github.com/rkt/rkt@v1.30.1-0.20200224141603-171c416fac02/Documentation/running-fly-stage1.md (about)

     1  # Running rkt with the *fly* stage1
     2  
     3  The *fly* stage1 is an alternative stage1 that runs a single-application ACI with only `chroot`-isolation.
     4  
     5  
     6  ## Motivation
     7  
     8  The motivation of the fly feature is to add the ability to run applications with full privileges on the host but still benefit from the image management and discovery from rkt.
     9  The Kubernetes [`kubelet`][kubelet] is one candidate for rkt fly.
    10  
    11  
    12  ## How does it work?
    13  
    14  In comparison to the default stage1, there is no process manager involved in the stage1.
    15  This a visual illustration for the differences in the process tree between the default and the fly stage1:
    16  
    17  stage1-coreos.aci:
    18  
    19  ```
    20  host OS
    21    └─ rkt
    22      └─ systemd-nspawn
    23        └─ systemd
    24          └─ chroot
    25            └─ user-app1
    26  ```
    27  
    28  
    29  stage1-fly.aci:
    30  
    31  ```
    32  host OS
    33    └─ rkt
    34      └─ chroot
    35        └─ user-app1
    36  ```
    37  
    38  The rkt application sets up bind mounts for `/dev`, `/proc`, `/sys`, and the user-provided volumes.
    39  In addition to the bind mounts, an additional *tmpfs* mount is done at `/tmp`.
    40  After the mounts are set up, rkt `chroot`s to the application's RootFS and finally executes the application.
    41  
    42  
    43  ### Mount propagation modes
    44  
    45  The *fly* stage1 makes use of Linux [mount propagation modes][sharedsubtree].
    46  If a volume source path is a mountpoint on the host, this mountpoint is made recursively shared before the host path is mounted on the target path in the container.
    47  Hence, changes to the mounts inside the container will be propagated back to the host.
    48  
    49  The bind mounts for `/dev`, `/proc`, and `/sys` are done automatically and are recursive, because their hierarchy contains mounts which also need to be available for the container to function properly.
    50  User-provided volumes are not mounted recursively.
    51  This is a safety measure to prevent system crashes when multiple containers are started that mount `/` into the container.
    52  
    53  
    54  ## Getting started
    55  
    56  You can either use `stage1-fly.aci` from the official release, or build rkt yourself with the right options:
    57  
    58  ```
    59  $ ./autogen.sh && ./configure --with-stage1-flavors=fly && make
    60  ```
    61  
    62  For more details about configure parameters, see the [configure script parameters documentation][build-configure].
    63  This will build the rkt binary and the stage1-fly.aci in `build-rkt-1.30.0+git/bin/`.
    64  
    65  ### Selecting stage1 at runtime
    66  
    67  Here is a quick example of how to use a container with the official fly stage1:
    68  
    69  ```
    70  # rkt run --stage1-name=coreos.com/rkt/stage1-fly:1.30.0 coreos.com/etcd:v2.2.5
    71  ```
    72  
    73  If the image is not in the store, `--stage1-name` will perform discovery and fetch the image.
    74  
    75  ## Notes on isolation and security
    76  
    77  By design, the *fly* stage1 does not provide the same isolation and security features as the default stage1.
    78  
    79  Specifically, the following constraints are not available when using the *fly* stage1:
    80  
    81  - network namespace isolation
    82  - CPU isolators
    83  - Memory isolators
    84  - CAPABILITY bounding
    85  - SELinux
    86  
    87  ### Providing additional isolation with systemd
    88  
    89  When using systemd on the host it is possible to [wrap rkt with a systemd unit file][systemd-unit] to provide additional isolation.
    90  For more information please consult the systemd manual.
    91  * [systemd.resource-control][systemd.resource-control]
    92  * [systemd.directives][systemd.directives]
    93  
    94  
    95  [build-configure]: build-configure.md
    96  [kubelet]: https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/
    97  [sharedsubtree]: https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt
    98  [systemd.directives]: https://www.freedesktop.org/software/systemd/man/systemd.directives.html
    99  [systemd.resource-control]: https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html
   100  [systemd-unit]: using-rkt-with-systemd.md#advanced-unit-file