search

containerd / accelerated-container-image

A production-ready remote container image format (overlaybd) and snapshotter based on block-device.
Apache License 2.0
400 stars 72 forks source link

DADI image support for "No image conversion" #137

Open shuaichang opened 2 years ago

shuaichang commented 2 years ago

TLDR: we'd love to request for feasibility of adding DADI blobs as part of the original OCIV1 image

Use cases:

  1. Easier management of a single image for both accelerated and original
  2. More transparent onboarding since it does not require workload to change the deployment config, workloads could use the same image as OCIV1 and later the node could decide when to start switching to accelerated format for a seemless user experience.
  3. Quick rollback: similar to 2, in case we encountered issue for accl image, we can switch containerd config snapshotter to overlayfs for a quick rollback and being transparent to workloads.
  4. Easier security scanning and auditing

AFAIK, there was previously a gap in image spec to achieve this state. I'm wondering if DADI could leverage on the new addition into the image spec for reference types https://github.com/opencontainers/wg-reference-types

An example can be found here https://github.com/awslabs/soci-snapshotter#no-image-conversion

Just a random thought, please feel free to correct me:

  1. Pull image, the image is an OCI V1 image with DADI blobs as its additional artifacts.
  2. Containerd calls overlaybd-snapshotter.Prepare
  3. overlaybd-snapshotter checks the image, if it has DADI blobs, then stream with overlaybd. Otherwise fall back to overlayfs.
lihuiba commented 2 years ago

You mean referencing DADI image blobs in OCIv1's metadata, and detect that reference in overlaybd-snapshotter?

shuaichang commented 2 years ago

@lihuiba that's correct. The end goal is to use a single OCIV1 image that can be run with/without acceleration for easier rolling updates, rollback, image security scanning etc.