runwasi: Use youki to fully support OCI runtime spec in wasmedge

[utam0k]

Partially Fix: #23 (After this PR, I'm planning to create a PR to address wasmtime.)

Remaining issues

• Wait for merge:
  • Fixed container init process not re-parent to youki main process youki-dev/youki#1637
  • libcontainer: Make the workloads injectable youki-dev/youki#1403
• Pass all tests
• Pass CIs

[utam0k]

Current Status.

$ cargo test --no-run --message-format=json | jq -r "select(.profile.test == true) | .filenames[]" | while read -r bin; do;
 sudo LD_LIBRARY_PATH=/home/utam0k/.wasmedge/lib "$bin"
done
[...]
running 3 tests
test instance::tests::test_maybe_open_stdio ... ok
test instance::wasitest::test_delete_after_create ... ok
test instance::wasitest::test_wasi ... ok

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.14s

[ipuustin]

Looks cool! Couple of questions:

1. You say this partially fixes Full Linux OCI runtime spec support #23 -- can you tell which parts will be missing?
2. Does this cause any functional changes outside of the spec? I mean, does Youki use the three-process model now for running the VM? Is the namespace isolation the same?

I was preparing some seccomp support in https://github.com/ipuustin/runwasi/commits/seccomp. I'm thinking I'll probably pause that work until this PR merges and then add the unit tests and other potentially useful stuff on top of this PR.

[ipuustin]

Are the oci functions such as get_cgroup, setup_cgroup etc. used elsewhere, or can we drop them too?

[utam0k]

Since libcontainer supports set-up cgroup, I think don't need to take care of cgroup by runwasi.

[utam0k]

👋 Hi, @ipuustin. Thanks for your comment.

We need to support wasmtime after this PR.

You say this partially fixes #23 -- can you tell which parts will be missing?

Basically the same. Youki implements the oci-spec following runc's implementation, but more simply.

Does this cause any functional changes outside of the spec? I mean, does Youki use the three-process model now for running the VM? Is the namespace isolation the same?

I agree with you. Sorry for the inconvenience.

I was preparing some seccomp support in https://github.com/ipuustin/runwasi/commits/seccomp. I'm thinking I'll probably pause that work until this PR merges and then add the unit tests and other potentially useful stuff on top of this PR.

[rumpl]

@utam0k Awesome! Sorry I didn't respond earlier, I didn't really have the time to go deep into this issue. Thanks!

[utam0k]

@rumpl PTAL

[rumpl]

I just tested this with docker and I have a new error:

➜  ~ docker run --runtime=io.containerd.wasmedge.v1 was
docker: Error response from daemon: failed to load spec: unknown.
ERRO[0000] error waiting for container:                 

I'll try and find some time today to see if I can find the issue

[0xE282B0]

Same result here:

docker: Error response from daemon: failed to load spec: unknown.
ERRO[0000] error waiting for container:

The last thing that is executed is the ContainerBuilder[...].build()?; when using docker. However, when running the same container with only containerd it is working.

@utam0k, could it be something in the bundle causing that?

[rumpl]

Note: I did try to run the same image with docker and the wasmtime runtime and it worked

[rumpl]

Just spent some more time with this, is annoying that anyhow only shows the last error in the chain, the actual error I get is:

Apr 06 18:01:45 nuque containerd[528]: [ERROR] ERROR: failed to load spec
Apr 06 18:01:45 nuque containerd[528]: [ERROR] because: failed to validate runtime spec
Apr 06 18:01:45 nuque containerd[528]: [ERROR] because: runtime spec has incompatible version '1.1.0-rc.1'. Only 1.0.X is supported

[0xE282B0]

@rumpl, You're right, bug hunting it's a bit cumbersome. Fortunately, the error you're mentioning was the last that blocks the container from running. Now I have at least a simple Wasm container running with moby.

@utam0k, I don't know what implications the version change has for youki but when I disable the version check it is working for me. Shall we open an issue for youki to support 1.1.x as well?

[utam0k]

@rumpl @0xE282B0 👋 Thanks for your check.
I will check it this weekend.

[utam0k]

@0xE282B0 @rumpl I have put the commit to fix it!

[0xE282B0]

LGTM, I'm able to run a simple Wasm container with Moby v24.0.0-beta.1 on Ubuntu 22.10 x64.

The log is looking similar to the old containerd-shim-wasmedge version:

Well done! 🥳

I'll test it with different Kubernetes distributions on Tuesday, but when it is working with Docker there should not be a big problem.

[utam0k]

@rumpl @cpuguy83 PTAL 🙏

[cpuguy83]

LGTM

We can follow up with any necessary fixes.

[utam0k]

@cpuguy83 Thanks for the hard PR review 🙇

[cpuguy83]

Thanks for putting in all the effort! Great work.