Internships/ProjectIdeas/VhostUserVSOCKRust: Difference between revisions
(Added a possible roadmap) |
|||
Line 39: | Line 39: | ||
*** add support to "vhost-user-vsock" | *** add support to "vhost-user-vsock" | ||
** There may be some work needed on the agent related to this integration, but we hope everything will be transparent on that layer. | ** There may be some work needed on the agent related to this integration, but we hope everything will be transparent on that layer. | ||
'''Links:''' | '''Links:''' |
Revision as of 09:33, 18 March 2021
vhost-user-vsock application
Summary: Develop a vhost-user-vsock application in Rust and integrate it with Kata Container
Kata Containers provides a secure container runtime using lightweight virtual machines that feel and perform like traditional containers. Kata Containers leverages KVM and supports multiple Virtual Machine Monitors, including QEMU. It uses virtio-vsock to create a communication channel between the runtime, running in the host, and the agent running in the guest.
Kata Containers focuses on security, so moving the device emulation into an external user space process is very attractive in order to reduce the attack surface.
This project aims to realize an application (i.e. vhost-user-vsock) that will leverage the vhost-user protocol to emulate the virtio-vsock device in an external process. It will provide the hybrid VSOCK interface over AF_UNIX introduced by Firecracker.
The QEMU part has already been implemented and tested with a proof of concept based on Cloud Hypervisor crates, that can be used as starting point for this project.
The new application should be written in Rust reusing as much as possible the crates available in rust-vmm. It's an umbrella project that provides a set of virtualization components that can be easily reused to speed up the implementation.
If time allows, we could integrate vhost-user-vsock into Kata Containers.
Possible roadmap:
- vhost-user-vsock application (Rust)
- Getting familiar with vsock and tools (ncat, tcpdump, wireshark)
- Overview and useful references
- Able to start a VM and communicate using ncat over vsock
- Learning vhost-user protocol
- Trying QEMU with the vhost-user-vsock PoC
- Rust application development based on vhost-user-vsock PoC
- Replace Cloud Hypervisor crates with rust-vmm crates (e.g. vhost)
- Try to move other crates to rust-vmm (e.g. virtio-vsock)
- Cleanups and tests
- Publish vhost-user-vsock in the rust-vmm umbrella project
- Getting familiar with vsock and tools (ncat, tcpdump, wireshark)
- Kata Container integration (Go)
- Getting familiar with kata-containers and its environment
- Deploying and using Kata Containers on minikube
- Able to modify the content of the projects and run the modified binaries on minikube
- Runtime side work:
- start the application daemon (similar to virtio-fs)
- ensure it's receiving the correct SELinux labels (container_kvm_t label similar to virtio-fs)
- GOVMM side:
- add support to "vhost-user-vsock"
- There may be some work needed on the agent related to this integration, but we hope everything will be transparent on that layer.
- Getting familiar with kata-containers and its environment
Links:
- Kata Containers
- virtio-vsock
- vhost-user protocol
- Firecracker's hybrid VSOCK
- QEMU's patches already merged to support vhost-user-vsock
- vhost-user-vsock PoC based on Cloud Hypervisor
- rust-vmm repositories
- kata-containers repository
- GoVMM repository
Details:
- Skill level: intermediate
- Language: Rust / Go
- Mentors: Stefano Garzarella <sgarzare@redhat.com>, Fabiano Fidêncio <fidencio@redhat.com>
- IRC nick: sgarzare (OFTC/freenode), fidencio (OFTC/freenode)