containerd

README

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc.

containerd is designed to be embedded into a larger system, rather than being used directly by developers or end-users.

Features

Client

containerd offers a full client package to help you integrate containerd into your platform.

import "github.com/containerd/containerd"

func main() {
	client, err := containerd.New("/run/containerd/containerd.sock")
	defer client.Close()
}

Namespaces

Namespaces allow multiple consumers to use the same containerd without conflicting with each other. It has the benefit of sharing content but still having separation with containers and images.

To set a namespace for requests to the API:

context    = context.Background()
// create a context for docker
docker = namespaces.WithNamespace(context, "docker")

containerd, err := client.NewContainer(docker, "id")

To set a default namespace on the client:

client, err := containerd.New(address, containerd.WithDefaultNamespace("docker"))

Distribution

// pull an image
image, err := client.Pull(context, "docker.io/library/redis:latest")

// push an image
err := client.Push(context, "docker.io/library/redis:latest", image.Target())

OCI Runtime Specification

containerd fully supports the OCI runtime specification for running containers. We have built in functions to help you generate runtime specifications based on images as well as custom parameters.

spec, err := containerd.GenerateSpec(containerd.WithImageConfig(context, image))

Containers

In containerd, a container is a metadata object. Resources such as an OCI runtime specification, image, root filesystem, and other metadata can be attached to a container.

redis, err := client.NewContainer(context, "redis-master",
	containerd.WithSpec(spec),
)
defer redis.Delete(context)

Root Filesystems

containerd allows you to use overlay or snapshot filesystems with your containers. It comes with builtin support for overlayfs and btrfs.

// pull an image and unpack it into the configured snapshotter
image, err := client.Pull(context, "docker.io/library/redis:latest", containerd.WithPullUnpack)

// allocate a new RW root filesystem for a container based on the image
redis, err := client.NewContainer(context, "redis-master",
	containerd.WithSpec(spec),
	containerd.WithNewRootFS("redis-rootfs", image),
)

// use a readonly filesystem with multiple containers
for i := 0; i < 10; i++ {
	id := fmt.Sprintf("id-%s", i)
	container, err := client.NewContainer(ctx, id,
		containerd.WithSpec(spec),
		containerd.WithNewReadonlyRootFS(id, image),
	)
}

Tasks

Taking a container object and turning it into a runnable process on a system is done by creating a new Task from the container. A task represents the runnable object within containerd.

// create a new task
task, err := redis.NewTask(context, containerd.Stdio)
defer task.Delete(context)

// the task is now running and has a pid that can be use to setup networking
// or other runtime settings outside of containerd
pid := task.Pid()

// start the redis-server process inside the container
err := task.Start(context)

// wait for the task to exit and get the exit status
status, err := task.Wait(context)

Checkpoint and Restore

If you have criu installed on your machine you can checkpoint and restore containers and their tasks. This allow you to clone and/or live migrate containers to other machines.

// checkpoint the task then push it to a registry
checkpoint, err := task.Checkpoint(context, containerd.WithExit)

err := client.Push(context, "myregistry/checkpoints/redis:master", checkpoint)

// on a new machine pull the checkpoint and restore the redis container
image, err := client.Pull(context, "myregistry/checkpoints/redis:master")

checkpoint := image.Target()

redis, err = client.NewContainer(context, "redis-master", containerd.WithCheckpoint(checkpoint, "redis-rootfs"))
defer container.Delete(context)

task, err = redis.NewTask(context, containerd.Stdio, containerd.WithTaskCheckpoint(checkpoint))
defer task.Delete(context)

err := task.Start(context)

Developer Quick-Start

To build the daemon and ctr simple test client, the following build system dependencies are required:

• Go 1.8.x or above (requires 1.8 due to use of golang plugin(s))
• Protoc 3.x compiler and headers (download at the Google protobuf releases page)
• Btrfs headers and libraries for your distribution. Note that building the btrfs driver can be disabled via build tag removing this dependency.

For proper results, install the protoc release into /usr/local on your build system. For example, the following commands will download and install the 3.1.0 release for a 64-bit Linux host:

$ wget -c https://github.com/google/protobuf/releases/download/v3.1.0/protoc-3.1.0-linux-x86_64.zip
$ sudo unzip protoc-3.1.0-linux-x86_64.zip -d /usr/local

With the required dependencies installed, the Makefile target named binaries will compile the ctr and containerd binaries and place them in the bin/ directory. Using sudo make install will place the binaries in /usr/local/bin. When making any changes to the gRPC API, make generate will use the installed protoc compiler to regenerate the API generated code packages.

Note: A build tag is currently available to disable building the btrfs snapshot driver. Adding BUILDTAGS=no_btrfs to your environment before calling the binaries Makefile target will disable the btrfs driver within the containerd Go build.

Vendoring of external imports uses the vndr tool which uses a simple config file, vendor.conf, to provide the URL and version or hash details for each vendored import. After modifying vendor.conf run the vndr tool to update the vendor/ directory contents. Combining the vendor.conf update with the changeset in vendor/ after running vndr should become a single commit for a PR which relies on vendored updates.

Please refer to RUNC.md for the currently supported version of runc that is used by containerd.

Releases

containerd will be released with a 1.0 when feature complete and this version will be supported for 1 year with security and bug fixes applied and released.

The upgrade path for containerd is that the 0.0.x patch releases are always backward compatible with its major and minor version. Minor (0.x.0) version will always be compatible with the previous minor release. i.e. 1.2.0 is backwards compatible with 1.1.0 and 1.1.0 is compatible with 1.0.0. There is no compatibility guarantees with upgrades from two minor releases. i.e. 1.0.0 to 1.2.0.

There are not backwards compatibility guarantees with upgrades to major versions. i.e 1.0.0 to 2.0.0. Each major version will be supported for 1 year with bug fixes and security patches.

Development reports.

Weekly summary on the progress and what is being worked on. https://github.com/containerd/containerd/tree/master/reports

Communication

For async communication and long running discussions please use issues and pull requests on the github repo. This will be the best place to discuss design and implementation.

For sync communication we have a community slack with a #containerd channel that everyone is welcome to join and chat about development.

Slack: https://dockr.ly/community

Copyright and license

Copyright ©2016-2017 Docker, Inc. All rights reserved, except as follows. Code is released under the Apache 2.0 license. The README.md file, and files in the "docs" folder are licensed under the Creative Commons Attribution 4.0 International License under the terms and conditions set forth in the file "LICENSE.docs". You may obtain a duplicate copy of the same license, titled CC-BY-SA-4.0, at http://creativecommons.org/licenses/by/4.0/.

Documentation

Index

• Constants
• func GenerateSpec(opts ...SpecOpts) (*specs.Spec, error)
• func NewRemoteContainerStore(client containersapi.ContainersClient) containers.Store
• func WithExit(r *CheckpointTaskInfo) error
• func WithPullUnpack(client *Client, c *RemoteContext) error
• func WithRootFSDeletion(ctx context.Context, client *Client, c containers.Container) error
• func WithSchema1Conversion(client *Client, c *RemoteContext) error
• func WithStdinCloser(r *IOCloseInfo)
• func WithTTY(s *specs.Spec) error
• type CheckpointTaskInfo
• type CheckpointTaskOpts
• type Client
  • func New(address string, opts ...ClientOpt) (*Client, error)
  • func NewWithConn(conn *grpc.ClientConn, opts ...ClientOpt) (*Client, error)
  • func (c *Client) Close() error
  • func (c *Client) ContainerService() containers.Store
  • func (c *Client) Containers(ctx context.Context, filters ...string) ([]Container, error)
  • func (c *Client) ContentStore() content.Store
  • func (c *Client) DiffService() diff.DiffService
  • func (c *Client) EventService() eventsapi.EventsClient
  • func (c *Client) GetImage(ctx context.Context, ref string) (Image, error)
  • func (c *Client) HealthService() grpc_health_v1.HealthClient
  • func (c *Client) ImageService() images.Store
  • func (c *Client) IsServing(ctx context.Context) (bool, error)
  • func (c *Client) ListImages(ctx context.Context) ([]Image, error)
  • func (c *Client) LoadContainer(ctx context.Context, id string) (Container, error)
  • func (c *Client) NamespaceService() namespacesapi.NamespacesClient
  • func (c *Client) NewContainer(ctx context.Context, id string, opts ...NewContainerOpts) (Container, error)
  • func (c *Client) Pull(ctx context.Context, ref string, opts ...RemoteOpts) (Image, error)
  • func (c *Client) Push(ctx context.Context, ref string, desc ocispec.Descriptor, opts ...RemoteOpts) error
  • func (c *Client) SnapshotService(snapshotterName string) snapshot.Snapshotter
  • func (c *Client) TaskService() tasks.TasksClient
  • func (c *Client) Version(ctx context.Context) (Version, error)
  • func (c *Client) VersionService() versionservice.VersionClient
• type ClientOpt
  • func WithDefaultNamespace(ns string) ClientOpt
  • func WithDialOpts(opts []grpc.DialOption) ClientOpt
• type Container
• type DeleteOpts
• type FIFOSet
  • func NewFifos() (*FIFOSet, error)
• type IO
  • func Stdio() (*IO, error)
  • func StdioTerminal() (*IO, error)
  • func (i *IO) Cancel()
  • func (i *IO) Close() error
  • func (i *IO) Wait()
• type IOAttach
  • func WithAttach(stdin io.Reader, stdout, stderr io.Writer) IOAttach
• type IOCloseInfo
• type IOCloserOpts
• type IOCreation
  • func NewIO(stdin io.Reader, stdout, stderr io.Writer) IOCreation
  • func NewIOWithTerminal(stdin io.Reader, stdout, stderr io.Writer, terminal bool) IOCreation
• type Image
• type NewContainerOpts
  • func WithCheckpoint(desc v1.Descriptor, rootfsID string) NewContainerOpts
  • func WithContainerLabels(labels map[string]string) NewContainerOpts
  • func WithExistingRootFS(id string) NewContainerOpts
  • func WithImage(i Image) NewContainerOpts
  • func WithNewReadonlyRootFS(id string, i Image) NewContainerOpts
  • func WithNewRootFS(id string, i Image) NewContainerOpts
  • func WithRuntime(name string) NewContainerOpts
  • func WithSnapshotter(name string) NewContainerOpts
  • func WithSpec(spec *specs.Spec) NewContainerOpts
• type NewTaskOpts
  • func WithTaskCheckpoint(desc v1.Descriptor) NewTaskOpts
• type Process
• type RemoteContext
• type RemoteOpts
  • func WithImageHandler(h images.Handler) RemoteOpts
  • func WithPullSnapshotter(snapshotterName string) RemoteOpts
  • func WithResolver(resolver remotes.Resolver) RemoteOpts
• type SpecOpts
  • func WithHostNamespace(ns specs.LinuxNamespaceType) SpecOpts
  • func WithImageConfig(ctx context.Context, i Image) SpecOpts
  • func WithLinuxNamespace(ns specs.LinuxNamespace) SpecOpts
  • func WithProcessArgs(args ...string) SpecOpts
• type Task
• type TaskInfo
• type TaskStatus
• type UpdateTaskInfo
• type UpdateTaskOpts
  • func WithResources(resources *specs.LinuxResources) UpdateTaskOpts
• type Version

Constants

const DefaultAddress = "/run/containerd/containerd.sock"

DefaultAddress is the default unix socket address

const UnknownExitStatus = 255

Functions

func GenerateSpec

func GenerateSpec(opts ...SpecOpts) (*specs.Spec, error)

GenerateSpec will generate a default spec from the provided image for use as a containerd container

func NewRemoteContainerStore

func NewRemoteContainerStore(client containersapi.ContainersClient) containers.Store

func WithExit

func WithExit(r *CheckpointTaskInfo) error

func WithPullUnpack

func WithPullUnpack(client *Client, c *RemoteContext) error

WithPullUnpack is used to unpack an image after pull. This uses the snapshotter, content store, and diff service configured for the client.

func WithRootFSDeletion

func WithRootFSDeletion(ctx context.Context, client *Client, c containers.Container) error

WithRootFSDeletion deletes the rootfs allocated for the container

func WithSchema1Conversion

func WithSchema1Conversion(client *Client, c *RemoteContext) error

WithSchema1Conversion is used to convert Docker registry schema 1 manifests to oci manifests on pull. Without this option schema 1 manifests will return a not supported error.

func WithStdinCloser

func WithStdinCloser(r *IOCloseInfo)

func WithTTY

func WithTTY(s *specs.Spec) error

Types

type CheckpointTaskInfo

type CheckpointTaskInfo struct {
	ParentCheckpoint digest.Digest
	Options          interface{}
}

type CheckpointTaskOpts

type CheckpointTaskOpts func(*CheckpointTaskInfo) error

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client is the client to interact with containerd and its various services using a uniform interface

func New

func New(address string, opts ...ClientOpt) (*Client, error)

New returns a new containerd client that is connected to the containerd instance provided by address

func NewWithConn

func NewWithConn(conn *grpc.ClientConn, opts ...ClientOpt) (*Client, error)

NewWithConn returns a new containerd client that is connected to the containerd instance provided by the connection

func (*Client) Close

func (c *Client) Close() error

Close closes the clients connection to containerd

func (*Client) ContainerService

func (c *Client) ContainerService() containers.Store

func (*Client) Containers

func (c *Client) Containers(ctx context.Context, filters ...string) ([]Container, error)

Containers returns all containers created in containerd

func (*Client) ContentStore

func (c *Client) ContentStore() content.Store

func (*Client) DiffService

func (c *Client) DiffService() diff.DiffService

func (*Client) EventService

func (c *Client) EventService() eventsapi.EventsClient

func (*Client) GetImage

func (c *Client) GetImage(ctx context.Context, ref string) (Image, error)

GetImage returns an existing image

func (*Client) HealthService

func (c *Client) HealthService() grpc_health_v1.HealthClient

func (*Client) ImageService

func (c *Client) ImageService() images.Store

func (*Client) IsServing

func (c *Client) IsServing(ctx context.Context) (bool, error)

func (*Client) ListImages

func (c *Client) ListImages(ctx context.Context) ([]Image, error)

ListImages returns all existing images

func (*Client) LoadContainer

func (c *Client) LoadContainer(ctx context.Context, id string) (Container, error)

func (*Client) NamespaceService

func (c *Client) NamespaceService() namespacesapi.NamespacesClient

func (*Client) NewContainer

func (c *Client) NewContainer(ctx context.Context, id string, opts ...NewContainerOpts) (Container, error)

NewContainer will create a new container in container with the provided id the id must be unique within the namespace

func (*Client) Pull

func (c *Client) Pull(ctx context.Context, ref string, opts ...RemoteOpts) (Image, error)

func (*Client) Push

func (c *Client) Push(ctx context.Context, ref string, desc ocispec.Descriptor, opts ...RemoteOpts) error

func (*Client) SnapshotService

func (c *Client) SnapshotService(snapshotterName string) snapshot.Snapshotter

func (*Client) TaskService

func (c *Client) TaskService() tasks.TasksClient

func (*Client) Version

func (c *Client) Version(ctx context.Context) (Version, error)

func (*Client) VersionService

func (c *Client) VersionService() versionservice.VersionClient

type ClientOpt

type ClientOpt func(c *clientOpts) error

func WithDefaultNamespace

func WithDefaultNamespace(ns string) ClientOpt

func WithDialOpts

func WithDialOpts(opts []grpc.DialOption) ClientOpt

WithDialOpts allows grpc.DialOptions to be set on the connection

type Container

type Container interface {
	ID() string
	Info() containers.Container
	Delete(context.Context, ...DeleteOpts) error
	NewTask(context.Context, IOCreation, ...NewTaskOpts) (Task, error)
	Spec() (*specs.Spec, error)
	Task(context.Context, IOAttach) (Task, error)
	Image(context.Context) (Image, error)
	Labels(context.Context) (map[string]string, error)
	SetLabels(context.Context, map[string]string) (map[string]string, error)
}

type DeleteOpts

type DeleteOpts func(context.Context, *Client, containers.Container) error

type FIFOSet

type FIFOSet struct {
	// Dir is the directory holding the task fifos
	Dir          string
	In, Out, Err string
	Terminal     bool
}

func NewFifos

func NewFifos() (*FIFOSet, error)

NewFifos returns a new set of fifos for the task

type IO

type IO struct {
	Terminal bool
	Stdin    string
	Stdout   string
	Stderr   string
	// contains filtered or unexported fields
}

func Stdio

func Stdio() (*IO, error)

Stdio returns an IO implementation to be used for a task that outputs the container's IO as the current processes Stdio

func StdioTerminal

func StdioTerminal() (*IO, error)

StdioTerminal will setup the IO for the task to use a terminal

func (*IO) Cancel

func (i *IO) Cancel()

func (*IO) Close

func (i *IO) Close() error

func (*IO) Wait

func (i *IO) Wait()

type IOAttach

type IOAttach func(*FIFOSet) (*IO, error)

func WithAttach

func WithAttach(stdin io.Reader, stdout, stderr io.Writer) IOAttach

type IOCloseInfo

type IOCloseInfo struct {
	Stdin bool
}

type IOCloserOpts

type IOCloserOpts func(*IOCloseInfo)

type IOCreation

type IOCreation func() (*IO, error)

func NewIO

func NewIO(stdin io.Reader, stdout, stderr io.Writer) IOCreation

func NewIOWithTerminal

func NewIOWithTerminal(stdin io.Reader, stdout, stderr io.Writer, terminal bool) IOCreation

type Image

type Image interface {
	Name() string
	Target() ocispec.Descriptor

	Unpack(context.Context, string) error
}

type NewContainerOpts

type NewContainerOpts func(ctx context.Context, client *Client, c *containers.Container) error

func WithCheckpoint

func WithCheckpoint(desc v1.Descriptor, rootfsID string) NewContainerOpts

func WithContainerLabels

func WithContainerLabels(labels map[string]string) NewContainerOpts

WithContainerLabels adds the provided labels to the container

func WithExistingRootFS

func WithExistingRootFS(id string) NewContainerOpts

WithExistingRootFS uses an existing root filesystem for the container

func WithImage

func WithImage(i Image) NewContainerOpts

func WithNewReadonlyRootFS

func WithNewReadonlyRootFS(id string, i Image) NewContainerOpts

WithNewReadonlyRootFS allocates a new snapshot to be used by the container as the root filesystem in read-only mode

func WithNewRootFS

func WithNewRootFS(id string, i Image) NewContainerOpts

WithNewRootFS allocates a new snapshot to be used by the container as the root filesystem in read-write mode

func WithRuntime

func WithRuntime(name string) NewContainerOpts

WithRuntime allows a user to specify the runtime name and additional options that should be used to create tasks for the container

func WithSnapshotter

func WithSnapshotter(name string) NewContainerOpts

func WithSpec

func WithSpec(spec *specs.Spec) NewContainerOpts

type NewTaskOpts

type NewTaskOpts func(context.Context, *Client, *TaskInfo) error

func WithTaskCheckpoint

func WithTaskCheckpoint(desc v1.Descriptor) NewTaskOpts

type Process

type Process interface {
	Pid() uint32
	Start(context.Context) error
	Delete(context.Context) (uint32, error)
	Kill(context.Context, syscall.Signal) error
	Wait(context.Context) (uint32, error)
	CloseIO(context.Context, ...IOCloserOpts) error
	Resize(ctx context.Context, w, h uint32) error
	IO() *IO
}

type RemoteContext

type RemoteContext struct {
	// Resolver is used to resolve names to objects, fetchers, and pushers.
	// If no resolver is provided, defaults to Docker registry resolver.
	Resolver remotes.Resolver

	// Unpack is done after an image is pulled to extract into a snapshotter.
	// If an image is not unpacked on pull, it can be unpacked any time
	// afterwards. Unpacking is required to run an image.
	Unpack bool

	// Snapshotter used for unpacking
	Snapshotter string

	// BaseHandlers are a set of handlers which get are called on dispatch.
	// These handlers always get called before any operation specific
	// handlers.
	BaseHandlers []images.Handler

	// ConvertSchema1 is whether to convert Docker registry schema 1
	// manifests. If this option is false then any image which resolves
	// to schema 1 will return an error since schema 1 is not supported.
	ConvertSchema1 bool
}

RemoteContext is used to configure object resolutions and transfers with remote content stores and image providers.

type RemoteOpts

type RemoteOpts func(*Client, *RemoteContext) error

func WithImageHandler

func WithImageHandler(h images.Handler) RemoteOpts

WithImageHandler adds a base handler to be called on dispatch.

func WithPullSnapshotter

func WithPullSnapshotter(snapshotterName string) RemoteOpts

WithPullSnapshotter specifies snapshotter name used for unpacking

func WithResolver

func WithResolver(resolver remotes.Resolver) RemoteOpts

WithResolver specifies the resolver to use.

type SpecOpts

type SpecOpts func(s *specs.Spec) error

func WithHostNamespace

func WithHostNamespace(ns specs.LinuxNamespaceType) SpecOpts

func WithImageConfig

func WithImageConfig(ctx context.Context, i Image) SpecOpts

func WithLinuxNamespace

func WithLinuxNamespace(ns specs.LinuxNamespace) SpecOpts

WithLinuxNamespace uses the passed in namespace for the spec. If a namespace of the same type already exists in the spec, the existing namespace is replaced by the one provided.

func WithProcessArgs

func WithProcessArgs(args ...string) SpecOpts

type Task

type Task interface {
	Pid() uint32
	Delete(context.Context) (uint32, error)
	Kill(context.Context, syscall.Signal) error
	Pause(context.Context) error
	Resume(context.Context) error
	Start(context.Context) error
	Status(context.Context) (TaskStatus, error)
	Wait(context.Context) (uint32, error)
	Exec(context.Context, string, *specs.Process, IOCreation) (Process, error)
	Pids(context.Context) ([]uint32, error)
	CloseIO(context.Context, ...IOCloserOpts) error
	Resize(ctx context.Context, w, h uint32) error
	IO() *IO
	Checkpoint(context.Context, ...CheckpointTaskOpts) (v1.Descriptor, error)
	Update(context.Context, ...UpdateTaskOpts) error
}

type TaskInfo

type TaskInfo struct {
	Checkpoint *types.Descriptor
	Options    interface{}
}

type TaskStatus

type TaskStatus string

const (
	Running TaskStatus = "running"
	Created TaskStatus = "created"
	Stopped TaskStatus = "stopped"
	Paused  TaskStatus = "paused"
	Pausing TaskStatus = "pausing"
)

type UpdateTaskInfo

type UpdateTaskInfo struct {
	Resources interface{}
}

type UpdateTaskOpts

type UpdateTaskOpts func(context.Context, *Client, *UpdateTaskInfo) error

func WithResources

func WithResources(resources *specs.LinuxResources) UpdateTaskOpts

type Version

type Version struct {
	Version  string
	Revision string
}