set to "containerd". CRI-O can be also supported later. Closes issue 10836 ("add support for rootless Docker"). Support for rootless Podman (issue 8719) is not covered in this commit. --- Code reading guide: - `deploy/kicbase/Dockerfile`: updated to install fuse-overlayfs and containerd-fuse-overlayfs, which is used instead of `overlayfs` snapshotter - `deploy/kicbase/entrypoint`: updated to verify cgroup v2 delegation. Mostly from https://github.com/kubernetes-sigs/kind/blob/8a83ee46b28a80ccd47a85e24294b3e149361947/images/base/files/usr/local/bin/entrypoint - `cmd/minikube/cmd/start_flags.go`: updated to set `KubeletInUserNamespace` feature gate when rootless - `pkg/drivers/kic/oci`: updated to use port forwarding, because rootless container IPs are not reachable from the host - `pkg/minikube/cruntime`: updated to generate `/etc/containerd/config.toml` with rootless support. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
|
/ok-to-test |
k8s-ci-robot
added
the
ok-to-test
|
kvm2 driver with docker runtime Times for minikube start: 57.4s 49.6s 54.6s 55.1s 54.1s Times for minikube ingress: 33.0s 33.5s 33.0s 31.9s 32.4s docker driver with docker runtime Times for minikube ingress: 37.0s 34.5s 27.5s 28.0s 36.5s Times for minikube start: 23.4s 22.3s 21.9s 23.2s 23.7s docker driver with containerd runtime Times for minikube (PR 12359) start: 29.4s 44.2s 43.9s 45.4s 44.3s |
|
These are the flake rates of all failed tests.
Too many tests failed - See test logs for more details. To see the flake rates of all tests by environment, click here. |
|
@TestAddons/parallel/HelmTiller seem to be failing only on this PR and not on master but it might be a problem not ralted to this PR since I can not pull that image manually either |
ok I confirm the failure is not related to this PR (see #12377) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #10836 ("add support for rootless Docker").
Support for rootless Podman (issue #8719) is not covered in this PR.
Requirements
Usage
The
--container-runtimeflag needs to be set to "containerd".CRI-O can be also supported later.
Code reading guide
deploy/kicbase/Dockerfile: updated to install fuse-overlayfs and containerd-fuse-overlayfs, which is used instead ofoverlayfssnapshotterdeploy/kicbase/entrypoint: updated to verify cgroup v2 delegation. Mostly from https://github.com/kubernetes-sigs/kind/blob/8a83ee46b28a80ccd47a85e24294b3e149361947/images/base/files/usr/local/bin/entrypointcmd/minikube/cmd/start_flags.go: updated to setKubeletInUserNamespacefeature gate when rootlesspkg/drivers/kic/oci: updated to use port forwarding, because rootless container IPs are not reachable from the hostpkg/minikube/cruntime: updated to generate/etc/containerd/config.tomlwith rootless support.