{"action":"created","issue":{"url":"https://api.github.com/repos/clearcontainers/runtime/issues/987","repository_url":"https://api.github.com/repos/clearcontainers/runtime","labels_url":"https://api.github.com/repos/clearcontainers/runtime/issues/987/labels{/name}","comments_url":"https://api.github.com/repos/clearcontainers/runtime/issues/987/comments","events_url":"https://api.github.com/repos/clearcontainers/runtime/issues/987/events","html_url":"https://github.com/clearcontainers/runtime/issues/987","id":294607098,"number":987,"title":"How to make dockershim support clear containers?","user":{"login":"miaoyq","id":17755856,"avatar_url":"https://avatars2.githubusercontent.com/u/17755856?v=4","gravatar_id":"","url":"https://api.github.com/users/miaoyq","html_url":"https://github.com/miaoyq","followers_url":"https://api.github.com/users/miaoyq/followers","following_url":"https://api.github.com/users/miaoyq/following{/other_user}","gists_url":"https://api.github.com/users/miaoyq/gists{/gist_id}","starred_url":"https://api.github.com/users/miaoyq/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miaoyq/subscriptions","organizations_url":"https://api.github.com/users/miaoyq/orgs","repos_url":"https://api.github.com/users/miaoyq/repos","events_url":"https://api.github.com/users/miaoyq/events{/privacy}","received_events_url":"https://api.github.com/users/miaoyq/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-06T02:03:39Z","updated_at":"2018-02-06T18:55:43Z","closed_at":null,"author_association":"NONE","body":"Recently I was trying to make dockershim support cc, and found that dockershim supporting cc need to meet the following conditions at least:\r\n1. Dockershim need provide container type(app or sandbox container) info in `Annotation` that clear containers need.\r\n   dockershim have provided this info in Label` field of docker container struct.\r\n2. Docker need pass `Label` of docker container to `Annotations` of OCI runtime spec.\r\n   I have sent a pr to moby project about this, see: [moby/moby/pull/36181](https://github.com/moby/moby/pull/36181)\r\n3. Annotations(Labels) of dockershim can be recognized by cc-runtime\r\n   The annotations(labels) are defined as private fields in dockershim and can't be referenced by virtcontainer. So I only modify the codes locally for testing. \r\n4. Kubelet should be able to get the IP address after the sandbox started\r\n   The IP address of the veth device that is create by cni plugin will be remove when cc-runtime create a tap device linked to the veth device. So we must create the network namespace and get the IP address of the veth before creating the sandbox container with the existing network namespace, just like [this issue description](https://github.com/containerd/cri-containerd/issues/524) in cri-containerd. However, docker does not provide an interface for using existing network namespace to create containers, we must use the namespace created by docker, so we can't get the IP via cni plugin after setting up the network since the IP of veth have been removed. This is the main obstruction point for me at present.\r\n\r\nAfter modifying the code corresponding to the first three conditions, and compiling codes of each component and setting up the k8s  cluster, I could create the pod successfully but the network of pod  could not be set up correctly. I do not know whether it is related to conditions, expect to get help here. Thanks!\r\n\r\n@sameo @plutoinmii\r\n\r\n/cc @guangxuli\r\n \r\n"},"comment":{"url":"https://api.github.com/repos/clearcontainers/runtime/issues/comments/363526963","html_url":"https://github.com/clearcontainers/runtime/issues/987#issuecomment-363526963","issue_url":"https://api.github.com/repos/clearcontainers/runtime/issues/987","id":363526963,"user":{"login":"sameo","id":1043863,"avatar_url":"https://avatars2.githubusercontent.com/u/1043863?v=4","gravatar_id":"","url":"https://api.github.com/users/sameo","html_url":"https://github.com/sameo","followers_url":"https://api.github.com/users/sameo/followers","following_url":"https://api.github.com/users/sameo/following{/other_user}","gists_url":"https://api.github.com/users/sameo/gists{/gist_id}","starred_url":"https://api.github.com/users/sameo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sameo/subscriptions","organizations_url":"https://api.github.com/users/sameo/orgs","repos_url":"https://api.github.com/users/sameo/repos","events_url":"https://api.github.com/users/sameo/events{/privacy}","received_events_url":"https://api.github.com/users/sameo/received_events","type":"User","site_admin":false},"created_at":"2018-02-06T18:55:43Z","updated_at":"2018-02-06T18:55:43Z","author_association":"CONTRIBUTOR","body":"cc @egernst \r\n\r\n@miaoyq I think we're looking at a couple of potential solutions here:\r\n\r\n1. Have virtcontainers somehow not cleaning the veth IP so that `PodSandboxStatus()` would just work.\r\n2. Have docker-shim cache the pod IP and use that cache instead of running unnecessary `netns` calls into the pod networking namespace. A pod IP is immutable, so there's no reasons for always checking about it.\r\n3. Use the Docker engine API (`GET /containers/(id or name)/json`) to ask for the pod container network settings from the Docker engine itself.\r\n\r\nSolution #2 is obviously the most appealing to us, as #1 would be quite disruptive for CC in general.\r\nSolution #3 may work, but since I don't have a working docker-shim based CC deployment, I can't guarantee that. If it does work, it would be a quick and portable solution. #2 would still be more efficient..."}}
{"actor":{"display_login":"sameo"}}