containerd/runwasiを読む #

tar::Builder::new(File::create(&layer_path).unwrap())
    .append_path_with_name(&app_path, "wasi-demo-app.wasm")

let config = spec::ConfigBuilder::default()
    .entrypoint(vec!["/wasi-demo-app.wasm".to_owned()])
    .build()

let img = spec::ImageConfigurationBuilder::default()
     .config(config)
     .os("wasi")
     .architecture("wasm")
     .rootfs(
         spec::RootFsBuilder::default()
             .diff_ids(vec!["sha256:".to_owned() + &layer_digest])
             .build()
             .unwrap(),
     )
     .build()

impl Instance for MyInstance {
    // ...
}

fn main() {
    shim::run::<ShimCli<MyInstance>>("io.containerd.myshim.v1", opts);
}

impl Instance for Wasi {
    type E = wasmtime::Engine;

    // ...省略
}

let dir = tempdir()?;
create_dir(dir.path().join("rootfs"))?;

let mut f = File::create(dir.path().join("rootfs/hello.wat"))?;
f.write_all(WASI_HELLO_WAT)?;

let stdout = File::create(dir.path().join("stdout"))?;
drop(stdout);

let spec = SpecBuilder::default()
    .root(RootBuilder::default().path("rootfs").build()?)
    .process(
        ProcessBuilder::default()
            .cwd("/")
            .args(vec!["hello.wat".to_string()])
            .build()?,
    )
    .build()?;
spec.save(dir.path().join("config.json"))?;

version: "1.0.2-dev",
    root: Some(
        Root {
            path: "/tmp/.tmpNNCrAK/rootfs",
            readonly: Some(
                true,
            ),
        },
    ),
    mounts: Some(
        [
            Mount {
                destination: "/proc",
                typ: "proc",
                source: "proc",
                options: None,
            },
            // ...
        ],
    ),
    process: Some(
        Process {
            terminal: false,
            user: User {
                uid: 0,
                gid: 0,
                umask: None,
                additional_gids: None,
                username: None,
            },
            args: ["hello.wat"],
            command_line: None,
            env: [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "TERM=xterm",
            ],
            cwd: "/",
            capabilities: Some(
                LinuxCapabilities { ... },
            ),
            rlimits:[
                    LinuxRlimit {
                        typ: RlimitNofile,
                        hard: 1024,
                        soft: 1024,
                    },
            ],
            // ...
        },
    ),
    hostname: "youki",
    linux: Linux {
            uid_mappings: None,
            gid_mappings: None,
            sysctl: None,
            resources: LinuxResources {/* ... */ },
            namespaces: [
                    LinuxNamespace { typ: Pid, path: None },
                    LinuxNamespace { typ: Network, path: None },
                    LinuxNamespace { typ: Ipc, path: None },
                    LinuxNamespace { typ: Uts, path: None },
                    LinuxNamespace { typ: Mount, path: None },
                ],
            ),
            devices: None,
            seccomp: None,
            rootfs_propagation: None,
            masked_paths: [/* ... */]
            readonly_paths: [/* ... */]
            // ...
    },
    // ...

let mut cfg = InstanceConfig::new(Engine::default());
let cfg = cfg
    .set_bundle(dir.path().to_str().unwrap().to_string())
    .set_stdout(dir.path().join("stdout").to_str().unwrap().to_string());
let wasi = Arc::new(Wasi::new("test".to_string(), Some(cfg)));

wasi.start()?;

let w = wasi.clone();
let (tx, rx) = channel();
thread::spawn(move || {
    w.wait(tx).unwrap();
});

let res = match rx.recv_timeout(Duration::from_secs(10)) {
    Ok(res) => res,
    Err(e) => {
        wasi.kill(SIGKILL as u32).unwrap();
        return Err( /* ... */);
    }
};

let engine = self.engine.clone();
let mut linker = Linker::new(&engine);
wasmtime_wasi::add_to_linker(&mut linker, |s| s).map_err( /* ... */)?;

snapshots::preview_1::add_wasi_snapshot_preview1_to_linker(linker, get_cx)?;
snapshots::preview_0::add_wasi_unstable_to_linker(linker, get_cx)?;
Ok(())

let spec = load_spec(self.bundle.clone())?;

let m = prepare_module(engine.clone(), &spec, stdin, stdout, stderr).map_err( /* ... */)
let mut store = Store::new(&engine, m.0);
let i = linker.instantiate(&mut store, &m.1).map_err( /* ... */)

let f = i.get_func(&mut store, "_start").ok_or_else(|| {  /* ... */ })?;

let cg = oci::get_cgroup(&spec)?;
oci::setup_cgroup(cg.as_ref(), &spec).map_err(/* ... */);

let res = unsafe { exec::fork(Some(cg.as_ref())) }?;

pub unsafe fn clone3_system_call(cl_args: &CloneArgs) -> c_long {
    syscall(
        SYS_clone3,
        cl_args as *const CloneArgs,
        core::mem::size_of::<CloneArgs>(),
    )
}

let _ret = match f.call(&mut store, &[], &mut []) {
    Ok(_) => std::process::exit(0),
    Err(_) => std::process::exit(137),
};

let mut lr = self.pidfd.lock().unwrap();
*lr = Some(pidfd.clone());
let code = self.exit_code.clone();

let _ = thread::spawn(move || {
    let (lock, cvar) = &*code;
    let status = match pidfd.wait() {
        Ok(status) => status,
        Err(e) => {
            cvar.notify_all();
            return;
        }
    };
    let mut ec = lock.lock().unwrap();
    *ec = Some((status.status, Utc::now()));
    drop(ec);
    cvar.notify_all();
});

Ok(tid)

fn wait(&self, channel: Sender<(u32, DateTime<Utc>)>) -> Result<(), Error> {
    let code = self.exit_code.clone();
    thread::spawn(move || {
        let (lock, cvar) = &*code;
        let mut exit = lock.lock().unwrap();
        while (*exit).is_none() {
            exit = cvar.wait(exit).unwrap();
        }
        let ec = (*exit).unwrap();
        channel.send(ec).unwrap();
    });
    Ok(())
}

fn task_wait(&self, req: api::WaitRequest) -> Result<api::WaitResponse> {  
    let i = self.get_instance(req.get_id())?;
    let (lock, cvar) = &*i.status.clone();
    let mut status = lock.lock().unwrap();
    while (*status).is_none() {
        status = cvar.wait(status).unwrap();
    }
    let (tx, rx) = channel::<(u32, DateTime<Utc>)>();  
    i.wait(tx)?;  
    let code = rx.recv().unwrap();  
    let mut timestamp = Timestamp::new();
    // ...
    let mut wr = api::WaitResponse {
        exit_status: code.0,
        ..Default::default()
    };
    wr.set_exited_at(timestamp);
    Ok(wr)
}

    fn kill(&self, signal: u32) -> Result<(), Error> { 
        if signal != SIGKILL as u32 {
            return Err(Error::InvalidArgument(
                "only SIGKILL is supported".to_string(),
            ));
        }

        let lr = self.pidfd.lock().unwrap(); 
        let fd = lr.as_ref().ok_or_else(|| /* ... */)?; 
        fd.kill(signal as i32) 
    }