Remove SeccompLevel from Jailer #176
Conversation
xibz
force-pushed
the
seccomp-clean
branch
17 times, most recently
from
6e3d82a to
9db8a10
Compare
xibz
force-pushed
the
seccomp-clean
branch
6 times, most recently
from
10a2f33 to
2d48810
Compare
|
managed to fix the seccomp issue and add the updated CI test to verify. However, Firecracker is panicking for some odd reason. Here is the issue, firecracker-microvm/firecracker#1557 Also seems this fix is incompatible with v0.20.0 of Firecracker. So, we'll have to wait for our release of |
xibz
force-pushed
the
seccomp-clean
branch
4 times, most recently
from
78a31a9 to
70c6433
Compare
|
root tests will fail due to Firecracker moving where the api socket location is. |
Firecracker has since removed specifying the seccomp level in the jailer and now is specified in Firecracker instead. This change removes the seccomp level from the jailer and adds it to machine instead. Signed-off-by: xibz <[email protected]>
Is there a reason we can't look in the new location? |
|
@IRCody -We are using the new location. Firecracker has changed the default location, which is a breaking change. Which is why it succeeds against master but fails the root tests, since it is looking for the new location |
|
So those tests will pass if we update the firecracker in CI? |
Once Firecracker releases v0.21.0, then yes. However, they haven't released v0.21.0 yet, but customers are using HEAD of Firecracker and we shouldn't limit ourselves to the most released version, due to this. |
|
Here is what we used to have. Probably not really intentional, but due to the fact we didn't have Firecracker master on our build host.
And here is what we are going to have.
Making master compatible with Firecracker's latest release is nice to have, but may require some efforts and we don't have customers who specifically ask about. Because of that, I think merging this change is fine. We can always create a branch and cherry-pick if we want to have some fixes for Firecracker 0.20.0 customers. |
Firecracker has since removed specifying the seccomp level in the jailer
and now is specified in Firecracker instead. This change removes the
seccomp level from the jailer and adds it to machine instead.
Signed-off-by: xibz [email protected]
TODO:
#175
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.