projectatomic / bwrap-oci Goto Github PK

When adding a mount, I get the error that devtmpfs is not a supported type, even though bwrap has a --dev flag.

How can I set up bubblewrap and brwap-oci to use them with docker run option --runtime=bwrap-oci?

I currently did some test runs with kata (--runtime=kata-runtime) and would like to try bubblewrap, too.

I've installed bubblewrapfrom debian repository and compiled bwrap-oci from github.
I've configured docker daemon to use bwrap-oci. I get the error message:

docker: Error response from daemon: OCI runtime create failed: unable to retrieve OCI runtime error (open /run/containerd/io.containerd.runtime.v1.linux/moby/bd13878d4dc6e0837f98ad12bdf4024b978b5e0b22709459ed74e095d7bb76cc/log.json: no such file or directory): /usr/local/bin/bwrap-oci did not terminate sucessfully: /usr/local/bin/bwrap-oci: option parsing failed: Unknown option --root

bwrap-oci has the subcommand run to run a container but the OCI spec divides it in operations create and start.

How could we find a way to divide run into create+start in bwrap?

In order to run the validation tests from runtime-tools, bwrap-oci would need to support the OCI Runtime Command Line Interface.

We should be able to drop bundlePath from kill.c. This may involve teaching read_container_status_file to accept NULL for unneeded arguments, but should be fairly straightforward. I can work up a PR on Monday, but wanted to file this so I don't forget.

While trying to use the demo for bwrap-oci, skopeo cannot download the image into a newly created empty directory:

FATA[0000] Error initializing destination oci:cache:: cannot save image with empty image.ref.name

If we change oci:cache to dir:cache it works, but the files inside the cache directory are not in the OCI format. If there a way to download the image in OCI format without any additional setup?

bwrap-oci.c:728:55: warning: comparison of unsigned expression < 0 is always false [-Wtautological-compare]
bwrap-oci.c:887:52: warning: comparison of unsigned expression < 0 is always false [-Wtautological-compare]
bwrap-oci.c:894:49: warning: comparison of unsigned expression < 0 is always false [-Wtautological-compare]

Comparing a function return type of size_t to less than zero looks dodgy.

To be able to exec process inside already started containers, runc has a runc exec command. bwrap-oci should be able to support the same kind of operation.