add initial draft of containerd-runh-shim

This is a fork of containerd-shim-runc-v2-rs and adatapted for
runh

Cargo.toml

@@ -0,0 +1,79 @@
+[package]
+name = "containerd-runh-shim"
+version = "0.1.1"
+authors = [
+    "Stefan Lankes <[email protected]>",
+    "Shaobao Feng <[email protected]>",
+    "Tianyang Zhang <[email protected]>",
+    "The containerd Authors",
+]
+description = "Rust implementation of containerd's runh v2 shim runtime"
+keywords = ["containerd", "shim", "containers"]
+categories = ["api-bindings", "asynchronous"]
+edition = "2021"
+license = "Apache-2.0"
+
+[workspace]
+members = [
+  "crates/runh",
+]
+
+[workspace.package]
+license = "Apache-2.0"
+repository = "https://github.com/hermit-os/containerd-runh-shim"
+homepage = "https://hermit-os.org"
+edition = "2021"
+
+# Common dependencies for all crates
+[workspace.dependencies]
+async-trait = "0.1.52"
+cgroups-rs = "0.3.4"
+crossbeam = "0.8.1"
+futures = "0.3.19"
+libc = "0.2.112"
+log = {version = "0.4.2", features=["kv_unstable"]}
+nix = "0.29"
+oci-spec = "0.6"
+os_pipe = "1.1"
+prctl = "1.0.0"
+prost = "0.13"
+prost-build = "0.13"
+prost-types = "0.13"
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+simple_logger = { version = "5.0", default-features = false }
+tempfile = "3.6"
+thiserror = "1.0"
+time = { version = "0.3.29", features = ["serde", "std", "formatting"] }
+tokio = "1.26"
+tonic = "0.12"
+tonic-build = "0.12"
+tower = "0.4"
+uuid = { version = "1.0", features = ["v4"] }
+
+[[bin]]
+name = "containerd-shim-runh-v2"
+path = "src/main.rs"
+doc = false
+
+[dependencies]
+containerd-shim = { version = "0.7.4", features = ["async"] }
+libc.workspace = true
+log.workspace = true
+nix = { workspace = true, features = ["socket", "uio", "term"] }
+oci-spec.workspace = true
+prctl.workspace = true
+runh = { path = "crates/runh", version = "0.2.0", features = ["async"] }
+serde.workspace = true
+serde_json.workspace = true
+time.workspace = true
+uuid.workspace = true
+
+# Async dependencies
+async-trait.workspace = true
+tokio = { workspace = true, features = ["full"] }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+cgroups-rs.workspace = true
+nix = { workspace = true, features = ["event"] }
+

README.md

@@ -0,0 +1,11 @@
+# Rust containerd shim v2 for runh container
+
+This shim is a fork of [io.containerd.runc.v2-rs](https://github.com/containerd/rust-extensions/blob/main/crates/runc-shim) and adapted for [runh](https://github.com/hermit-os/runh).
+By default [containerd](https://github.com/containerd/containerd) relies on runtime shim to launch containers.
+
+## Usage
+
+To build binary, run:
+```shell
+cargo build --release
+```

build.rs

@@ -0,0 +1,39 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+use std::{process::Command, str::from_utf8};
+
+fn main() {
+    let output = match Command::new("git").arg("rev-parse").arg("HEAD").output() {
+        Ok(output) => output,
+        Err(_) => {
+            return;
+        }
+    };
+    let mut hash = from_utf8(&output.stdout).unwrap().trim().to_string();
+
+    let output_dirty = match Command::new("git").arg("diff").arg("--exit-code").output() {
+        Ok(output) => output,
+        Err(_) => {
+            return;
+        }
+    };
+
+    if !output_dirty.status.success() {
+        hash.push_str(".m");
+    }
+    println!("cargo:rustc-env=CARGO_GIT_HASH={}", hash);
+}

crates/runh/Cargo.toml

@@ -0,0 +1,39 @@
+[package]
+name = "runh"
+version = "0.2.0"
+authors = ["Stefan Lankes <[email protected]>", "Yuna Tomida <[email protected]>", "The containerd Authors"]
+description = "A crate for consuming the runh binary in your Rust applications"
+keywords = ["containerd", "containers", "runh"]
+categories = ["api-bindings", "asynchronous"]
+
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+homepage.workspace = true
+
+[features]
+async = ["tokio", "async-trait", "tokio-pipe"]
+docs = []
+
+[dependencies]
+libc.workspace = true
+log.workspace = true
+nix = { workspace = true, features = ["user", "fs"] }
+oci-spec.workspace = true
+os_pipe.workspace = true
+path-absolutize = "3.0.11"
+prctl.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+tempfile.workspace = true
+thiserror.workspace = true
+time.workspace = true
+uuid.workspace = true
+
+# Async dependencies
+async-trait = { workspace = true, optional = true }
+tokio = { workspace = true, features = ["full"], optional = true }
+tokio-pipe = { version = "0.2.10", optional = true }
+
+[package.metadata.docs.rs]
+features = ["docs"]

crates/runh/README.md

@@ -0,0 +1,46 @@
+# Rust bindings for runc CLI
+
+[![Crates.io](https://img.shields.io/crates/v/runc)](https://crates.io/crates/runc)
+[![docs.rs](https://img.shields.io/docsrs/runc)](https://docs.rs/runc/latest/runc/)
+[![Crates.io](https://img.shields.io/crates/l/containerd-shim)](https://github.com/containerd/rust-extensions/blob/main/LICENSE)
+[![CI](https://github.com/containerd/rust-extensions/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/containerd/rust-extensions/actions/workflows/ci.yml)
+
+A crate for consuming the runc binary in your Rust applications, similar to [go-runc](https://github.com/containerd/go-runc) for Go.
+This crate is based on archived [rust-runc](https://github.com/pwFoo/rust-runc).
+
+## Usage
+Both sync/async version is available.
+You can build runc client with `RuncConfig` in method chaining style.
+Call `build()` or `build_async()` to get client.
+Note that async client depends on [tokio](https://github.com/tokio-rs/tokio), then please use it on tokio runtime.
+
+```rust,ignore
+#[tokio::main]
+async fn main() {
+    let config = runc::GlobalOpts::new()
+        .root("./new_root")
+        .debug(false)
+        .log("/path/to/logfile.json")
+        .log_format(runc::LogFormat::Json)
+        .rootless(true);
+
+    let client = config.build_async().unwrap();
+
+    let opts = runc::options::CreateOpts::new()
+        .pid_file("/path/to/pid/file")
+        .no_pivot(true);
+
+    client.create("container-id", "path/to/bundle", Some(&opts)).unwrap();
+}
+```
+
+## Limitations
+- Supported commands are only:
+    - create
+    - start
+    - state
+    - kill
+    - delete
+- Exec is **not** available in `RuncAsyncClient` now.
+- Console utilites are **not** available
+    - see [Go version](https://github.com/containerd/go-runc/blob/main/console.go)

crates/runh/src/container.rs

@@ -0,0 +1,86 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Forked from https://github.com/pwFoo/rust-runc/blob/313e6ae5a79b54455b0a242a795c69adf035141a/src/lib.rs
+
+/*
+ * Copyright 2020 fsyncd, Berlin, Germany.
+ * Additional material, copyright of the containerd authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use std::collections::HashMap;
+
+use serde::{Deserialize, Serialize};
+use time::{serde::timestamp, OffsetDateTime};
+
+/// Information for runc container
+#[derive(Debug, Serialize, Deserialize)]
+pub struct Container {
+    pub id: String,
+    pub pid: usize,
+    pub status: String,
+    pub bundle: String,
+    pub rootfs: String,
+    #[serde(with = "timestamp")]
+    pub created: OffsetDateTime,
+    pub annotations: HashMap<String, String>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn serde_test() {
+        let j = r#"
+            {
+                "id": "fake",
+                "pid": 1000,
+                "status": "RUNNING",
+                "bundle": "/path/to/bundle",
+                "rootfs": "/path/to/rootfs",
+                "created": 1431684000,
+                "annotations": {
+                    "foo": "bar"
+                }
+            }"#;
+
+        let c: Container = serde_json::from_str(j).unwrap();
+        assert_eq!(c.id, "fake");
+        assert_eq!(c.pid, 1000);
+        assert_eq!(c.status, "RUNNING");
+        assert_eq!(c.bundle, "/path/to/bundle");
+        assert_eq!(c.rootfs, "/path/to/rootfs");
+        assert_eq!(
+            c.created,
+            OffsetDateTime::from_unix_timestamp(1431684000).unwrap()
+        );
+        assert_eq!(c.annotations.get("foo"), Some(&"bar".to_string()));
+        assert_eq!(c.annotations.get("bar"), None);
+    }
+}