runc spec 命令的使用说明

该命令，主要是用来生成容器启动的config.json文件，所有的容器config.json初始相同，根据--rootless再覆盖配置，重新生成config.json

--bundle 工作目录

--rootless 非root用户权限的容器

$ runc spec --help
NAME:
   runc spec - create a new specification file

USAGE:
   runc spec [command options] [arguments...]

DESCRIPTION:
   The spec command creates the new specification file named "config.json" for
the bundle.

The spec generated is just a starter file. Editing of the spec is required to
achieve desired results. For example, the newly generated spec includes an args
parameter that is initially set to call the "sh" command when the container is
started. Calling "sh" may work for an ubuntu container or busybox, but will not
work for containers that do not include the "sh" program.

EXAMPLE:
  To run docker's hello-world container one needs to set the args parameter
in the spec to call hello. This can be done using the sed command or a text
editor. The following commands create a bundle for hello-world, change the
default args parameter in the spec from "sh" to "/hello", then run the hello
command in a new hello-world container named container1:

    mkdir hello
    cd hello
    docker pull hello-world
    docker export $(docker create hello-world) > hello-world.tar
    mkdir rootfs
    tar -C rootfs -xf hello-world.tar
    runc spec
    sed -i 's;"sh";"/hello";' config.json
    runc run container1

In the run command above, "container1" is the name for the instance of the
container that you are starting. The name you provide for the container instance
must be unique on your host.

An alternative for generating a customized spec config is to use "oci-runtime-tool", the
sub-command "oci-runtime-tool generate" has lots of options that can be used to do any
customizations as you want, see runtime-tools (https://github.com/opencontainers/runtime-tools)
to get more information.

When starting a container through runc, runc needs root privilege. If not
already running as root, you can use sudo to give runc root privilege. For
example: "sudo runc start container1" will give runc root privilege to start the
container on your host.

Alternatively, you can start a rootless container, which has the ability to run
without root privileges. For this to work, the specification file needs to be
adjusted accordingly. You can pass the parameter --rootless to this command to
generate a proper rootless spec file.

OPTIONS:
   --bundle value, -b value  path to the root of the bundle directory
   --rootless                generate a configuration for a rootless container

源码流程

下面是 spec 命令的源码，比较简单，没有过多涉及底层的地方

var specCommand = cli.Command{
    Name: "spec",
    Action: func(context *cli.Context) error {
        // 1. 检查参数是否正确
        if err := checkArgs(context, 0, exactArgs); err != nil {
            return err
        }

        // 2. 生成spec配置样例
        spec := specconv.Example()

        // 3. 判断rootless. 如果rootless = true， 会调用ToRootless()修改spec，去掉不必要的配置，增加相关配置
        rootless := context.Bool("rootless")
        if rootless {
            specconv.ToRootless(spec)
        }

        checkNoFile := func(name string) error {
            _, err := os.Stat(name)
            if err == nil {
                return fmt.Errorf("File %s exists. Remove it first", name)
            }
            if !os.IsNotExist(err) {
                return err
            }
            return nil
        }

        // 4. 切换工作目录
        // `--bundle`参数如果为空，工作目录为当前目录，否则切换工作目录
        bundle := context.String("bundle")
        if bundle != "" {
            if err := os.Chdir(bundle); err != nil {
                return err
            }
        }

        // 5. 检查工作目录下是否有config.json的容器配置文件， 如果有的话会提示，需要手动删除该文件。
        if err := checkNoFile(specConfig); err != nil {
            return err
        }

        // 6. 生成配置文件config.json
        // 写入json格式的容器配置到工作目录下的config.json
        data, err := json.MarshalIndent(spec, "", "\t")
        if err != nil {
            return err
        }
        if err := ioutil.WriteFile(specConfig, data, 0666); err != nil {
            return err
        }
        return nil
}