[question] Linux container support?

[gizahNL]

Does/would runj support running linux containers? (aka: docker images?)

Obviously provided that the software in these containers does not make any syscalls not supported by the linuxulator.

Seeing that a lot of projects are (often unfortunately) moving to distributing Docker images and not even bothering to check platform compatibility with other OS's it would be a big boon if possible :)

That and VNET support would be amazing!

[samuelkarp]

Does/would runj support running linux containers?

Not yet; I'm focusing on the FreeBSD userland first.

[gizahNL]

Would runj be responsible for mounting sysfs & proc or would containerd (or other higher level abstraction) have this responsibility? I'm actually guessing that's the only relevant hurdle, since most linux software depends on it. Besides that FreeBSD would just detect the ELF library and "it should just work"

[samuelkarp]

Would runj be responsible for mounting sysfs & proc or would containerd (or other higher level abstraction) have this responsibility?

runj would be responsible for performing the mount operations in response to them being specified in the mounts array. containerd would be responsible for specifying which mounts should be mounted. I haven't yet added support to runj for the mounts array.

[akhramov]

FWIW here's the relevant runtime config part:

  "mounts": [
    {
      "destination": "/dev",
      "source": "devfs",
      "options": null,
      "type": "devfs"
    },
    {
      "destination": "/sys",
      "source": "linsysfs",
      "options": [
        "nosuid",
        "noexec",
        "ro"
      ],
      "type": "linsysfs"
    },
    {
      "destination": "/proc",
      "source": "linprocfs",
      "options": [
        "nosuid",
        "noexec",
        "ro"
      ],
      "type": "linprocfs"
    }

Please mind that some ELF binaries may need to be rebranded in order for the kernel to find out the appropriate ABI type.

[emaste]

Please mind that some ELF binaries may need to be rebranded in order for the kernel to find out the appropriate ABI type.

This should not be necessary - fallback brand (for binaries not otherwise identified) can be set via the

kern.fallback_elf_brand: -1
kern.elf32.fallback_brand: -1
kern.elf64.fallback_brand: -1

sysctls.

If Linux binaries are found that need a workaround (either sysctls or brandelf) please let us know so that we can update the Linuxulator to detect them automatically.

See the brandinfo sections at https://github.com/freebsd/freebsd-src/blob/main/sys/amd64/linux/linux_sysvec.c#L834 for example.

[davidchisnall]

Ideally, a Linux container would be a Linux container with the associated Linux-specific metadata and so the FreeBSD port of containerd / runj would contain the logic for setting these things up in response to seeing "os" : "linux" in the image.

[samuelkarp]

@davidchisnall See containerd/containerd#5480 by @gizahNL for this 😄