【从零造容器】用 Go 组装迷你容器运行时：把积木拼起来

package main

import ("os"
  "os/exec"
  "syscall")

func main() {
  switch os.Args[1] {
  case "run":
  // 父进程：创建子进程并进入新 namespace
  run()
  case "init":
  // 子进程：在新 namespace 里执行初始化
  initContainer()
  }
}

func run() {
  // 重新执行自己，但参数改为 "init"
  cmd := exec.Command("/proc/self/exe", "init")
  cmd.SysProcAttr = &syscall.SysProcAttr{
  Cloneflags: syscall.CLONE_NEWPID |
  syscall.CLONE_NEWUTS |
  syscall.CLONE_NEWNS |
  syscall.CLONE_NEWIPC,
  }
  cmd.Stdin = os.Stdin
  cmd.Stdout = os.Stdout
  cmd.Stderr = os.Stderr
  cmd.Run()
}

func initContainer() {
  // 此时已经在新 namespace 里了
  // 执行 pivot_root、挂载 /proc 等
  setupRootfs()
  setupProc()

  // 最后 exec 用户指定的命令
  syscall.Exec("/bin/sh", []string{"/bin/sh"}, os.Environ())
}

type ContainerState struct {
  ID  string `json:"id"`
  PID  int  `json:"pid"`
  Status  string `json:"status"` // created, running, stopped
  Rootfs  string `json:"rootfs"`
  CgroupDir string `json:"cgroup_dir"`
  CreatedAt string `json:"created_at"`
}

const stateDir = "/run/miniruntime"

func saveState(state *ContainerState) error {
  dir := filepath.Join(stateDir, state.ID)
  os.MkdirAll(dir, 0700)

  data, _ := json.MarshalIndent(state, "", "  ")
  return os.WriteFile(filepath.Join(dir, "state.json"), data, 0600)
}

func loadState(id string) (*ContainerState, error) {
  path := filepath.Join(stateDir, id, "state.json")
  data, err := os.ReadFile(path)
  if err != nil {
  return nil, fmt.Errorf("container %s not found", id)
  }
  var state ContainerState
  json.Unmarshal(data, &state)
  return &state, nil
}

func setupCgroup(id string, memLimit, cpuQuota string) (string, error) {
  cgroupPath := filepath.Join("/sys/fs/cgroup", "miniruntime-"+id)

  if err := os.MkdirAll(cgroupPath, 0755); err != nil {
  return "", fmt.Errorf("create cgroup: %w", err)
  }

  // 设置内存限制
  if memLimit != "" {
  if err := os.WriteFile(filepath.Join(cgroupPath, "memory.max"),
  []byte(memLimit), 0644); err != nil {
  return "", fmt.Errorf("set memory.max: %w", err)
  }
  }

  // 设置 CPU 限制
  if cpuQuota != "" {
  if err := os.WriteFile(filepath.Join(cgroupPath, "cpu.max"),
  []byte(cpuQuota), 0644); err != nil {
  return "", fmt.Errorf("set cpu.max: %w", err)
  }
  }

  return cgroupPath, nil
}

func addToCgroup(cgroupPath string, pid int) error {
  return os.WriteFile(filepath.Join(cgroupPath, "cgroup.procs"),
  []byte(fmt.Sprintf("%d", pid)), 0644)
}

func removeCgroup(cgroupPath string) error {
  return os.Remove(cgroupPath)
}

func setupRootfs(rootfs string) error {
  // 切断挂载传播
  if err := syscall.Mount("", "/", "", syscall.MS_PRIVATE|syscall.MS_REC, ""); err != nil {
  return fmt.Errorf("mount private: %w", err)
  }

  // 把 rootfs bind mount 到自己（pivot_root 要求 new_root 是挂载点）
  if err := syscall.Mount(rootfs, rootfs, "", syscall.MS_BIND|syscall.MS_REC, ""); err != nil {
  return fmt.Errorf("bind mount rootfs: %w", err)
  }

  // 创建 old_root 挂载点
  oldRoot := filepath.Join(rootfs, ".old_root")
  os.MkdirAll(oldRoot, 0700)

  // pivot_root
  if err := syscall.PivotRoot(rootfs, oldRoot); err != nil {
  return fmt.Errorf("pivot_root: %w", err)
  }

  // 切换到新根目录
  os.Chdir("/")

  // 挂载 /proc
  os.MkdirAll("/proc", 0755)
  syscall.Mount("proc", "/proc", "proc", 0, "")

  // 挂载 /dev (最小化)
  os.MkdirAll("/dev", 0755)
  syscall.Mount("tmpfs", "/dev", "tmpfs", syscall.MS_NOSUID|syscall.MS_STRICTATIME, "mode=755")

  // 卸载 old_root
  syscall.Unmount("/.old_root", syscall.MNT_DETACH)
  os.Remove("/.old_root")

  return nil
}

func setupNetwork(pid int, containerIP, bridgeIP string) error {
  vethHost := "veth-host"
  vethContainer := "veth-ct"

  cmds := [][]string{
  // 创建 veth pair
  {"ip", "link", "add", vethHost, "type", "veth", "peer", "name", vethContainer},
  // 把一端移入容器 netns
  {"ip", "link", "set", vethContainer, "netns", fmt.Sprintf("%d", pid)},
  // 宿主机端配置
  {"ip", "addr", "add", bridgeIP + "/24", "dev", vethHost},
  {"ip", "link", "set", vethHost, "up"},
  // 启用 IP 转发
  {"sysctl", "-w", "net.ipv4.ip_forward=1"},
  // NAT
  {"iptables", "-t", "nat", "-A", "POSTROUTING", "-s",
  containerIP + "/24", "-j", "MASQUERADE"},
  }

  for _, args := range cmds {
  cmd := exec.Command(args[0], args[1:]...)
  if out, err := cmd.CombinedOutput(); err != nil {
  return fmt.Errorf("%s: %s: %w", args[0], string(out), err)
  }
  }
  return nil
}

type Cleanup struct {
  steps []func()
}

func (c *Cleanup) Add(fn func()) {
  c.steps = append(c.steps, fn)
}

func (c *Cleanup) Run() {
  // 逆序执行清理
  for i := len(c.steps) - 1; i >= 0; i-- {
  c.steps[i]()
  }
}

func createContainer(id, rootfs string) error {
  cleanup := &Cleanup{}
  defer func() {
  // 只在出错时执行清理
  // 成功的话清理由 delete 命令负责
  }()

  // Step 1: 创建 cgroup
  cgroupPath, err := setupCgroup(id, "256m", "50000 100000")
  if err != nil {
  return err
  }
  cleanup.Add(func() { removeCgroup(cgroupPath) })

  // Step 2: 准备 rootfs overlay
  // ...

  // Step 3: 创建子进程
  // ...

  return nil
}