Build Kata container with RME Support

Build Environment

Ubuntu 22.04 Arm64, Kernel 6.5.0-28-generic, native build.

Build process

Due to the quick code change for CCA software stack, the Kata-container is working well with v1.0-eac5 Guest kernel and Qemu. We skip the RFCv2 integration, and WIP on Kata-support with RFCv3.

The original v1.0-eac5 is not working with TSM report modules, and there is a backport patch to support this: https://git.codelinaro.org/linaro/dcap/cca-demos/build-ccs/-/blob/clo/main/shrinkwrap/config/linux/TSM-CCA-Prototype.patch?ref_type=heads

Download build-ccs repository and run the command as below:

git clone https://git.codelinaro.org/linaro/dcap/cca-demos/build-ccs.git
cd build-ccs
git checkout origin/dev/clo/main
make kata-deploy

After run the command, it will automatically build the:

Kata Guest Kernel(v1.0-eac5 with TSM support)
Kata rootfs image/Kata initrd image(Kata-agent and CoCo guest components will be also included)
Qemu with CCA enabled (v1.0-eac5)
Kata container Binaries/virtiofsd

All the binaries will be moved to build-ccs/binaries

Prepare Kata container Host

In order to launch the Kata-container, it needs the host kernel have different configurations. The demo kernel configuration is https://people.linaro.org/~kevin.zhao/config-cca-host-v1.0-eac5

Repo: https://gitlab.arm.com/linux-arm/linux-cca cca-full/rmm-v1.0-eac5

cd linux-cca
cp config-cca-host-v1.0-eac5
make CROSS_COMPILE=aarch64-linux-gnu- ARCH=arm64 -j8

Follow the instructions show here Building an RME stack for QEMU | Build the Ubuntu Rootfs , you will get a ubuntu rootfs. Assume it is named as ubuntu22.img, mount at /root/mnt, then make modules install to put the modules to the rootfs.

sudo mount /root/ubuntu22.img /root/mnt
cd ../linux-cca
sudo make modules_install ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- INSTALL_MOD_PATH=/root/mnt
sudo umount /root/mnt

Install and Configure the Kata container

Launch the Kata container Host

Can refer to : https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/Building+an+RME+stack+for+QEMU#With-the-OP-TEE-build-environment. Assume that you are using the OPTEE build environment to set up the pure software stack, and that will be also easy to launch the host.

Then, Change the Makefile script, re-direct the kernel/rootfs you just get from Build and run CoCo/Kata Container with RME Support | Prepare Kata container Host .

Next step, copy the binaries to the Kata host.

Install Kata from tarball

Configure the Kata-containers

Get the Kata container configuration from: https://people.linaro.org/~kevin.zhao/configuration.toml, copy it to /etc/kata-containers/

Set some configuration items in /etc/kata-containers/configuration.toml. Kata containers can run with either an initrd image or a rootfs image. But they can just be set either rootfs or initrd, please do not set both. Here we test rootfs. Some essential configurations items should be changed as below.

Configure the Containerd to use Kata-container. Copy https://people.linaro.org/~kevin.zhao/config.toml.containerd to /etc/containerd/config.toml

More things for Kata with containerd, please refer here: https://github.com/kata-containers/kata-containers/blob/main/docs/install/container-manager/containerd/containerd-install.md

Install CNI and nerdctl to launch the container

CNI - Container network interface

CNI is essential for container network. CNI can be installed either binaries or build from source, check :

More things for Kata with containerd, please refer here:

Nerdctl command line

Install nerdctl command line. nerdctl cmdline will automatically set up the CNI network with host-local, and it is compatible with docker command line. Just copy the binaries to the host and it is ready to go. See more for Nerdctl

Run command like below to launch Kata container: