liquidmetal-dev / liquidmetal-dev/flintlock
Add support for using the Jailer
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 1.5k
- Forks
- 73
- Avg merge
- 17h 24m
- Merged PRs (30d)
- 30
Description
Its recommended that when running Firecracker in production that the [Jailer](https://github.com/firecracker-microvm/firecracker/blob/main/docs/jailer.md) is used instead of Firecracker directly. We need to add support to flintlockd to make this configurable.
As part of this we need to be aware of the [production host recommendations](https://github.com/firecracker-microvm/firecracker/blob/main/docs/prod-host-setup.md) and so we need to use/set:
- netns
- uid/gid
- resource limites
- cgroup
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked Firecracker Jailer and production host recommendation documents, then trace how flintlockd currently launches Firecracker and exposes configuration. Done means Jailer use is configurable and the required netns, uid/gid, resource-limit, and cgroup settings are supported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100