whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Tidy install guide for container runtimes (#12704)

Browse Source 
* Use feature-state note for CRI

* Note applicability to Linux hosts

* Explain cgroup ("control group")

* De-emphasize cgroup details

The individual runtime install steps already take account of this
advice.
This commit is contained in:
Tim Bannister
2019-02-25 16:37:39 +00:00
committed by Kubernetes Prow Robot
parent 99dccca00a
commit e176143ab1
1 changed files with 19 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/setup/cri.md
+19 -10
View File
@@ -7,15 +7,14 @@ content_template: templates/concept
weight: 100 weight: 100
--- ---
{{% capture overview %}} {{% capture overview %}}
Since v1.6.0, Kubernetes has enabled the use of CRI, Container Runtime Interface, by default. {{< feature-state for_k8s_version="v1.6" state="stable" >}}
This page contains installation instruction for various runtimes. To run containers in Pods, Kubernetes uses a container runtime. Here are
the installation instruction for various runtimes.
{{% /capture %}} {{% /capture %}}
{{% capture body %}} {{% capture body %}}
Please proceed with executing the following commands based on your OS as root.
You may become the root user by executing `sudo -i` after SSH-ing to each host.
{{< caution >}} {{< caution >}}
A flaw was found in the way runc handled system file descriptors when running containers. A flaw was found in the way runc handled system file descriptors when running containers.
@@ -26,15 +25,25 @@ Please refer to this link for more information about this issue
[cve-2019-5736 : runc vulnerability ] (https://access.redhat.com/security/cve/cve-2019-5736) [cve-2019-5736 : runc vulnerability ] (https://access.redhat.com/security/cve/cve-2019-5736)
{{< /caution >}} {{< /caution >}}
## Cgroup drivers ### Applicability
{{< note >}}
This document is written for users installing CRI onto Linux. For other operating
systems, look for documentation specific to your platform.
{{< /note >}}
You should execute all the commands in this guide as `root`. For example, prefix commands
with `sudo `, or become `root` and run the commands as that user.
### Cgroup drivers
When systemd is chosen as the init system for a Linux distribution, the init process generates When systemd is chosen as the init system for a Linux distribution, the init process generates
and consumes a root cgroup and acts as a cgroup manager. Systemd has a tight integration with and consumes a root control group (`cgroup`) and acts as a cgroup manager. Systemd has a tight
cgroups and will allocate cgroups per process. It's possible to configure your container integration with cgroups and will allocate cgroups per process. It's possible to configure your
runtime and the kubelet to use `cgroupfs`. This means that there will then be two different container runtime and the kubelet to use `cgroupfs`. Using `cgroupfs` alongside systemd means
cgroup managers. that there will then be two different cgroup managers.
Cgroups are used to constrain resources that are allocated to processes. Control groups are used to constrain resources that are allocated to processes.
A single cgroup manager will simplify the view of what resources are being allocated A single cgroup manager will simplify the view of what resources are being allocated
and will by default have a more consistent view of the available and in-use resources. When we have and will by default have a more consistent view of the available and in-use resources. When we have
two managers we end up with two views of those resources. We have seen cases in the field two managers we end up with two views of those resources. We have seen cases in the field