Supported VMMs and software-based monitors
One of the main goals of urunc
is to be a generic OCI unikernel runtime for
various unikernel frameworks and similar technologies. In order to achieve
that, we want to support as many Virtual Machine Monitors (VMMs) and other
types of sandboxing mechanisms such as user-space monitors based on
seccomp.
In this document, we will go through the current state of urunc
's support for
VMMs and monitors that utilize software-based isolation technologies. We will
provide a brief description about them, along with installation instructions
and a few comments regarding their integration with urunc
.
Note: In general,
urunc
expects all supported VM/Sandbox monitors to be available somewhere in the$PATH
.
Virtual Machine Monitors (VMMs)
VMMs use hardware-assisted virtualization technologies in order to create a
Virtual Machine (VM) where a guest OS will execute. It is one of the most
widely used technology for providing strong isolation in multi-tenant
environments. For the time being urunc
supports 3 types of such VMMs: 1)
Qemu, 2)
Firecracker and 3) Solo5-hvt.
Qemu
Qemu (Quick Emulator) is an open-source virtualization platform that enables the emulation of various hardware architectures. By leveraging Linux's KVM, Qemu is able to create VMs and manage their execution. Some of the biggest advantages of Qemu are the mature and stable interface and codebase. In addition, Qemu supports various paravirtual devices, mostly based on VirtIO and allows the direct use of the host's devices with passthrough.
Installing Qemu
We can easily install Qemu through almost all package managers. For more details check Qemu's download page. For instance, in the case of Ubuntu, we can simply run the following command:
$ sudo apt-get install qemu-system
Qemu and urunc
In the case of Qemu, urunc
makes use of its
virtio-net
device to provide network support for the unikernel through a tap
device. In addition, urunc
can leverage Qemu's
initrd option in order to provide the Unikernel with an initial RamFS
(initramfs). However, Qemu supports various ways to
provide storage in VMs such as block devices through virtio-blk,
shared-fs through 9p and virtio-fs and initramfs.
We plan to add support for all the above options, but as previously mentioned only Initramfs is supported for the time being.
Supported unikernel frameworks with urunc
:
An example unikernel:
$ sudo nerdctl run --rm -ti --runtime io.containerd.urunc.v2 harbor.nbfc.io/nubificus/urunc/nginx-qemu-unikraft-initrd:latest unikernel
AWS Firecracker
AWS Firecracker is an open-source virtualization technology developed by Amazon Web Services (AWS) that is designed to run serverless workloads efficiently. Firecracker provides a minimalist VMM, allowing the creation of lightweight virtual machines, called microVMs, that are faster and more resource-efficient than traditional VMs. In contrast with Qemu, Firecracker aims to provide a smaller set of devices for the VMs. The main benefit of Firecracker comes from its fast VM instantiation and guest OS boot.
Installing Firecracker
Firecracker is not available through a package manger, but it can easily be installed. The Getting Started guide of Firecracker describes how users can set up Firecracker. Long story short, we can fetch a Firecracker binary with the following commands:
$ ARCH="$(uname -m)" $ VERSION=v1.7.0"
$ release_url="https://github.com/firecracker-microvm/firecracker/releases"
$ curl -L ${release_url}/download/${VERSION}/firecracker-${VERSION}-${ARCH}.tgz | tar -xz
$ # Rename the binary to "firecracker"
$ sudo mv release-${latest}-$(uname-m)/firecracker-${latest}-${ARCH} /usr/local/bin/firecracker
$ rm -fr release-${latest}-$(uname -m)
It is important to note that urunc
expects to find the firecracker
binary
located in the $PATH
and named firecracker
.
Note: Since only Unikraft can boot on top of Firecracker (from the supported unikernels in
urunc
) we use the v1.7.0 version of Firecracker, due to some booting issues of Unikraft in newer versions.
Firecracker and urunc
In the case of Firecracker, urunc
makes use of its virtio-net
device to provide network support for the
unikernel though a tap device. In addition, urunc
can leverage
Firecracker's initrd option in order
to provide the Unikernel with an initial RamFS (initramfs).
Firecracker does not support
shared-fs between the host and the guest. However, it does provide support for
virtio-block.
We plan to add support for virtio-block, but as previously mentioned only Initramfs is supported for the time being.
Supported unikernel frameworks with urunc
:
An example unikernel:
$ sudo nerdctl run --rm -ti --runtime io.containerd.urunc.v2 harbor.nbfc.io/nubificus/urunc/nginx-firecracker-unikraft-initrd:latest unikernel
Solo5-hvt
Solo5-hvt is a lightweight, high-performance VMM designed to run unikernels in a virtualized environment. As a part of the broader Solo5 project, Solo5-hvt provides a minimal, efficient abstraction layer for running unikernels on modern hardware, leveraging hardware virtualization technologies Some of the key benefits of Solo5-hvt is its simplicity and and extremely fast boot times of unikernels. In contrast to the other VMMs, Solo5-hvt does not provide support for virtIO devices. Instead, it defines its own interface, which can be used for network and block I/O.
Installing Solo5-hvt
Solo5 can be installed by building from source. However, in order to do that, we will need a few packages.
$ sudo apt install libseccomp-dev pkg-config build-essential
Next, we can clone and build solo5-hvt
.
$ git clone -b v0.6.9 https://github.com/Solo5/solo5.git
$ cd solo5
$ ./configure.sh && make -j$(nproc)
It is important to note that urunc
expects to find the solo5-hvt
binary
located in the $PATH
and named as solo5-hvt
. Therefore, to install it:
$ sudo cp tenders/hvt/solo5-hvt /usr/local/bin
Solo5-hvt and urunc
In the case of Solo5-hvt, urunc
supports
all the devices and utilizes a tap device to provide network in the unikernel.
For the storage part, urunc
supports the block storage interface of
Solo5-hvt, which can be used in two ways,
either with a block image inside the container image, or using the devmapper as
a snapshotter.
In the first case, we copy inside the container image a block image that contains all the data we want to pass in the unikernel.
In the second case, we copy directly all the files we want the unikernel to
access inside the container's image. Using devmapper urunc
will use the
container's image snapshot as a block image for the unikernel. It is important
to note that the unikernel framework must support the respective filesystem
type (e.g. ext2/3/4). This is the case for Rumprun unikernel.
Supported unikernel frameworks with urunc
:
An example unikernel with a block image inside the conntainer's rootfs:
$ sudo nerdctl run --rm -ti --runtime io.containerd.urunc.v2 harbor.nbfc.io/nubificus/urunc/redis-hvt-rumprun-block:latest unikernel
Software-based isolation monitors
Except for the traditional VM-based isolation solutions, there are other solutions which provide isolation using software-based technologies too. In that case the monitor interacts with a user-space kernel on top of which the application is running. The user-space kernel intercepts or defines a set of system calls and then forwards them to the monitor. To further strengthen security, it is common to use seccomp filters to limit the exposure of the host OS to the monitor.
A well-known example of such a technology is gVisor. Unfortunately, gVisor does not support the execution of any unikernel framework.
Solo5-spt
In a similar way, Solo5-spt is a specialized backend for the Solo5 project, designed to run unikernels in systems that do not have access to hardware-assisted virtualization technologies. Solo5-spt executes a unikernel monitor with a seccomp filter allowing only seven system calls. The unikernel running on top of Solo5-spt interacts with this monitor through a similar interface with Solo5-hvt, facilitating network and block storage I/O. Solo5-spt can provide extremely fast intantiation times, very small overhead, along with performant execution.
Installing Solo5-spt
The installation process of Solo5-spt is similar with the Solo5-hvt one. In fact, both projects share the same repository. Hence we can follow the same steps as in Solo5-hvt. At first, make sure to install the necessary packages.
$ sudo apt install libseccomp-dev pkg-config build-essential
Next, we can clone and build solo5-spt
.
$ git clone -b v0.6.9 https://github.com/Solo5/solo5.git
$ cd solo5
$ ./configure.sh && make -j$(nproc)
It is important to note that urunc
expects to find the solo5-spt
binary
located in the $PATH
and named solo5-spt
. Therefore, to install it:
$ sudo cp tenders/spt/solo5-spt /usr/local/bin
Solo5-spt and urunc
Similarly with Solo5-hvt, urunc
supports
all the devices of Solo5-spt. For more
information take a look at the respective Solo5-hvt
section.
Supported unikernel frameworks with urunc
:
An example unikernel which utilizes devmapper for block storage:
$ sudo nerdctl run --rm -ti --snapshotter devmapper --runtime io.containerd.urunc.v2 harbor.nbfc.io/nubificus/urunc/redis-spt-rumprun:latest unikernel
Note: Since only Rumrpun can boot on top of Solo5-{hvt|spt} (from the supported unikernels in
urunc
) we use the v0.6.9 version of Solo5 since Rumprun has not been updated for the newer ones.