rkt/rkt

stage1: idea of using pure golang unprivileged containers (unc) as execution engine

Open

#1,318 建立於 2015年8月21日

在 GitHub 查看
 (0 留言) (0 反應) (0 負責人)Go (8,871 star) (865 fork)batch import
component/stage1help wantedkind/enhancementpriority/Pmaybe

描述

just an idea (similar to #1030), we can base on unc, with great technical explanation in this blog series

pros:

  • unprivileged (non root required)
  • pure golang (no c/systemd nspawn depedency)
  • easier to maintain
  • existing implementation (support all namespaces, even network support)

cons:

  • requires go 1.5
  • re-implementation systemd machined integration
  • cgroups missing
  • capabilities managment missing
  • overlay/union fs missing

貢獻者指南

技術棧
go
領域
infrastructure
議題類型
research
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
5
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
over 1 week
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
stale
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
mostly clear
前置要求
Go programmingLinux containersLinux namespacescgroups
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
10
研究方向
Explore the unc library (github.com/LK4D4/unc) and its blog series to understand the current unprivileged container implementation. Assess the feasibility of integrating unc as a stage1 executor in rkt by comparing its capabilities (namespaces, network) against rkt's requirements, and identify what needs to be added (cgroups, capabilities, overlay/union fs). The existing unc implementation is a starting point, but lacks features like cgroups and capabilities management that would need to be implemented.