Forking OpenFaaS Faasd to support Firecracker ContainerdPublished on Jun 10, 2024Updated on Jun 10, 2024Read on dev.to

Whilst Firecracker containerd support for K8s is not ready to be used with OpenFaaS K8s provider, we might be able to utilise it for OpenFaas faasd. This article covers my experience on extending OpenFaas faasd to run with Firecracker-containerd.

containerfirecrackerserverlessopenfaas

Why you would need to do that?

Prerequisites

• make all to get firecracker-ctr, firecracker-containerd, and containerd-shim-v2-firecracker.
• make firecracker to get the Firecracker binary
• make image to get the rootfs

Extending faasd to firecracker-containerd

func ReadFromEnv(hasEnv types.HasEnv) (*types.FaaSConfig, *ProviderConfig, error) {
	//
	// ... rest of the code is untouched
	//
	providerConfig := &ProviderConfig{
		Sock: types.ParseString(hasEnv.Getenv("sock"), "/run/firecracker-containerd/containerd.sock"),
	}
	return config, providerConfig, nil
}

func runProviderE(cmd *cobra.Command, _ []string) error {
	//
	// ... rest of the code is untouched
	//
	client, err := containerd.New(
		providerConfig.Sock,
		containerd.WithDefaultRuntime("aws.firecracker"),
	)
	//
	// ... 
	//
}

Changes to instance management

$ go get github.com/firecracker-microvm/firecracker-containerd/

import (
	// ... other imports
	"github.com/firecracker-microvm/firecracker-containerd/runtime/firecrackeroci"
)

func deploy(ctx context.Context, req types.FunctionDeployment, client *containerd.Client, cni gocni.CNI, secretMountPath string, alwaysPull bool) error {
	//
	// ... rest of the code is untouched
	//
	copts := []containerd.NewContainerOpts{
		containerd.WithImage(image),
		containerd.WithSnapshotter(snapshotter),
		containerd.WithNewSnapshot(name+"-snapshot", image),
		containerd.WithNewSpec(
			oci.WithImageConfig(image),
			oci.WithCapabilities([]string{"CAP_NET_RAW"}),
			// oci.WithMounts(mounts),
			oci.WithEnv(envs),
			firecrackeroci.WithVMID(name),
			firecrackeroci.WithVMNetwork,
			withMemory(memory)),
		containerd.WithContainerLabels(labels),
	}
	
	container, err := client.NewContainer(
		ctx,
		name,
		copts...,
	)
	//
	// ...
	//
}

func createTask(ctx context.Context, container containerd.Container, _ gocni.CNI) error {
	name := container.ID()
	task, taskErr := container.NewTask(ctx, cio.LogFile(fmt.Sprintf("/tmp/%s.log", name)))
	if taskErr != nil {
		return fmt.Errorf("unable to start task: %s, error: %w", name, taskErr)
	}
	log.Printf("Container ID: %s\tTask ID %s:\tTask PID: %d\t\n", name, task.ID(), task.Pid())
	_, waitErr := task.Wait(ctx)
	if waitErr != nil {
		return errors.Wrapf(waitErr, "Unable to wait for task to start: %s", name)
	}
	if startErr := task.Start(ctx); startErr != nil {
		return errors.Wrapf(startErr, "Unable to start task: %s", name)
	}
	ip, err := cninetwork.GetIPAddress(name)
	if err != nil {
		return err
	}
	log.Printf("%s has IP: %s.\n", name, ip)
	return nil
}

func Remove(ctx context.Context, client *containerd.Client, name string) error {
	//
	// ...
	//
	} else {
		snapshotter := "devmapper"
		if val, ok := os.LookupEnv("snapshotter"); ok {
			snapshotter = val
		}
		service := client.SnapshotService(snapshotter)
		key := name + "-snapshot"
		if _, err := client.SnapshotService("").Stat(ctx, key); err == nil {
			service.Remove(ctx, key)
		}
	}
	return nil
}

Changes to networking

const (
	// CNIBinDir describes the directory where the CNI binaries are stored
	CNIBinDir = "/opt/cni/bin"
	// CNIConfDir describes the directory where the CNI plugin's configuration is stored
	CNIConfDir = "/etc/cni/conf.d"
	// NetNSPathFmt gives the path to the a process network namespace, given the pid
	NetNSPathFmt = "/proc/%d/ns/net"
	// CNIDataDir is the directory CNI stores allocated IP for containers
	CNIDataDir = "/var/run/cni"
	// defaultCNIConfFilename is the vanity filename of default CNI configuration file
	defaultCNIConfFilename = "fcnet.conflist"
	// This value appears in iptables comments created by CNI.
	defaultNetworkName = "fcnet"
	// defaultSubnet is the default subnet used in the defaultCNIConf -- this value is set to not collide with common container networking subnets:
	defaultSubnet = "10.64.0.0/16"
	// defaultIfPrefix is the interface name to be created in the container
	defaultIfPrefix = "veth"
)

// defaultCNIConf is a CNI configuration that enables network access to containers
var defaultCNIConf = fmt.Sprintf(`
{
    "cniVersion": "0.4.0",
    "name": "%s",
    "plugins": [
      {
        "type": "ptp",
        "ipMasq": true,
        "ipam": {
            "type": "host-local",
            "subnet": "%s",
            "dataDir": "%s",
            "routes": [
                { "dst": "0.0.0.0/0" }
            ]
        }
      },
      {
        "type": "firewall"
      },
	  {
		"type": "tc-redirect-tap"
	  }
    ]
}
`, defaultNetworkName, defaultSubnet, CNIDataDir)

func isCNIResultForContainer(fileName, container string) (bool, error) {
	found := false

	f, err := os.Open(fileName)
	if err != nil {
		return false, fmt.Errorf("failed to open CNI IP file for %s: %v", fileName, err)
	}
	defer f.Close()

	reader := bufio.NewReader(f)
	processLine, _ := reader.ReadString('\n')
	if strings.Contains(processLine, container) {
		ethNameLine, _ := reader.ReadString('\n')
		if strings.Contains(ethNameLine, defaultIfPrefix) {
			found = true
		}
	}

	return found, nil
}

func GetIPAddress(container string) (string, error) {
	CNIDir := path.Join(CNIDataDir, defaultNetworkName)

	files, err := os.ReadDir(CNIDir)
	if err != nil {
		return "", fmt.Errorf("failed to read CNI dir for container %s: %v", container, err)
	}
	for _, file := range files {
		// each fileName is an IP address
		fileName := file.Name()

		resultsFile := filepath.Join(CNIDir, fileName)
		found, err := isCNIResultForPID(resultsFile, container)
		if err != nil {
			return "", err
		}
		if found {
			return fileName, nil
		}
	}
	return "", fmt.Errorf("unable to get IP address for container: %s", container)
}

Changes to conf files

make dist-local

Running It

sudo bin/faasd-fc install

$ faas-cli ls
Function                      	Invocations    	Replicas

$ faas-cli deploy --image=alanjohn/hello-go:latest --name=hello-go --update=false   
Function hello-go already exists, attempting rolling-update.

Deployed. 200 OK.
URL: http://127.0.0.1:8080/function/hello-go

$ curl http://127.0.0.1:8080/function/hello-go
hello, world!
$ faas-cli ls
Function                      	Invocations    	Replicas
hello-go                      	1              	1    

$ faas-cli rm hello-go
Deleting: hello-go.
Removing old function.
$ faas-cli ls         
Function                      	Invocations    	Replicas

Conclusion