1. 背景

2. vm template 原理

3. 系统架构

3.1. template 是什么

3.2. 打开 template 特性

3.3. 创建 template

3.3.1. template 创建流程

    factoryConfig := vf.Config{
        Template:        runtimeConfig.FactoryConfig.Template,
        TemplatePath:    runtimeConfig.FactoryConfig.TemplatePath,
        VMCache:         runtimeConfig.FactoryConfig.VMCacheNumber > 0,
        VMCacheEndpoint: runtimeConfig.FactoryConfig.VMCacheEndpoint,
        VMConfig: vc.VMConfig{
            HypervisorType:   runtimeConfig.HypervisorType,
            HypervisorConfig: runtimeConfig.HypervisorConfig,
            AgentConfig:      runtimeConfig.AgentConfig,
        },
    }
     f, err := vf.NewFactory(ctx, factoryConfig, true)
    if err != nil && !factoryConfig.VMCache {
        kataUtilsLogger.WithError(err).Warn("load vm factory failed, about to create new one")
        f, err = vf.NewFactory(ctx, factoryConfig, false)
    }

func (t *template) createTemplateVM(ctx context.Context) error {
    // create the template vm
    config := t.config
    config.HypervisorConfig.BootToBeTemplate = true
    config.HypervisorConfig.BootFromTemplate = false
    config.HypervisorConfig.MemoryPath = t.statePath + "/memory"
    config.HypervisorConfig.DevicesStatePath = t.statePath + "/state"

    vm, err := vc.NewVM(ctx, config)  // 这个地方会创建一个 vm，并真正的 start 起来
    if err != nil {
        return err
    }
    defer vm.Stop(ctx)

    if err = vm.Disconnect(ctx); err != nil {
        return err
    }

    // Sleep a bit to let the agent grpc server clean up
    // When we close connection to the agent, it needs sometime to cleanup
    // and restart listening on the communication( serial or vsock) port.
    // That time can be saved if we sleep a bit to wait for the agent to
    // come around and start listening again. The sleep is only done when
    // creating new vm templates and saves time for every new vm that are
    // created from template, so it worth the invest.
    time.Sleep(templateWaitForAgent)

    if err = vm.Pause(ctx); err != nil {
        return err
    }

    if err = vm.Save(); err != nil {
        return err
    }
    return nil
}

3.3.2. template 规格

    return vc.HypervisorConfig{
        HypervisorPath:          hypervisor,
        HypervisorMachineType:   machineType,
        NumVCPUs:                h.defaultVCPUs(),   --> 对应 default vcpus 参数
        DefaultMaxVCPUs:         h.defaultMaxVCPUs(),
        MemorySize:              h.defaultMemSz(),   --> 对应 default memory 参数
        MemSlots:                h.defaultMemSlots(),
        MemOffset:               h.defaultMemOffset(),

3.3. 从 template 创建 sandbox

func (q *qemu) setupTemplate(knobs *govmmQemu.Knobs, memory *govmmQemu.Memory) govmmQemu.Incoming {
    incoming := govmmQemu.Incoming{}

    if q.config.BootToBeTemplate || q.config.BootFromTemplate {
        knobs.FileBackedMem = true
        memory.Path = q.config.MemoryPath

        if q.config.BootToBeTemplate {
            knobs.MemShared = true
        }
        if q.config.BootFromTemplate {
            incoming.MigrationType = govmmQemu.MigrationDefer
        }
    }
    return incoming
}

3.4. 创建 container

// CreateContainer creates a new container in the sandbox
// This should be called only when the sandbox is already created.
// It will add new container config to sandbox.config.Containers
func (s *Sandbox) CreateContainer(ctx context.Context, contConfig ContainerConfig) (VCContainer, error) {
    // Update sandbox config to include the new container's config
    s.config.Containers = append(s.config.Containers, contConfig)

    // Create the container object, add devices to the sandbox's device-manager:
    c, err := newContainer(ctx, s, &s.config.Containers[len(s.config.Containers)-1])
    if err != nil {
        return nil, err
    }

    // create and start the container
    if err = c.create(ctx); err != nil {
        return nil, err
    }

    // Add the container to the containers list in the sandbox.
    if err = s.addContainer(c); err != nil {
        return nil, err
    }

    // Sandbox is responsible to update VM resources needed by Containers
    // Update resources after having added containers to the sandbox, since
    // container status is requiered to know if more resources should be added.
    if err = s.updateResources(ctx); err != nil {
        return nil, err
    }

    if err = s.cgroupsUpdate(ctx); err != nil {
        return nil, err
    }
    // ....

    return c, nil
}

4. 技术限制

4.1. virtio-fs