Repository navigation
Run gVisor sandboxes without a pause container - #2773
Open
Jing (milantracy) wants to merge 2 commits into
Open
Jing (milantracy) wants to merge 2 commits into
Jing (milantracy) wants to merge 2 commits into
Conversation
Jing (milantracy)
marked this pull request as draft
October 16, 2026 21:28
Contributor
Author
|
I verified the change locally The gVisor pin in manifests/ate-install/sandboxconfig-gvisor.yaml still points at the 2026-10-10 nightly, which can't checkpoint/restore a sandbox with no root container. I'll move it to the first nightly with google/gvisor#15551 or later from a different PR before this change is merged |
2 tasks
Benjamin Elder (BenTheElder)
left a comment
Collaborator
There was a problem hiding this comment.
minor comments, generally +1
you'll probably have to rebase a bit when the nightly is ready, feel free to drop me a ping when the nightly is ready.
1 of 2 tasks
Jing (milantracy)
force-pushed
the
gvisor-no-root-container
branch
2 times, most recently
from
October 18, 2026 01:03
29ef674 to
d9738ea
Compare
Each actor sandbox had a root container that ran /pause from a pause image. atelet pulled that image and built its bundle, and every SandboxConfig had to name it. runsc can now boot a sandbox with no root container and checkpoint and restore it, so the pause container is not necessary. ateworker-gvisor still names the sandbox _pause, but now creates it with -no-root-container and a spec with no process, rootfs, or mounts. The spec keeps the network namespace, cgroup, resource limits, and durable-dir mount hints. Application containers do not change. Remove pauseImage from the SandboxConfig CRD, from SandboxAssets in the atelet API, from the snapshot manifest, from the sandbox bundle hash, and from runtime prewarm. Remove the pause_rootfs restore phase. The bundle hash changes, so snapshots taken with a pause container no longer match any worker's runtime.
The sandbox has no pause container, so the name _pause is misleading. Rename the sandbox's runsc ID to _sandbox and ocispec.PauseContainer to ocispec.SandboxID. The sandbox's runsc output is now logged under _sandbox, its cgroup leaf is <uid>-_sandbox, and the restore phases are sandbox_create and sandbox_restore. Remove the claim in the architecture doc that snapshot manifests pin the sandbox binaries for restore. A restore gets its runtime from the control plane, not from the manifest. Signed-off-by: Jing Chen <milantracy@gmail.com>
Jing (milantracy)
force-pushed
the
gvisor-no-root-container
branch
from
October 18, 2026 01:52
d9738ea to
4826196
Compare
Jing (milantracy)
marked this pull request as ready for review
October 18, 2026 02:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Each actor sandbox had a root container that ran /pause from a pause image. atelet pulled that image and built its bundle, and every SandboxConfig had to name it. runsc can now boot a sandbox with no root container and checkpoint and restore it, so the pause container is not necessary.
ateworker-gvisor now creates the _pause sandbox with -no-root-container and writes its spec with no process, rootfs, or mounts. The spec keeps the network namespace, cgroup, resource limits, and durable-dir mount hints. Application containers do not change.
Remove pauseImage from the SandboxConfig CRD, from SandboxAssets in the atelet API, from the snapshot manifest, from the sandbox runtime hash, and from asset prewarm. Remove the pause_rootfs restore phase.
Breaking change
Fixes #967