docs: documentation for running rootless kata-runtime #553

gabibeyer · 2019-09-04T22:45:45Z

The documentation was created assuming that the podman changes and kata changes have been merged into a release. At this time, this is not the case. In order to test/follow the documentation (if someone wants to do that prior to that) you will have to checkout my forks of podman and the kata-runtime. Additionally, they will need to be build from source with their dependencies. I also created a script/gist that may be helpful to set up this kind of pre-release environment: https://gist.github.com/gabibeyer/ca61f433eca00dd3123d3f70efbe7614

Documentation for running Kata Containers with Podman as a non
privileged user

Signed-off-by: gabi beyer [email protected]

marcov

Thanks @gabibeyer for the doc, and for the all work you did to have this working in Kata / Podman!
I really appreciate the ability to run kata / podman rootless.

Take a look at the comments and suggested rewrite I left. To recap:

the way to write notes should follow this
the way to write code blocks should follow this
<br> are usually not needed, the markdown will render just fine without them!
Between a sentence and a code block, better to put some punctuation, otherwise it looks like the sentence is not typed out completely.

how-to/how-to-use-rootless-kata-with-podman.md

jodh-intel

Thanks @gabibeyer! This is going to be an increasingly useful doc I suspect.

A few comments to align this into the "standard form" ;)

how-to/how-to-use-rootless-kata-with-podman.md

gabibeyer · 2019-09-06T03:13:16Z

@marcov @jodh-intel Thank you both so much for the detailed PR review; it was extremely helpful and I learned a lot about markdown! I made the first run of changes, but anticipated I missed a few things. I will look it over again in the morning :) Thank you again!

jodh-intel

Thanks @gabibeyer.

@klynnrif - ptal.

how-to/how-to-use-rootless-kata-containers-with-podman.md

marcov

I did another review round @gabibeyer, sorry if I am overwhelming you with comments.

Overall, I am satisfied with how this document is turning out!

how-to/how-to-use-rootless-kata-containers-with-podman.md

gabibeyer · 2019-09-06T16:46:42Z

@marcov Not overwhelming at all! I really appreciate the thoroughness of both your reviews, thank you!

gabibeyer · 2019-09-06T16:49:33Z

I don't have permission for labeling this, but should be DNM until the Podman and Kata releases, so that the versions can be updated in the table

Documentation for running Kata Containers with Podman as a non privileged user Fixes: kata-containers#540 Signed-off-by: gabi beyer <[email protected]>

klynnrif

Scrubbed for spelling, grammar, and voice. Some suggested rewrites here to keep an active voice. Thanks!

klynnrif · 2019-09-16T18:18:59Z

how-to/how-to-use-rootless-kata-containers-with-podman.md

+
+## Requirements
+- A Linux system, see [supported distributions](https://github.com/kata-containers/documentation/blob/master/install/README.md#supported-distributions) for an updated list.
+  - If using CentOS 7, `newuidmap` and `newgidmap` do not exist, and can be installed with:


Suggested rewrite:
If using CentOS 7, newuidmap and newgidmap do not exist. Install them with:

klynnrif · 2019-09-16T18:19:31Z

how-to/how-to-use-rootless-kata-containers-with-podman.md

+> If installing Podman with a package manager, there is usually no need to install slirp4netns separately.
+
+## Configuration
+Now that Kata Containers and Podman have been installed, they need to be configured for rootless execution.


Suggested rewrite:
Now that you have installed Kata Containers and Podman, you need to configure them for rootless execution.

klynnrif · 2019-09-16T18:19:58Z

how-to/how-to-use-rootless-kata-containers-with-podman.md

+If SELinux is installed and enabled, it needs to be disabled with the following command (Kata Containers [does not support SELinux](https://github.com/kata-containers/documentation/blob/master/Limitations.md#selinux-support)).
+
+> **Warning:**
+> The following command may differ depending on the distro being used:


Suggested rewrite:
The following command might differ depending on the distro you use:

klynnrif · 2019-09-16T18:20:24Z

how-to/how-to-use-rootless-kata-containers-with-podman.md

+```
+
+#### 2. Add user to KVM group
+If running a KVM based hypervisor, the user running the workload needs to be added to the KVM group:


Suggested rewrite:
If running a KVM based hypervisor, add the user running the workload to the KVM group:

klynnrif · 2019-09-16T18:21:24Z

how-to/how-to-use-rootless-kata-containers-with-podman.md

+```
+
+#### 3. Reboot
+Reboot the system for the changes to take effect (a reboot is required when disabling SELinux, while logging out and back in is enough to have that user joining the `KVM` group).


Suggested rewrite:
... (when you disable SELinux you must reboot, while logging out and back in is enough to have that user joining the ‘KVM’ group).

klynnrif · 2019-09-16T18:41:22Z

how-to/how-to-use-rootless-kata-containers-with-podman.md

+
+> **NOTE:**
+> To obtain debug logs you can:
+>  - Enable [debug](https://github.com/kata-containers/documentation/blob/master/Developer-Guide.md#enable-full-debug) in Kata (logs are added to journald).


Suggested rewrite:
… (this adds the logs to journald).

klynnrif · 2019-09-16T18:41:44Z

how-to/how-to-use-rootless-kata-containers-with-podman.md

+> **NOTE:**
+> To obtain debug logs you can:
+>  - Enable [debug](https://github.com/kata-containers/documentation/blob/master/Developer-Guide.md#enable-full-debug) in Kata (logs are added to journald).
+>  - Pass `--log-level=debug` to Podman (logs are printed to stderr).


Suggested rewrite:
… (this prints the logs to stderr).

klynnrif · 2019-09-16T18:42:21Z

how-to/how-to-use-rootless-kata-containers-with-podman.md

+>  - Pass `--log-level=debug` to Podman (logs are printed to stderr).
+
+## Appendix: Possible Errors
+If you are building from source you may encounter the following errors.


may => might
If you are building from source you might encounter the following errors.

klynnrif · 2019-09-16T18:42:41Z

how-to/how-to-use-rootless-kata-containers-with-podman.md

+rpc error: code = Internal desc = Could not add route dest()/gw(10.0.2.2)/dev(tap0): network is unreachable: OCI runtime error
+```
+Solution:
+You may need to [rebuild the agent](https://github.com/kata-containers/documentation/blob/master/Developer-Guide.md#add-a-custom-agent-to-the-image---optional); there was a change in both the [agent](https://github.com/kata-containers/agent/commit/a78e8cfda627cc350dc9d9ca9b969ebb642030c3) and [runtime](https://github.com/kata-containers/runtime/commit/cfedb06a19135e2ab4f18203a4f3147cdc3a4980) code. This would probably only occur if building latest from source, since the runtime version would have the change and the released agent does not.


may => might
You might need to...

klynnrif · 2019-09-16T18:43:06Z

how-to/how-to-use-rootless-kata-containers-with-podman.md

+
+### Missing registry file
+```
+Error: unable to pull alpine: image name provided is a short name and no search registries are defined in the registries config file.


Suggested rewrite:
Error: unable to pull alpine: image name provided is a short name. The registries config file does not define the search registries.

Hi @klynnrif - alas, we can't change this here as the doc is simply reporting an error (verbatim) coming from the runtime itself. The PR is now over at #565.

(but all other review feedback has been applied to the new PR).

AkihiroSuda · 2019-09-17T08:50:58Z

how-to/how-to-use-rootless-kata-containers-with-podman.md

+
+| Component       | Version | Install Instructions|
+| ----------------|:-------:|---------------------|
+| Podman          | WIP     | [see here](https://github.com/containers/libpod/blob/master/install.md)


Does it work with Rootless Docker as well?

jodh-intel · 2019-10-11T08:47:21Z

Closing this PR in favour of #565.

gabibeyer requested a review from a team as a code owner September 4, 2019 22:45

gabibeyer force-pushed the podmanDocs branch 5 times, most recently from 9b975e1 to 3cbb6b6 Compare September 5, 2019 00:07

marcov reviewed Sep 5, 2019

View reviewed changes

jodh-intel mentioned this pull request Sep 5, 2019

Add Podman to spell checker dictionary kata-containers/tests#1948

Closed

jodh-intel reviewed Sep 5, 2019

View reviewed changes

gabibeyer force-pushed the podmanDocs branch 6 times, most recently from 9adc162 to dd69695 Compare September 6, 2019 03:50

jodh-intel reviewed Sep 6, 2019

View reviewed changes

marcov reviewed Sep 6, 2019

View reviewed changes

gabibeyer force-pushed the podmanDocs branch from dd69695 to 0f38775 Compare September 6, 2019 17:35

docs: documentation for running rootless kata-runtime

0f38775

Documentation for running Kata Containers with Podman as a non privileged user Fixes: kata-containers#540 Signed-off-by: gabi beyer <[email protected]>

caoruidong added the do-not-merge PR has problems or depends on another label Sep 9, 2019

klynnrif suggested changes Sep 16, 2019

View reviewed changes

AkihiroSuda reviewed Sep 17, 2019

View reviewed changes

jodh-intel mentioned this pull request Oct 11, 2019

Add podman docs #565

Closed

jodh-intel closed this Oct 11, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs: documentation for running rootless kata-runtime #553

docs: documentation for running rootless kata-runtime #553

gabibeyer commented Sep 4, 2019

marcov left a comment

jodh-intel left a comment

gabibeyer commented Sep 6, 2019

jodh-intel left a comment

marcov left a comment •

edited

Loading

gabibeyer commented Sep 6, 2019

gabibeyer commented Sep 6, 2019

klynnrif left a comment

klynnrif Sep 16, 2019

klynnrif Sep 16, 2019

klynnrif Sep 16, 2019

klynnrif Sep 16, 2019

klynnrif Sep 16, 2019

klynnrif Sep 16, 2019

klynnrif Sep 16, 2019

klynnrif Sep 16, 2019

klynnrif Sep 16, 2019

klynnrif Sep 16, 2019

jodh-intel Oct 11, 2019

jodh-intel Oct 11, 2019

AkihiroSuda Sep 17, 2019

jodh-intel commented Oct 11, 2019

docs: documentation for running rootless kata-runtime #553

docs: documentation for running rootless kata-runtime #553

Conversation

gabibeyer commented Sep 4, 2019

marcov left a comment

Choose a reason for hiding this comment

jodh-intel left a comment

Choose a reason for hiding this comment

gabibeyer commented Sep 6, 2019

jodh-intel left a comment

Choose a reason for hiding this comment

marcov left a comment • edited Loading

Choose a reason for hiding this comment

gabibeyer commented Sep 6, 2019

gabibeyer commented Sep 6, 2019

klynnrif left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jodh-intel commented Oct 11, 2019

marcov left a comment •

edited

Loading