giuseppe

package main

import (
	"bytes"
	"errors"
	"io"
	"os"
)

type state int

giuseppe

#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/sysmacros.h>
#include <sys/xattr.h>
#include <unistd.h>

giuseppe

/*
 * io_uring_chcon.c
 *
 * Copyright (C) 2021 Giuseppe Scrivano <[email protected]>
 * io_uring_chcon is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * io_uring_chcon is distributed in the hope that it will be useful,

giuseppe

module inhibit

go 1.13

require (
	github.com/godbus/dbus/v5 v5.0.3
)

giuseppe

#!/usr/bin/python3
#
# profile *sync* syscalls.
#
# Based on existing programs that have these copyrights:
# Copyright (c) 2015 Brendan Gregg.
# Licensed under the Apache License, Version 2.0 (the "License")
#
# 13-Aug-2015   Brendan Gregg   Created this.
# 19-Feb-2016   Allan McAleavy migrated to BPF_PERF_OUTPUT

giuseppe

# All files must be copied under the fuse-overlayfs root source directory
all: test-plugin.so convert

test-plugin.so:
	gcc -fPIC -I $(pwd) -shared -o test-plugin.so test-plugin.c utils.c
    
convert:
	gcc convert.c -o convert
  

giuseppe

Enable cgroups v2

# grubby --update-kernel=ALL --args="systemd.unified_cgroup_hierarchy=1"
# cat /etc/systemd/system/enable-cgroups.service 
[Service]
ExecStart=/bin/sh -c 'echo "+io +cpu +memory +pids +cpuset" > /sys/fs/cgroup/cgroup.subtree_control; mkdir /sys/fs/cgroup/user.slice; echo "+io +cpu +memory +pids +cpuset" > /sys/fs/cgroup/user.slice/cgroup.subtree_control'
Type=oneshot

[Install]
WantedBy=multi-user.target

giuseppe

#!/bin/bash -e
set -x
set -u
IP=$(hostname -I | cut -d' ' -f1)
echo "Using IP: $IP"
export GOPATH=/home/gscrivano/src/gopath
export PATH=$PATH:$GOPATH/bin:$GOPATH/src/k8s.io/kubernetes/third_party/etcd:$GOPATH/src/k8s.io/kubernetes/_output/local/bin/linux/amd64/
export FEATURE_GATES="AllAlpha=false,RunAsGroup=true"
export CONTAINER_RUNTIME=remote
export CGROUP_DRIVER=systemd

giuseppe

use std::env;
use std::process::Command;
use std::path::Path;

fn main() {
    let out_dir = env::var("OUT_DIR").unwrap();
    Command::new("make").current_dir(&Path::new("../..")).arg("install").arg(&format!("DESTDIR={}", out_dir)).status().unwrap();
    println!("cargo:rustc-link-search=native={}/usr/local/lib", out_dir);
    println!("cargo:rustc-link-lib=static=crun");
    println!("cargo:rustc-link-lib=yajl");

giuseppe

running Podman as root

runc

[root@fedora-s-4vcpu-8gb-fra1-01 ~]# for i in {1..10}; do /usr/bin/time -f%e podman \
    --runtime /usr/bin/runc run --rm alpine true; done 2>&1 | sort
1.10
1.10
1.10