OCI 规范兼容：让迷你运行时说标准语言

{
    "ociVersion": "1.0.2",
    "process": {
        "terminal": true,
        "user": { "uid": 0, "gid": 0 },
        "args": ["/bin/sh"],
        "env": [
            "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
            "TERM=xterm"
        ],
        "cwd": "/"
    },
    "root": {
        "path": "rootfs",
        "readonly": false
    },
    "hostname": "minicontainer",
    "mounts": [
        {
            "destination": "/proc",
            "type": "proc",
            "source": "proc"
        },
        {
            "destination": "/dev",
            "type": "tmpfs",
            "source": "tmpfs",
            "options": ["nosuid", "strictatime", "mode=755", "size=65536k"]
        },
        {
            "destination": "/sys",
            "type": "sysfs",
            "source": "sysfs",
            "options": ["nosuid", "noexec", "nodev", "ro"]
        }
    ],
    "linux": {
        "namespaces": [
            { "type": "pid" },
            { "type": "ipc" },
            { "type": "uts" },
            { "type": "mount" },
            { "type": "network" }
        ],
        "resources": {
            "memory": { "limit": 268435456 },
            "cpu": { "quota": 50000, "period": 100000 }
        }
    }
}

miniruntime create <container-id> --bundle <path-to-bundle>

miniruntime start <container-id>

miniruntime state <container-id>

{
    "ociVersion": "1.0.2",
    "id": "mycontainer",
    "status": "running",
    "pid": 12345,
    "bundle": "/path/to/bundle"
}

miniruntime kill <container-id> SIGTERM

miniruntime delete <container-id>

type OCISpec struct {
    Version  string      `json:"ociVersion"`
    Process  OCIProcess  `json:"process"`
    Root     OCIRoot     `json:"root"`
    Hostname string      `json:"hostname"`
    Mounts   []OCIMount  `json:"mounts"`
    Linux    OCILinux    `json:"linux"`
    Hooks    *OCIHooks   `json:"hooks,omitempty"`
}

type OCIProcess struct {
    Terminal bool     `json:"terminal"`
    User     OCIUser  `json:"user"`
    Args     []string `json:"args"`
    Env      []string `json:"env"`
    Cwd      string   `json:"cwd"`
}

type OCIRoot struct {
    Path     string `json:"path"`
    Readonly bool   `json:"readonly"`
}

type OCILinux struct {
    Namespaces []OCINamespace `json:"namespaces"`
    Resources  *OCIResources  `json:"resources,omitempty"`
}

func loadSpec(bundlePath string) (*OCISpec, error) {
    data, err := os.ReadFile(filepath.Join(bundlePath, "config.json"))
    if err != nil {
        return nil, fmt.Errorf("read config.json: %w", err)
    }
    var spec OCISpec
    if err := json.Unmarshal(data, &spec); err != nil {
        return nil, fmt.Errorf("parse config.json: %w", err)
    }
    return &spec, nil
}

func namespaceFlagsFromSpec(nss []OCINamespace) uintptr {
    var flags uintptr
    for _, ns := range nss {
        switch ns.Type {
        case "pid":
            flags |= syscall.CLONE_NEWPID
        case "uts":
            flags |= syscall.CLONE_NEWUTS
        case "mount":
            flags |= syscall.CLONE_NEWNS
        case "ipc":
            flags |= syscall.CLONE_NEWIPC
        case "network":
            flags |= syscall.CLONE_NEWNET
        case "user":
            flags |= syscall.CLONE_NEWUSER
        }
    }
    return flags
}

func setupMounts(spec *OCISpec) error {
    for _, m := range spec.Mounts {
        // 确保挂载目标目录存在
        target := filepath.Join(spec.Root.Path, m.Destination)
        os.MkdirAll(target, 0755)

        // options 字符串拆分成 flags 和 data
        flags, data := parseMountOptions(m.Options)

        // 直接映射到 mount(source, target, fstype, flags, data)
        if err := syscall.Mount(m.Source, target, m.Type, flags, data); err != nil {
            return fmt.Errorf("mount %s -> %s: %w", m.Source, m.Destination, err)
        }
    }
    return nil
}

{
    "hooks": {
        "prestart": [{ "path": "/usr/bin/setup-network" }],
        "createRuntime": [{ "path": "/usr/bin/gpu-setup" }],
        "poststart": [{ "path": "/usr/bin/notify-ready" }],
        "poststop": [{ "path": "/usr/bin/cleanup" }]
    }
}

{
    "hooks": {
        "createRuntime": [
            {
                "path": "/usr/bin/gpu-container-hook",
                "args": ["gpu-container-hook", "--device=0"],
                "env": ["PATH=/usr/bin", "NVIDIA_VISIBLE_DEVICES=0"]
            }
        ]
    }
}

#!/bin/bash
# 从 stdin 读取容器 state（JSON 格式）
STATE=$(cat)
PID=$(echo "$STATE" | jq -r '.pid')
BUNDLE=$(echo "$STATE" | jq -r '.bundle')

# 在容器的 mount namespace 里创建 GPU 设备节点
ROOTFS=$(jq -r '.root.path' "$BUNDLE/config.json")

# 把宿主机的 /dev/nvidia0 绑定挂载到容器的 rootfs
CONTAINER_ROOTFS="/proc/$PID/root"
mkdir -p "$CONTAINER_ROOTFS/dev/nvidia0"
mount --bind /dev/nvidia0 "$CONTAINER_ROOTFS/dev/nvidia0"

# 挂载 NVIDIA 用户态驱动库
mkdir -p "$CONTAINER_ROOTFS/usr/lib/x86_64-linux-gnu"
mount --bind /usr/lib/x86_64-linux-gnu/libnvidia-ml.so.1 \
    "$CONTAINER_ROOTFS/usr/lib/x86_64-linux-gnu/libnvidia-ml.so.1"

{
    "hooks": {
        "createRuntime": [
            {
                "path": "/opt/cni/bin/bridge-hook",
                "args": ["bridge-hook", "--subnet=10.88.0.0/16"],
                "timeout": 10
            }
        ],
        "poststop": [
            {
                "path": "/opt/cni/bin/bridge-hook",
                "args": ["bridge-hook", "--action=teardown"]
            }
        ]
    }
}

func runHooks(hooks []OCIHook, state []byte) error {
    for _, h := range hooks {
        cmd := exec.Command(h.Path, h.Args[1:]...)
        cmd.Stdin = bytes.NewReader(state)  // 通过 stdin 传递容器 state
        cmd.Env = h.Env

        if err := cmd.Start(); err != nil {
            return fmt.Errorf("hook %s: %w", h.Path, err)
        }
        if h.Timeout != nil {
            // 设置超时定时器
            timer := time.AfterFunc(time.Duration(*h.Timeout)*time.Second, func() {
                cmd.Process.Kill()
            })
            defer timer.Stop()
        }
        if err := cmd.Wait(); err != nil {
            return fmt.Errorf("hook %s exited with: %w", h.Path, err)
        }
    }
    return nil
}

# 拉一个镜像
sudo ctr image pull docker.io/library/alpine:latest

# 用我们的运行时创建容器
sudo ctr run --runtime /usr/local/bin/miniruntime \
    docker.io/library/alpine:latest mycontainer /bin/sh

mkdir my-bundle && cd my-bundle
mkdir rootfs
# 用 alpine 的 rootfs 或者 docker export 导出一个
runc spec
# 会在当前目录生成 config.json，包含所有常用字段的默认值

# 方法一：用 jq 检查 JSON 语法
jq . config.json > /dev/null && echo "JSON OK" || echo "JSON broken"

# 方法二：用 oci-runtime-tool 做规范级验证（需要安装）
go install github.com/opencontainers/runtime-tools/cmd/oci-runtime-tool@latest
oci-runtime-tool validate --path config.json

# 方法三：自己写一个最小验证脚本
python3 -c "
import json, sys
spec = json.load(open('config.json'))
assert 'ociVersion' in spec, 'missing ociVersion'
assert spec.get('process', {}).get('args'), 'process.args is empty'
assert spec.get('root', {}).get('path'), 'root.path is empty'
print('Basic validation passed')
"

# runc 支持 --debug 和 --log 参数
runc --debug --log /var/log/runc-debug.log create mycontainer --bundle ./my-bundle
cat /var/log/runc-debug.log

strace -f -e trace=clone,mount,unshare,pivot_root,execve \
    runc create mycontainer --bundle ./my-bundle 2>&1 | tail -50

# 查看容器状态
cat /run/runc/<container-id>/state.json | jq .

# 如果容器状态是 "created" 但 start 失败，检查 init 进程是否还活着
ls -la /proc/$(jq -r '.init_process_pid' /run/runc/<container-id>/state.json)/

# 强制清理僵尸容器
runc delete --force <container-id>