Conversation
|
|
||
| Unikraft guests used a hardcoded DNS server, so name resolution inside | ||
| the unikernel ignored the DNS configuration of the container. Parse the | ||
| nameserver entry from the container's resolv.conf and pass it to the |
There was a problem hiding this comment.
can we wait for the next release which includes the patch?
There was a problem hiding this comment.
When is the next release planned @smira?
There was a problem hiding this comment.
Ah, you meant the next release of Urunc?
There was a problem hiding this comment.
can we wait for the next release which includes the patch?
I don't think so, the v0.8.0 release was only a few weeks ago, and the next one per roadmap is pretty far away.
There was a problem hiding this comment.
Actually, this patch is not a blocker, but it cover the most usual case when you use pre build Unikraft kernel for image. And for my standpoint Unikraft is most usable option from supported unikernels, as other have some limitation with the application types (at least in our usecase). But if rebuild Unikraft kernel, this patch is no necessary. So I guess, we can either leave a note with required steps to use urunc + Unikraft or leave the patch.
There was a problem hiding this comment.
@smira, since the next Urunc release is far out, would you be open to merging this patch into our extension now so we’re not blocked? Would you like us to prepare a clean PR that applies the resolver fix and keeps it isolated or what are our next steps to move from here?
There was a problem hiding this comment.
how far out is urunc release? this extension will not ship before Talos 1.15 (December).
Also it ships so much extra stuff that I need to take another look.
There was a problem hiding this comment.
Hi @smira, I discussed this with urunc maintainer. Here is the answer:
We can have a patch release at the first week of October. I will plan some bug fixes this week to push them in v0.8.1. Otherwise, the next minor release is planned for late November early December.
| ```yaml | ||
| machine: | ||
| files: | ||
| - path: /var/etc/urunc/config.toml |
There was a problem hiding this comment.
machine.files has been deprecated, please move to EtcConfig
There was a problem hiding this comment.
Sure, moved example to EtcFileConfig.
| URUNC_VERSION: 0.8.0-talos.1 | ||
| URUNC_SOURCE_SHA256: 6773f666f2ddfa5ec4b52b35a685d76063ad61e28234a78355a354240858685f | ||
| URUNC_SOURCE_SHA512: ac7b46047bb48d8799b347f2da654b69b3f091096cb6a0bcf4f3190fc68b37d062ab445dc71ae52000ca04d2dfe618ddfbd0df37e3a4d020a342becaa0ce5c0c | ||
| URUNC_MONITORS_VERSION: FC-v1.7.0_CLH-v50.0_S5-v0.12.1_VFS_-v1.13.0_QM-v10.1.1-9a44e |
There was a problem hiding this comment.
this looks like a mess of a version - it's unclear how to support it in the future
There was a problem hiding this comment.
I agree that this looks kinda mess, but in fact this is only pre-build binaries, so we can either build them ourselves or just download the latest one from repo (like I did).
Kata has something similar, except they build it as part of their release cycle and has separeted tarball with static files.
There was a problem hiding this comment.
My question is maintenance (which will be on us), and I don't see how to maintain this version - when to upgrade it and how.
There was a problem hiding this comment.
@smira, how would you prefer we structure or publish these versions so they’re easier to support? What direction makes the most sense to you to move this forward?
There was a problem hiding this comment.
I don't know the details of urunc, but is there something that I can tell Renovate to match on?
There was a problem hiding this comment.
I don't think so, at least with existing flow, but as far as I know this currently is being discussed how to change monitors build processes. Not sure about specific decisions yet.
Package urunc, its containerd shim, and monitor binaries, and register the urunc runtime handler. Apply an upstream patch that uses the container DNS configuration for guests. Add usage and configuration documentation. Remove the duplicated PUSH=true build argument. Signed-off-by: kastakhov <16296930+kastakhov@users.noreply.github.com>
Signed-off-by: kastakhov <16296930+kastakhov@users.noreply.github.com>
4 participants
What is urunc?
urunc is an OCI-compatible low-level container runtime for running unikernels in cloud-native environments. It integrates with containerd and Kubernetes through a containerd shim and a dedicated RuntimeClass.
Upstream urunc supports OCI-packaged Unikraft, Rumprun, MirageOS, Mewz, Hermit, and Linux workloads. This extension bundles the QEMU, Firecracker, Cloud Hypervisor, and Solo5 monitors required by those workloads.
What does this change?
This PR adds urunc v0.8.0 as a Talos system extension.
It:
Testing