Add delete subcmd.

Signed-off-by: Klaus Ma <klausm@nvidia.com>

Cargo.toml

@@ -16,14 +16,17 @@ path = "src/shim/main.rs"
 clap = { version = "4", features = ["derive", "env"] }
 tokio = { version = "1", features = ["full", "tracing"] }
 tonic = { version = "0.11", features = ["tls"] }
-tokio-stream = { version="0.1", features=["net"] }
-futures="0.3"
+tokio-stream = { version = "0.1", features = ["net"] }
+futures = "0.3"
 tower = "0.4"
 prost = "0.12"
 prost-types = "0.12"
 
 tracing = "0.1"
-tracing-subscriber = { version = "0.3", features = ["env-filter", "local-time"] }
+tracing-subscriber = { version = "0.3", features = [
+    "env-filter",
+    "local-time",
+] }
 thiserror = "1"
 stdng = "0.1"
 async-trait = "0.1"
@@ -33,11 +36,17 @@ serde_json = "1.0"
 serde_yaml = "0.9"
 toml = "0.8"
 
-nix = { version = "0.29" , features = ["sched", "fs", "signal", "mount"]}
+nix = { version = "0.29", features = [
+    "sched",
+    "fs",
+    "signal",
+    "mount",
+    "user",
+] }
 oci-spec = "0.7.0"
 flate2 = "1.0"
 tar = "0.4"
 
 [build-dependencies]
 tonic-build = "0.11"
-prost-build = "0.12"
+prost-build = "0.12"

busybox.yaml

@@ -1,3 +1,3 @@
 name: busybox
 image: busybox
-entrypoint: /usr/bin/date
+entrypoint: /usr/bin/sh

src/core/cfg/mod.rs

@@ -22,6 +22,16 @@ pub enum Commands {
         file: String,
     },
 
+    /// Delete a container or sandbox.
+    Delete {
+        /// The name of conatiner to delete.
+        #[arg(short, long)]
+        container: Option<String>,
+        /// The name of pod to delete.
+        #[arg(short, long)]
+        pod: Option<String>,
+    },
+
     /// Run a Pod directly.
     Runp,
 

src/core/cmd/delete/mod.rs

@@ -0,0 +1,31 @@
+/*
+Copyright 2024 The openBCE Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+use std::fs;
+
+use chariot::apis;
+use crate::cfg;
+
+pub async fn run(
+    cxt: cfg::Context,
+    container: Option<String>,
+    _pod: Option<String>,
+) -> apis::ChariotResult<()> {
+    if let Some(container) = container {
+        let container_root = format!("{}/{}", cxt.container_dir(), container);
+        fs::remove_dir_all(&container_root)?;
+        tracing::debug!("The container <{}> was cleared", container_root);
+    }
+
+    Ok(())
+}

src/core/cmd/mod.rs

@@ -11,6 +11,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+pub mod delete;
 pub mod runc;
 pub mod runp;
 pub mod start;

src/core/cmd/runc/mod.rs

@@ -17,10 +17,10 @@ use std::fs;
 use nix::{
     fcntl::{open, OFlag},
     libc,
-    mount::{mount, MsFlags},
+    mount::{mount, umount2, MntFlags, MsFlags},
     sched::CloneFlags,
     sys::{stat::Mode, wait::wait},
-    unistd::{chdir, dup2, execv, getpid, pivot_root},
+    unistd::{chdir, dup2, execv, getpid, getuid, pivot_root},
 };
 
 use flate2::read::GzDecoder;
@@ -33,15 +33,32 @@ pub async fn run(cxt: cfg::Context, file: String) -> ChariotResult<()> {
     let yaml = fs::read_to_string(file)?;
     let container: Container = serde_yaml::from_str(&yaml)?;
 
+    tracing::debug!("Parent pid is <{}>.", getpid());
+
+    let manifest_path = format!("{}/{}/manifest.json", cxt.image_dir(), container.image);
+    tracing::debug!("Loading image manifest <{}>.", manifest_path);
+    let image_manifest = ImageManifest::from_file(manifest_path)?;
+
+    let container_root = format!("{}/{}", cxt.container_dir(), container.name);
+    let rootfs = format!("{}/rootfs", container_root);
+    let imagefs = format!("{}/{}", cxt.image_dir(), container.name);
+
+    for layer in image_manifest.layers() {
+        // TODO: detect mediaType and select unpack tools accordingly.
+        let layer_path = format!("{}/{}", imagefs, layer.digest().digest());
+        let tar_gz = fs::File::open(layer_path)?;
+        let tar = GzDecoder::new(tar_gz);
+        let mut archive = tar::Archive::new(tar);
+        archive.unpack(&rootfs)?;
+    }
+
     let mut stack = [0u8; 1024 * 1024];
     let flags = CloneFlags::empty()
         .union(CloneFlags::CLONE_NEWUSER)
         .union(CloneFlags::CLONE_NEWNET)
         .union(CloneFlags::CLONE_NEWPID)
         .union(CloneFlags::CLONE_NEWNS);
 
-    tracing::debug!("Parent pid is <{}>.", getpid());
-
     let pid = unsafe {
         nix::sched::clone(
             Box::new(|| match run_container(cxt.clone(), container.clone()) {
@@ -67,41 +84,25 @@ pub async fn run(cxt: cfg::Context, file: String) -> ChariotResult<()> {
 }
 
 fn run_container(cxt: cfg::Context, container: Container) -> ChariotResult<()> {
-    tracing::debug!("Run sandbox <{}> as <{}>.", container.name, getpid());
-
-    // TODO: get the CHARIOT_HOME from configure file.
-    let manifest_path = format!("{}/{}/manifest.json", cxt.image_dir(), container.image);
-    tracing::debug!("Loading image manifest <{}>.", manifest_path);
-    let image_manifest = ImageManifest::from_file(manifest_path)?;
-
+    tracing::debug!(
+        "Run sandbox <{}> in <{}> as <{}>.",
+        container.name,
+        getpid(),
+        getuid()
+    );
     let container_root = format!("{}/{}", cxt.container_dir(), container.name);
-    let logfile = format!("{}/{}.log", container_root, container.name);
-    let rootfs = format!("{}/rootfs", container_root);
-    let imagefs = format!("{}/{}", cxt.image_dir(), container.name);
-    let oldfs = format!("{}/.pivot_root", rootfs);
 
-    for layer in image_manifest.layers() {
-        // TODO: detect mediaType and select unpack tools accordingly.
-        let layer_path = format!("{}/{}", imagefs, layer.digest().digest());
-        let tar_gz = fs::File::open(layer_path)?;
-        let tar = GzDecoder::new(tar_gz);
-        let mut archive = tar::Archive::new(tar);
-        archive.unpack(&rootfs)?;
-    }
-
-    // Change to rootfs.
-    fs::create_dir_all(&oldfs)?;
-    tracing::debug!("Change root to <{}>, and the old fs is <{}>", rootfs, oldfs);
-
-    //Re-direct the stdout/stderr to log file.
+    // Re-direct the stdout/stderr to log file.
+    let logfile = format!("{}/{}.log", container_root, container.name);
     let log = open(
         logfile.as_str(),
         OFlag::empty().union(OFlag::O_CREAT).union(OFlag::O_RDWR),
-        Mode::from_bits(0755).unwrap(),
+        Mode::from_bits(0o755).unwrap(),
     )?;
-    tracing::debug!("Dup container stdout to log file.");
-    dup2(log, 1)?;
-    dup2(log, 2)?;
+
+    // Create rootfs.
+    let rootfs = format!("{}/rootfs", container_root);
+    tracing::debug!("Change root to <{}>", rootfs);
 
     // Ensure that 'new_root' and its parent mount don't have
     // shared propagation (which would cause pivot_root() to
@@ -126,14 +127,46 @@ fn run_container(cxt: cfg::Context, container: Container) -> ChariotResult<()> {
         None::<&str>,
     )?;
 
-    let _ = pivot_root(rootfs.as_str(), oldfs.as_str())?;
+    let _ = pivot_root(rootfs.as_str(), rootfs.as_str())?;
+
+    tracing::debug!("Detach the rootfs from parent.");
+    mount(
+        None::<&str>,
+        "/",
+        None::<&str>,
+        MsFlags::MS_SLAVE | MsFlags::MS_REC,
+        None::<&str>,
+    )?;
+    umount2("/", MntFlags::MNT_DETACH)?;
 
-    // TODO: unmout the old fs
-    // umount(oldfs)
+    tracing::debug!("Try to mout /proc, /dev by <{}>", getuid());
+    mount(
+        Some("proc"),
+        "/proc",
+        Some("proc"),
+        MsFlags::empty()
+            .union(MsFlags::MS_NOEXEC)
+            .union(MsFlags::MS_NODEV)
+            .union(MsFlags::MS_NOSUID),
+        None::<&str>,
+    )?;
+    mount(
+        Some("tmpfs"),
+        "/dev",
+        Some("tmpfs"),
+        MsFlags::empty()
+            .union(MsFlags::MS_STRICTATIME)
+            .union(MsFlags::MS_NOSUID),
+        Some("mode=755"),
+    )?;
 
     // Change working directory to '/'.
     chdir("/")?;
 
+    tracing::debug!("Redirect container stdout/stderr to log file.");
+    dup2(log, 1)?;
+    dup2(log, 2)?;
+
     // execute `container entrypoint`
     let cmd = CString::new(container.entrypoint.as_bytes())?;
     let _ = execv(cmd.as_c_str(), &[cmd.as_c_str()]);

src/core/main.rs

@@ -50,6 +50,9 @@ async fn main() -> Result<(), Box<dyn Error>> {
         cfg::Commands::Runc { file } => {
             cmd::runc::run(cxt, file).await?;
         }
+        cfg::Commands::Delete { container, pod } => {
+            cmd::delete::run(cxt, container, pod).await?;
+        }
     }
 
     Ok(())