Provide process space virtualisation functionality for jails.
Needs ReviewPublic
Actions

Authored by bz on Jun 17 2018, 2:55 PM.

Details

Reviewers

jamie
kib
jhb
andrew

Summary

This is the initial logic which will give a jail its own init,
have a dedicated kernel process "0" (swapper) per jail, its
own pid, etc. space if enabled.
Add ddb support to aid debugging as was done for vnet.

Obtained from: http://www.7he.at/freebsd/vps/files/diffs/vps-r215.diff

		(parts, originally as provided by iXsystems, Inc.)

Diff Detail

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 17372
Build 17205: arc lint + arc unit

Event Timeline

bz created this revision.Jun 17 2018, 2:55 PM

Harbormaster completed remote builds in B17372: Diff 43944.Jun 17 2018, 2:55 PM

bz added a parent revision: D15570: Virtualization of basic variables and locks for jail+vps..Jun 18 2018, 3:24 PM

jamie added inline comments.Jun 18 2018, 6:51 PM

sys/kern/init_main.c
695	Panicking seems harsh when kproc_create can fail simply because the process limit has been hit. Is there a way to just fail the jail creation, or if not that to destroy the jail? Perhaps with a warning - a sort of VPS panic.
sys/kern/kern_resource.c
1254	Is this something you've found to happen? I know that zombie jails often sit around indefinitely waiting for a cred hold to go away; perhaps it's something like that?

bz edited parent revisions, added: D15906: Implement "global" process (and zombie) lists loops iterating over all vps instances and all processes in each.; removed: D15570: Virtualization of basic variables and locks for jail+vps..Jun 19 2018, 4:36 PM

Follow-up on comments to @jamie

sys/kern/init_main.c
695	Yes. There's a few such situations; we would need to add a flag to the vps structure, check in between every sysinit invokation; in case of error, undo the exact bits we already allocated/initialised, and the return an error to jail creation. We never did for vnets; maybe it's time; but the cleanup can be "complex" to get fully symmetric. For the moment having well-defined errors (panic) seems better while developing.
sys/kern/kern_resource.c
1254	Yes I have but so far no one has ever tried to cleanly shutdown process space so (as with vnet) we expect to find certain leaks. I am sure that the buffer cache is a major problem for process space references. One thing at a time though. At the moment I am seeing linger DYING jails around with plain HEAD and not even vnets; took something over 50 days for one to go. Need a more general "tracker" which I do not want to intermix with this work.

freqlabs added a subscriber: freqlabs.Jun 22 2018, 7:39 PM

swills added a subscriber: swills.Jul 4 2018, 4:41 PM

Merge branch 'p2' into p3

Herald added subscribers: emaste, ae. · View Herald TranscriptJul 11 2018, 3:50 PM

Harbormaster completed remote builds in B17983: Diff 45169.Jul 11 2018, 3:50 PM

marius.h_lden.org added a subscriber: marius.h_lden.org.Mar 18 2019, 11:31 PM

Herald added a subscriber: andrew. · View Herald TranscriptMar 18 2019, 11:31 PM

fabian.freyer_physik.tu-berlin.de added a subscriber: fabian.freyer_physik.tu-berlin.de.May 21 2019, 1:25 PM

zlei added a subscriber: zlei.Jan 15 2024, 9:07 AM

Herald added a reviewer: andrew. · View Herald TranscriptJan 15 2024, 9:07 AM

Herald added subscribers: linuxkpi, glebius, melifaro. · View Herald Transcript

freebsd_igalic.co added a subscriber: freebsd_igalic.co.Jan 22 2024, 12:27 AM

meka_tilda.center added a subscriber: meka_tilda.center.Jan 22 2024, 7:55 AM

crest_freebsd_rlwinm.de added a subscriber: crest_freebsd_rlwinm.de.Jan 30 2024, 6:29 PM

bz mentioned this in D46440: init: Add jail(8) support.Aug 26 2024, 7:21 PM

hrs added a subscriber: hrs.Aug 26 2024, 10:47 PM

From the Jails Production User call: This work is still of interest, particularly in the context of OCI jail progress.
DCH: "This needs serious rebasing." Do any developers have interest in this feature?

In D15865#1126562, @editor_callfortesting.org wrote:

From the Jails Production User call: This work is still of interest, particularly in the context of OCI jail progress.
DCH: "This needs serious rebasing." Do any developers have interest in this feature?

I think @dfr is interested with this :)

In D15865#1126691, @zlei wrote:

In D15865#1126562, @editor_callfortesting.org wrote:

From the Jails Production User call: This work is still of interest, particularly in the context of OCI jail progress.
DCH: "This needs serious rebasing." Do any developers have interest in this feature?

I think @dfr is interested with this :)

I read through the diff briefly and as far as I can tell, with this approach, processes inside the vps jail are not visible in the host (or parent jail). If so, this won't work for OCI containers where we need to be able to wait for and reap the initial container process on the host. With Linux pid namespaces, each process has a sequence of pids starting with a host pid, then a viritualised pid for each parent namespace (if any) of the container and finishes with the pid visible inside the container.