Package org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.runtime

Class OCIContainerRuntime

java.lang.Object

org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.runtime.OCIContainerRuntime

All Implemented Interfaces:

LinuxContainerRuntime, ContainerRuntime

Direct Known Subclasses:

DockerLinuxContainerRuntime, RuncContainerRuntime

@Private
@Unstable
public abstract class OCIContainerRuntime
extends java.lang.Object
implements LinuxContainerRuntime

This class is a ContainerRuntime implementation that uses the native container-executor binary via a PrivilegedOperationExecutor instance to launch processes inside OCI-compliant containers.

Field Summary

Fields

Modifier and Type	Field	Description
static java.lang.String	CONTAINER_PID_NAMESPACE_SUFFIX
static java.lang.String	RUN_PRIVILEGED_CONTAINER_SUFFIX
static java.lang.String	RUNTIME_PREFIX

Constructor Summary

Constructors

Constructor	Description
OCIContainerRuntime(PrivilegedOperationExecutor privilegedOperationExecutor)
OCIContainerRuntime(PrivilegedOperationExecutor privilegedOperationExecutor, CGroupsHandler cGroupsHandler)

Method Summary

Modifier and Type	Method	Description
protected boolean	allowHostPidNamespace(Container container)	Return whether the YARN container is allowed to run using the host's PID namespace for the OCI-compliant container.
protected boolean	allowPrivilegedContainerExecution(Container container)	Return whether the YARN container is allowed to run in a privileged OCI-compliant container.
static java.lang.String	formatOciEnvKey(java.lang.String runtimeTypeUpper, java.lang.String envKeySuffix)
java.util.Map<java.lang.String,org.apache.hadoop.yarn.api.CsiAdaptorProtocol>	getCsiClients()
protected java.lang.String[]	getGroupIdInfo(java.lang.String userName)
protected java.lang.String	getUserIdInfo(java.lang.String userName)
void	initialize(org.apache.hadoop.conf.Configuration conf, Context nmContext)	Initialize the runtime.
protected void	initiateCsiClients(org.apache.hadoop.conf.Configuration config)	Initiate CSI clients to talk to the CSI adaptors on this node and cache the clients for easier fetch.
protected boolean	isContainerRequestedAsPrivileged(Container container)	This function only returns whether a privileged container was requested, not whether the container was or will be launched as privileged.
static boolean	isOCICompliantContainerRequested(org.apache.hadoop.conf.Configuration daemonConf, java.util.Map<java.lang.String,java.lang.String> env)
protected java.lang.String	mountReadOnlyPath(java.lang.String mount, java.util.Map<org.apache.hadoop.fs.Path,java.util.List<java.lang.String>> localizedResources)
void	prepareContainer(ContainerRuntimeContext ctx)	Prepare a container to be ready for launch.
protected void	validateContainerNetworkType(java.lang.String network)
protected void	validateContainerRuntimeType(java.lang.String runtime)
protected static void	validateHostname(java.lang.String hostname)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.hadoop.yarn.server.nodemanager.containermanager.runtime.ContainerRuntime

execContainer, getExposedPorts, getIpAndHost, launchContainer, reapContainer, relaunchContainer, signalContainer

Methods inherited from interface org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.runtime.LinuxContainerRuntime

getLocalResources, isRuntimeRequested, start, stop

Field Detail

RUNTIME_PREFIX

@Private
public static final java.lang.String RUNTIME_PREFIX

See Also:

Constant Field Values

CONTAINER_PID_NAMESPACE_SUFFIX

@Private
public static final java.lang.String CONTAINER_PID_NAMESPACE_SUFFIX

See Also:

Constant Field Values

RUN_PRIVILEGED_CONTAINER_SUFFIX

@Private
public static final java.lang.String RUN_PRIVILEGED_CONTAINER_SUFFIX

See Also:

Constant Field Values

Constructor Detail

OCIContainerRuntime

public OCIContainerRuntime(PrivilegedOperationExecutor privilegedOperationExecutor)

OCIContainerRuntime

public OCIContainerRuntime(PrivilegedOperationExecutor privilegedOperationExecutor,
                           CGroupsHandler cGroupsHandler)

Method Detail

initialize

public void initialize(org.apache.hadoop.conf.Configuration conf,
                       Context nmContext)
                throws ContainerExecutionException

Description copied from interface: LinuxContainerRuntime

Initialize the runtime.

Specified by:

initialize in interface LinuxContainerRuntime

Parameters:

conf - the Configuration to use

nmContext - NMContext

Throws:

ContainerExecutionException - if an error occurs while initializing the runtime

isOCICompliantContainerRequested

public static boolean isOCICompliantContainerRequested(org.apache.hadoop.conf.Configuration daemonConf,
                                                       java.util.Map<java.lang.String,java.lang.String> env)

mountReadOnlyPath

@VisibleForTesting
protected java.lang.String mountReadOnlyPath(java.lang.String mount,
                                             java.util.Map<org.apache.hadoop.fs.Path,java.util.List<java.lang.String>> localizedResources)
                                      throws ContainerExecutionException

Throws:

ContainerExecutionException

prepareContainer

public void prepareContainer(ContainerRuntimeContext ctx)
                      throws ContainerExecutionException

Description copied from interface: ContainerRuntime

Prepare a container to be ready for launch.

Specified by:

prepareContainer in interface ContainerRuntime

Parameters:

ctx - the ContainerRuntimeContext

Throws:

ContainerExecutionException - if an error occurs while preparing the container

getUserIdInfo

protected java.lang.String getUserIdInfo(java.lang.String userName)
                                  throws ContainerExecutionException

Throws:

ContainerExecutionException

getGroupIdInfo

protected java.lang.String[] getGroupIdInfo(java.lang.String userName)
                                     throws ContainerExecutionException

Throws:

ContainerExecutionException

validateContainerNetworkType

protected void validateContainerNetworkType(java.lang.String network)
                                     throws ContainerExecutionException

Throws:

ContainerExecutionException

validateContainerRuntimeType

protected void validateContainerRuntimeType(java.lang.String runtime)
                                     throws ContainerExecutionException

Throws:

ContainerExecutionException

allowHostPidNamespace

protected boolean allowHostPidNamespace(Container container)
                                 throws ContainerExecutionException

Return whether the YARN container is allowed to run using the host's PID namespace for the OCI-compliant container. For this to be allowed, the submitting user must request the feature and the feature must be enabled on the cluster.

Parameters:

container - the target YARN container

Returns:

whether host pid namespace is requested and allowed

Throws:

ContainerExecutionException - if host pid namespace is requested but is not allowed

validateHostname

protected static void validateHostname(java.lang.String hostname)
                                throws ContainerExecutionException

Throws:

ContainerExecutionException

allowPrivilegedContainerExecution

protected boolean allowPrivilegedContainerExecution(Container container)
                                             throws ContainerExecutionException

Return whether the YARN container is allowed to run in a privileged OCI-compliant container. For a privileged container to be allowed all of the following three conditions must be satisfied:

1. Submitting user must request for a privileged container
2. Privileged containers must be enabled on the cluster
3. Submitting user must be white-listed to run a privileged container

Parameters:

container - the target YARN container

Returns:

whether privileged container execution is allowed

Throws:

ContainerExecutionException - if privileged container execution is requested but is not allowed

isContainerRequestedAsPrivileged

protected boolean isContainerRequestedAsPrivileged(Container container)

This function only returns whether a privileged container was requested, not whether the container was or will be launched as privileged.

Parameters:

container -

Returns:

true if container is requested as privileged

getCsiClients

public java.util.Map<java.lang.String,org.apache.hadoop.yarn.api.CsiAdaptorProtocol> getCsiClients()

initiateCsiClients

protected void initiateCsiClients(org.apache.hadoop.conf.Configuration config)
                           throws ContainerExecutionException

Initiate CSI clients to talk to the CSI adaptors on this node and cache the clients for easier fetch.

Parameters:

config - configuration

Throws:

ContainerExecutionException

formatOciEnvKey

public static java.lang.String formatOciEnvKey(java.lang.String runtimeTypeUpper,
                                               java.lang.String envKeySuffix)