You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@mesos.apache.org by Joshua Cohen <jc...@apache.org> on 2016/05/26 19:38:35 UTC
Extracting a filesystem isolation utility?
Hi Mesos devs,
I'm working on adding unified containerizer support to Aurora, and during
review[1] it was pointed out that the work being done to pivot into the
task's filesystem, mount the necessary special filesystems, etc. was a
subset (and probably an insufficient subset at that) of what Mesos does
when isolating a container's filesystem[2]. I wanted to propose that Mesos
creates a utility along the lines of mesos-containerizer that makes it
possible for an executor to share Mesos's logic without having to replicate
it wholesale.
Does this sound like something that could be done?
Thanks!
Joshua
[1] https://reviews.apache.org/r/47853/
[2]
https://github.com/apache/mesos/blob/547f4a4d122253a42819d5746cf51593923a56bc/src/linux/fs.cpp#L599-L699
Re: Extracting a filesystem isolation utility?
Posted by Joshua Cohen <jc...@apache.org>.
We can try and get this done next week, but be forewarned: it might involve
lots of dumb questions on my part ;).
On Fri, May 27, 2016 at 11:40 AM, Jie Yu <yu...@gmail.com> wrote:
> Joshua,
>
> Yep. That's what we've discussed yesterday. I think the short-term solution
> makes sense to me. Do you guys have any cycle to submit a patch for the
> short-term solution? I'd be happy to shepherd it.
>
> - Jie
>
> On Fri, May 27, 2016 at 7:09 AM, Joshua Cohen <jc...@apache.org> wrote:
>
> > Hi Gilbert,
> >
> > I talked to Jie about this a bit in IRC yesterday. I think long term what
> > we'd like to see is for the executor to be able to send a message to the
> > agent that instructs it to prepare filesystem isolation at a given path
> > (so, pivot that root to be the new root and mount everything into that
> new
> > root). In the shorter term if we could add a sub-command to
> > mesos-containterizer that would perform the same logic, that seems like
> an
> > easier near-term win that would allow us to remove all of this code from
> > Aurora's executor.
> >
> > Jie, let me know if that sums up things from your perspective as well or
> if
> > I'm mis-representing anything.
> >
> > Thanks!
> >
> > Joshua
> >
> > On Thu, May 26, 2016 at 4:08 PM, Gilbert Song <gi...@mesosphere.io>
> > wrote:
> >
> > > Hi Joshua,
> > >
> > > Thanks for pointing this out. We understand that it would be a breaking
> > > change in the future if Aurora release the unified containerizer
> support.
> > > You want the chroot::enter call to be unified in one place instead of
> > what
> > > we currently doing on command executor launchtask, to avoid any other
> > > duplicate code in executor. May I ask how urgent it is for you guys in
> > > developing unified containerizer support? We will discuss about this
> > issue
> > > and create a JIRA to track it.
> > >
> > > Thanks,
> > > Gilbert
> > >
> > > On Thu, May 26, 2016 at 12:38 PM, Joshua Cohen <jc...@apache.org>
> > wrote:
> > >
> > > > Hi Mesos devs,
> > > >
> > > > I'm working on adding unified containerizer support to Aurora, and
> > during
> > > > review[1] it was pointed out that the work being done to pivot into
> the
> > > > task's filesystem, mount the necessary special filesystems, etc. was
> a
> > > > subset (and probably an insufficient subset at that) of what Mesos
> does
> > > > when isolating a container's filesystem[2]. I wanted to propose that
> > > Mesos
> > > > creates a utility along the lines of mesos-containerizer that makes
> it
> > > > possible for an executor to share Mesos's logic without having to
> > > replicate
> > > > it wholesale.
> > > >
> > > > Does this sound like something that could be done?
> > > >
> > > > Thanks!
> > > >
> > > > Joshua
> > > >
> > > > [1] https://reviews.apache.org/r/47853/
> > > > [2]
> > > >
> > > >
> > >
> >
> https://github.com/apache/mesos/blob/547f4a4d122253a42819d5746cf51593923a56bc/src/linux/fs.cpp#L599-L699
> > > >
> > >
> >
>
Re: Extracting a filesystem isolation utility?
Posted by Jie Yu <yu...@gmail.com>.
Joshua,
Yep. That's what we've discussed yesterday. I think the short-term solution
makes sense to me. Do you guys have any cycle to submit a patch for the
short-term solution? I'd be happy to shepherd it.
- Jie
On Fri, May 27, 2016 at 7:09 AM, Joshua Cohen <jc...@apache.org> wrote:
> Hi Gilbert,
>
> I talked to Jie about this a bit in IRC yesterday. I think long term what
> we'd like to see is for the executor to be able to send a message to the
> agent that instructs it to prepare filesystem isolation at a given path
> (so, pivot that root to be the new root and mount everything into that new
> root). In the shorter term if we could add a sub-command to
> mesos-containterizer that would perform the same logic, that seems like an
> easier near-term win that would allow us to remove all of this code from
> Aurora's executor.
>
> Jie, let me know if that sums up things from your perspective as well or if
> I'm mis-representing anything.
>
> Thanks!
>
> Joshua
>
> On Thu, May 26, 2016 at 4:08 PM, Gilbert Song <gi...@mesosphere.io>
> wrote:
>
> > Hi Joshua,
> >
> > Thanks for pointing this out. We understand that it would be a breaking
> > change in the future if Aurora release the unified containerizer support.
> > You want the chroot::enter call to be unified in one place instead of
> what
> > we currently doing on command executor launchtask, to avoid any other
> > duplicate code in executor. May I ask how urgent it is for you guys in
> > developing unified containerizer support? We will discuss about this
> issue
> > and create a JIRA to track it.
> >
> > Thanks,
> > Gilbert
> >
> > On Thu, May 26, 2016 at 12:38 PM, Joshua Cohen <jc...@apache.org>
> wrote:
> >
> > > Hi Mesos devs,
> > >
> > > I'm working on adding unified containerizer support to Aurora, and
> during
> > > review[1] it was pointed out that the work being done to pivot into the
> > > task's filesystem, mount the necessary special filesystems, etc. was a
> > > subset (and probably an insufficient subset at that) of what Mesos does
> > > when isolating a container's filesystem[2]. I wanted to propose that
> > Mesos
> > > creates a utility along the lines of mesos-containerizer that makes it
> > > possible for an executor to share Mesos's logic without having to
> > replicate
> > > it wholesale.
> > >
> > > Does this sound like something that could be done?
> > >
> > > Thanks!
> > >
> > > Joshua
> > >
> > > [1] https://reviews.apache.org/r/47853/
> > > [2]
> > >
> > >
> >
> https://github.com/apache/mesos/blob/547f4a4d122253a42819d5746cf51593923a56bc/src/linux/fs.cpp#L599-L699
> > >
> >
>
Re: Extracting a filesystem isolation utility?
Posted by Joshua Cohen <jc...@apache.org>.
Hi Gilbert,
I talked to Jie about this a bit in IRC yesterday. I think long term what
we'd like to see is for the executor to be able to send a message to the
agent that instructs it to prepare filesystem isolation at a given path
(so, pivot that root to be the new root and mount everything into that new
root). In the shorter term if we could add a sub-command to
mesos-containterizer that would perform the same logic, that seems like an
easier near-term win that would allow us to remove all of this code from
Aurora's executor.
Jie, let me know if that sums up things from your perspective as well or if
I'm mis-representing anything.
Thanks!
Joshua
On Thu, May 26, 2016 at 4:08 PM, Gilbert Song <gi...@mesosphere.io> wrote:
> Hi Joshua,
>
> Thanks for pointing this out. We understand that it would be a breaking
> change in the future if Aurora release the unified containerizer support.
> You want the chroot::enter call to be unified in one place instead of what
> we currently doing on command executor launchtask, to avoid any other
> duplicate code in executor. May I ask how urgent it is for you guys in
> developing unified containerizer support? We will discuss about this issue
> and create a JIRA to track it.
>
> Thanks,
> Gilbert
>
> On Thu, May 26, 2016 at 12:38 PM, Joshua Cohen <jc...@apache.org> wrote:
>
> > Hi Mesos devs,
> >
> > I'm working on adding unified containerizer support to Aurora, and during
> > review[1] it was pointed out that the work being done to pivot into the
> > task's filesystem, mount the necessary special filesystems, etc. was a
> > subset (and probably an insufficient subset at that) of what Mesos does
> > when isolating a container's filesystem[2]. I wanted to propose that
> Mesos
> > creates a utility along the lines of mesos-containerizer that makes it
> > possible for an executor to share Mesos's logic without having to
> replicate
> > it wholesale.
> >
> > Does this sound like something that could be done?
> >
> > Thanks!
> >
> > Joshua
> >
> > [1] https://reviews.apache.org/r/47853/
> > [2]
> >
> >
> https://github.com/apache/mesos/blob/547f4a4d122253a42819d5746cf51593923a56bc/src/linux/fs.cpp#L599-L699
> >
>
Re: Extracting a filesystem isolation utility?
Posted by Gilbert Song <gi...@mesosphere.io>.
Hi Joshua,
Thanks for pointing this out. We understand that it would be a breaking
change in the future if Aurora release the unified containerizer support.
You want the chroot::enter call to be unified in one place instead of what
we currently doing on command executor launchtask, to avoid any other
duplicate code in executor. May I ask how urgent it is for you guys in
developing unified containerizer support? We will discuss about this issue
and create a JIRA to track it.
Thanks,
Gilbert
On Thu, May 26, 2016 at 12:38 PM, Joshua Cohen <jc...@apache.org> wrote:
> Hi Mesos devs,
>
> I'm working on adding unified containerizer support to Aurora, and during
> review[1] it was pointed out that the work being done to pivot into the
> task's filesystem, mount the necessary special filesystems, etc. was a
> subset (and probably an insufficient subset at that) of what Mesos does
> when isolating a container's filesystem[2]. I wanted to propose that Mesos
> creates a utility along the lines of mesos-containerizer that makes it
> possible for an executor to share Mesos's logic without having to replicate
> it wholesale.
>
> Does this sound like something that could be done?
>
> Thanks!
>
> Joshua
>
> [1] https://reviews.apache.org/r/47853/
> [2]
>
> https://github.com/apache/mesos/blob/547f4a4d122253a42819d5746cf51593923a56bc/src/linux/fs.cpp#L599-L699
>