Merge pull request #108 from AkihiroSuda/a

update components; enable slirp4netns-sandbox

Dockerfile

@@ -4,22 +4,22 @@
 ### Version definitions
 # use ./hack/show-latest-commits.sh to get the latest commits
 
-# 2019-07-21T16:46:59Z
-ARG ROOTLESSKIT_COMMIT=2cb5ec5819fddecb93aeea843ecdf29d6ecaf9af
-# 2019-07-23T12:05:26Z
-ARG SLIRP4NETNS_COMMIT=62cbdd3369dde25e3d1a952fb61072e650893899
-# 2019-06-26T16:58:14Z
-ARG RUNC_COMMIT=6cccc1760d57d9e1bc856b96eeb7ee02b7b8101d
-# 2019-07-23T06:46:12Z
-ARG MOBY_COMMIT=a9dc697fd2a51c1e47a1c5404d2254d5b6318fd4
-# 2019-07-22T23:39:02Z
-ARG CONTAINERD_COMMIT=f7761411b8735d8605378e71f1ad16b759326c1b
-# 2019-07-24T06:55:21Z
-ARG CRIO_COMMIT=3732d1508ae0eb762d81039555c1ce2566acf370
-# 2019-07-18T21:12:53Z
-ARG CNI_PLUGINS_COMMIT=7ba2bcfeab482eaaa7d6e7e4ec9fbd493c54d4fa
-# 2019-07-24T09:02:15Z
-ARG KUBERNETES_COMMIT=da3daf2e8a99bbb9345f1060e8bf4fb4d5772e06
+# 2019-07-28T04:55:48Z
+ARG ROOTLESSKIT_COMMIT=93164c4427c9c75aa3199b8baa5005ce9adfcd69
+# 2019-07-28T04:08:29Z
+ARG SLIRP4NETNS_COMMIT=96ff33cafc1dabf1437b87133850ed2324b2c640
+# 2019-07-27T01:26:32Z
+ARG RUNC_COMMIT=9ae790178ee4535e1afd865eed70a7f7cdb655ac
+# 2019-07-26T23:09:22Z
+ARG MOBY_COMMIT=917a8b42594317e4b547c4d34a6bc733f32a9974
+# 2019-07-26T21:13:02Z
+ARG CONTAINERD_COMMIT=eabb536b1f376a259e3450a9d8f6fc7e6a18367e
+# 2019-07-25T01:24:20Z
+ARG CRIO_COMMIT=b94a84cd6d126b12c837db3650fed546376c1f58
+# 2019-07-24T15:32:15Z
+ARG CNI_PLUGINS_COMMIT=ded2f1757770e8e2aa41f65687f8fc876f83048b
+# 2019-07-27T16:25:56Z
+ARG KUBERNETES_COMMIT=23649560c060ad6cd82da8da42302f8f7e38cf1e
 
 ## Version definitions (cont.)
 ARG DOCKER_CLI_RELEASE=19.03.0
@@ -54,8 +54,8 @@ RUN mkdir /out && \
   go build -o /out/rootlesskit-docker-proxy github.com/rootless-containers/rootlesskit/cmd/rootlesskit-docker-proxy
 
 #### slirp4netns (slirp4netns-build)
-FROM alpine:3.9 AS slirp4netns-build
-RUN apk add --no-cache git build-base autoconf automake libtool linux-headers glib-dev glib-static
+FROM alpine:3.10 AS slirp4netns-build
+RUN apk add --no-cache git build-base autoconf automake libtool linux-headers glib-dev glib-static libcap-static libcap-dev
 RUN git clone https://github.com/rootless-containers/slirp4netns.git /slirp4netns
 WORKDIR /slirp4netns
 ARG SLIRP4NETNS_COMMIT

boot/rootlesskit.sh

@@ -33,7 +33,7 @@ if [[ $_U7S_CHILD == 0 ]]; then
 	# * /opt: copy-up is required for mounting /opt/cni/bin
 	rootlesskit \
 		--state-dir $rk_state_dir \
-		--net=slirp4netns --mtu=65520 --disable-host-loopback \
+		--net=slirp4netns --mtu=65520 --disable-host-loopback --slirp4netns-sandbox=true \
 		--port-driver=builtin \
 		--copy-up=/etc --copy-up=/run --copy-up=/var/lib --copy-up=/opt \
 		--pidns \

src/patches/kubernetes/0001-kubelet-cm-ignore-sysctl-error-when-running-in-usern.patch

@@ -1,4 +1,4 @@
-From d6bb506f28c6e1397ab46174311c070d9eb9acbf Mon Sep 17 00:00:00 2001
+From 446629d78a49ba7f830437cdad46cdc413bfd1d8 Mon Sep 17 00:00:00 2001
 From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 Date: Tue, 21 Aug 2018 16:45:04 +0900
 Subject: [PATCH 1/3] kubelet/cm: ignore sysctl error when running in userns

src/patches/kubernetes/0002-kube-proxy-allow-running-in-userns.patch

@@ -1,4 +1,4 @@
-From e8b684a6ea8326eebef96a5c04c9a8d1ec77c1a4 Mon Sep 17 00:00:00 2001
+From 665f1772f32d9833ac0d08e18f45521269f999e1 Mon Sep 17 00:00:00 2001
 From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 Date: Thu, 23 Aug 2018 14:14:44 +0900
 Subject: [PATCH 2/3] kube-proxy: allow running in userns

src/patches/kubernetes/0003-kubelet-new-feature-gate-SupportNoneCgroupDriver.patch

@@ -1,4 +1,4 @@
-From 0c4b71ba23db9949d7c971cd71cc2fa89046b6f3 Mon Sep 17 00:00:00 2001
+From 33b6ed4c7b6fb424c5ac5972f3a5fb15da027985 Mon Sep 17 00:00:00 2001
 From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 Date: Sun, 2 Jun 2019 18:39:05 +0900
 Subject: [PATCH 3/3] kubelet: new feature gate: SupportNoneCgroupDriver
@@ -38,7 +38,7 @@ index a6c5d1411e..dbdb95db10 100644
  		}
  		if opts.pauseImage != "" {
 diff --git a/cmd/kubelet/app/options/options.go b/cmd/kubelet/app/options/options.go
-index 712760967e..c2134dad39 100644
+index 1a2b3263be..c718050aff 100644
 --- a/cmd/kubelet/app/options/options.go
 +++ b/cmd/kubelet/app/options/options.go
 @@ -513,7 +513,7 @@ func AddKubeletConfigFlags(mainfs *pflag.FlagSet, c *kubeletconfig.KubeletConfig
@@ -51,7 +51,7 @@ index 712760967e..c2134dad39 100644
  	fs.StringVar(&c.CPUManagerPolicy, "cpu-manager-policy", c.CPUManagerPolicy, "CPU Manager policy to use. Possible values: 'none', 'static'. Default: 'none'")
  	fs.DurationVar(&c.CPUManagerReconcilePeriod.Duration, "cpu-manager-reconcile-period", c.CPUManagerReconcilePeriod.Duration, "<Warning: Alpha feature> CPU Manager reconciliation period. Examples: '10s', or '1m'. If not supplied, defaults to `NodeStatusUpdateFrequency`")
 diff --git a/cmd/kubelet/app/server.go b/cmd/kubelet/app/server.go
-index 1f357a4ad9..4ea181d0f6 100644
+index 207893d8be..e83ab11616 100644
 --- a/cmd/kubelet/app/server.go
 +++ b/cmd/kubelet/app/server.go
 @@ -605,26 +605,28 @@ func run(s *options.KubeletServer, kubeDeps *kubelet.Dependencies, stopCh <-chan
@@ -134,7 +134,7 @@ index 7ee1c8b195..36522ff9be 100644
  	// inherited features from generic apiserver, relisted here to get a conflict if it is changed
  	// unintentionally on either side:
 diff --git a/pkg/kubelet/apis/config/types.go b/pkg/kubelet/apis/config/types.go
-index 7ff18c62a0..2830249f24 100644
+index bf99db85f0..93408248c2 100644
 --- a/pkg/kubelet/apis/config/types.go
 +++ b/pkg/kubelet/apis/config/types.go
 @@ -198,7 +198,7 @@ type KubeletConfiguration struct {