1
minirunc/
2
├── main.go           # CLI 入口
3
├── bundle.go         # OCI Bundle 解析
4
├── namespace.go      # Namespace 管理
5
├── cgroup.go         # Cgroup v2 管理
6
├── overlay.go        # OverlayFS 管理
7
├── security.go       # 安全配置
8
├── init.go           # 容器初始化
9
├── container.go      # 容器状态管理
10
└── go.mod

1
// bundle.go - OCI Bundle 解析
2
package main
3

4
import (
5
    "encoding/json"
6
    "fmt"
7
    "os"
8
    "path/filepath"
9

10
    specs "github.com/opencontainers/runtime-spec/specs-go"
11
)
12

13
type Bundle struct {
14
    Path string
15
    Spec *specs.Spec
16
}
17

18
func LoadBundle(bundlePath string) (*Bundle, error) {
19
    configPath := filepath.Join(bundlePath, "config.json")
20
    data, err := os.ReadFile(configPath)
21
    if err != nil {
22
        return nil, fmt.Errorf("read config.json: %w", err)
23
    }
24

25
    var spec specs.Spec
26
    if err := json.Unmarshal(data, &spec); err != nil {
27
        return nil, fmt.Errorf("parse config.json: %w", err)
28
    }
29

30
    return &Bundle{
31
        Path: bundlePath,
32
        Spec: &spec,
33
    }, nil
34
}
35

36
func (b *Bundle) RootfsPath() string {
37
    if filepath.IsAbs(b.Spec.Root.Path) {
38
        return b.Spec.Root.Path
39
    }
40
    return filepath.Join(b.Path, b.Spec.Root.Path)
41
}

1
// cgroup.go - Cgroup v2 管理
2
package main
3

4
import (
5
    "fmt"
6
    "os"
7
    "path/filepath"
8
    "strconv"
9

10
    specs "github.com/opencontainers/runtime-spec/specs-go"
11
)
12

13
const cgroupRoot = "/sys/fs/cgroup"
14

15
type CgroupManager struct {
16
    Path string
17
}
18

19
func NewCgroupManager(cgroupPath string) *CgroupManager {
20
    return &CgroupManager{
21
        Path: filepath.Join(cgroupRoot, cgroupPath),
22
    }
23
}
24

25
func (m *CgroupManager) Apply(pid int, resources *specs.LinuxResources) error {
26
    // 1. 创建 cgroup 目录
27
    if err := os.MkdirAll(m.Path, 0755); err != nil {
28
        return fmt.Errorf("create cgroup dir: %w", err)
29
    }
30

31
    // 2. 将进程加入 cgroup
32
    if err := os.WriteFile(
33
        filepath.Join(m.Path, "cgroup.procs"),
34
        []byte(strconv.Itoa(pid)),
35
        0644,
36
    ); err != nil {
37
        return fmt.Errorf("add process to cgroup: %w", err)
38
    }
39

40
    // 3. 设置资源限制
41
    if resources != nil {
42
        if err := m.setMemory(resources.Memory); err != nil {
43
            return err
44
        }
45
        if err := m.setCPU(resources.CPU); err != nil {
46
            return err
47
        }
48
        if err := m.setPids(resources.Pids); err != nil {
49
            return err
50
        }
51
    }
52

53
    return nil
54
}
55

56
func (m *CgroupManager) setMemory(mem *specs.LinuxMemory) error {
57
    if mem == nil || mem.Limit == nil {
58
        return nil
59
    }
60
    return os.WriteFile(
61
        filepath.Join(m.Path, "memory.max"),
62
        []byte(strconv.FormatInt(*mem.Limit, 10)),
63
        0644,
64
    )
65
}
66

67
func (m *CgroupManager) setCPU(cpu *specs.LinuxCPU) error {
68
    if cpu == nil {
69
        return nil
70
    }
71
    if cpu.Quota != nil && cpu.Period != nil {
72
        content := fmt.Sprintf("%d %d", *cpu.Quota, *cpu.Period)
73
        if err := os.WriteFile(
74
            filepath.Join(m.Path, "cpu.max"),
75
            []byte(content),
76
            0644,
77
        ); err != nil {
78
            return err
79
        }
80
    }
81
    return nil
82
}
83

84
func (m *CgroupManager) setPids(pids *specs.LinuxPids) error {
85
    if pids == nil {
86
        return nil
87
    }
88
    return os.WriteFile(
89
        filepath.Join(m.Path, "pids.max"),
90
        []byte(strconv.FormatInt(pids.Limit, 10)),
91
        0644,
92
    )
93
}
94

95
func (m *CgroupManager) Destroy() error {
96
    return os.RemoveAll(m.Path)
97
}

1
// overlay.go - OverlayFS 管理
2
package main
3

4
import (
5
    "fmt"
6
    "os"
7
    "path/filepath"
8
    "strings"
9
    "syscall"
10
)
11

12
type OverlayConfig struct {
13
    LowerDirs []string
14
    UpperDir  string
15
    WorkDir   string
16
    MergedDir string
17
}
18

19
func NewOverlayConfig(bundlePath, rootfsPath string) *OverlayConfig {
20
    overlayDir := filepath.Join(bundlePath, "overlay")
21
    return &OverlayConfig{
22
        LowerDirs: []string{rootfsPath},
23
        UpperDir:  filepath.Join(overlayDir, "upper"),
24
        WorkDir:   filepath.Join(overlayDir, "work"),
25
        MergedDir: filepath.Join(overlayDir, "merged"),
26
    }
27
}
28

29
func (c *OverlayConfig) Mount() error {
30
    // 创建目录
31
    for _, dir := range []string{c.UpperDir, c.WorkDir, c.MergedDir} {
32
        if err := os.MkdirAll(dir, 0755); err != nil {
33
            return fmt.Errorf("create overlay dir %s: %w", dir, err)
34
        }
35
    }
36

37
    // 构建 mount 选项
38
    options := fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s",
39
        strings.Join(c.LowerDirs, ":"),
40
        c.UpperDir,
41
        c.WorkDir,
42
    )
43

44
    // 挂载 OverlayFS
45
    if err := syscall.Mount("overlay", c.MergedDir, "overlay", 0, options); err != nil {
46
        return fmt.Errorf("mount overlay: %w", err)
47
    }
48

49
    return nil
50
}
51

52
func (c *OverlayConfig) Unmount() error {
53
    return syscall.Unmount(c.MergedDir, 0)
54
}

1
// init.go - 容器初始化
2
package main
3

4
import (
5
    "os"
6
    "syscall"
7

8
    specs "github.com/opencontainers/runtime-spec/specs-go"
9
)
10

11
func containerInit(spec *specs.Spec, rootfs string) error {
12
    // 1. 设置 hostname
13
    if spec.Hostname != "" {
14
        if err := syscall.Sethostname([]byte(spec.Hostname)); err != nil {
15
            return err
16
        }
17
    }
18

19
    // 2. 挂载 proc
20
    if err := syscall.Mount("proc", "/proc", "proc", 0, ""); err != nil {
21
        return err
22
    }
23

24
    // 3. 挂载 sysfs
25
    if err := syscall.Mount("sysfs", "/sys", "sysfs", syscall.MS_RDONLY, ""); err != nil {
26
        return err
27
    }
28

29
    // 4. 挂载 devtmpfs
30
    if err := syscall.Mount("devtmpfs", "/dev", "devtmpfs", 0, ""); err != nil {
31
        return err
32
    }
33

34
    // 5. pivot_root 切换根文件系统
35
    if err := pivotRoot(rootfs); err != nil {
36
        return err
37
    }
38

39
    // 6. 设置工作目录
40
    if spec.Process.Cwd != "" {
41
        if err := syscall.Chdir(spec.Process.Cwd); err != nil {
42
            return err
43
        }
44
    }
45

46
    // 7. 设置环境变量
47
    for _, env := range spec.Process.Env {
48
        // 解析 KEY=VALUE 格式
49
        for i := 0; i < len(env); i++ {
50
            if env[i] == '=' {
51
                os.Setenv(env[:i], env[i+1:])
52
                break
53
            }
54
        }
55
    }
56

57
    // 8. 执行用户命令
58
    return syscall.Exec(spec.Process.Args[0], spec.Process.Args, os.Environ())
59
}
60

61
func pivotRoot(rootfs string) error {
62
    // 绑定挂载 rootfs 到自身
63
    if err := syscall.Mount(rootfs, rootfs, "", syscall.MS_BIND, ""); err != nil {
64
        return err
65
    }
66

67
    // 创建 put_old 目录
68
    putOld := rootfs + "/.pivot_root"
69
    if err := os.MkdirAll(putOld, 0755); err != nil {
70
        return err
71
    }
72

73
    // 执行 pivot_root
74
    if err := syscall.PivotRoot(rootfs, putOld); err != nil {
75
        return err
76
    }
77

78
    // 修正工作目录
79
    if err := syscall.Chdir("/"); err != nil {
80
        return err
81
    }
82

83
    // 卸载旧根
84
    if err := syscall.Unmount(".pivot_root", syscall.MNT_DETACH); err != nil {
85
        return err
86
    }
87

88
    return os.Remove(".pivot_root")
89
}

1
// container.go - 容器生命周期管理
2
package main
3
import (
4
    "encoding/json"
5
    "fmt"
6
    "os"
7
    "os/exec"
8
    "path/filepath"
9
    "syscall"
10
    specs "github.com/opencontainers/runtime-spec/specs-go"
11
)
12
type Container struct {
13
    ID      string
14
    Bundle  *Bundle
15
    PID     int
16
    Status  string
17
    Cgroup  *CgroupManager
18
    Overlay *OverlayConfig
19
}
20
func CreateContainer(id, bundlePath string) (*Container, error) {
21
    // 1. 加载 OCI Bundle
22
    bundle, err := LoadBundle(bundlePath)
23
    if err != nil {
24
        return nil, err
25
    }
26
    // 2. 准备 OverlayFS
27
    overlay := NewOverlayConfig(bundlePath, bundle.RootfsPath())
28
    if err := overlay.Mount(); err != nil {
29
        return nil, fmt.Errorf("mount overlay: %w", err)
30
    }
31
    // 3. 创建容器对象
32
    c := &Container{
33
        ID:      id,
34
        Bundle:  bundle,
35
        Status:  "created",
36
        Overlay: overlay,
37
    }
38
    // 4. 保存容器状态
39
    if err := c.saveState(); err != nil {
40
        return nil, err
41
    }
42
    return c, nil
43
}
44
func (c *Container) Start() error {
45
    spec := c.Bundle.Spec
46
    // 1. 创建子进程（新 Namespace）
47
    cmd := exec.Command("/proc/self/exe", "init", c.ID)
48
    cmd.Stdin = os.Stdin
49
    cmd.Stdout = os.Stdout
50
    cmd.Stderr = os.Stderr
51
    cmd.SysProcAttr = &syscall.SysProcAttr{
52
        Cloneflags: getCloneFlags(spec.Linux.Namespaces),
53
    }
54
    if err := cmd.Start(); err != nil {
55
        return fmt.Errorf("start container process: %w", err)
56
    }
57
    c.PID = cmd.Process.Pid
58
    c.Status = "running"
59
    // 2. 配置 Cgroup
60
    cgroupPath := fmt.Sprintf("minirunc/%s", c.ID)
61
    c.Cgroup = NewCgroupManager(cgroupPath)
62
    if err := c.Cgroup.Apply(c.PID, spec.Linux.Resources); err != nil {
63
        return fmt.Errorf("apply cgroup: %w", err)
64
    }
65
    // 3. 保存状态
66
    if err := c.saveState(); err != nil {
67
        return err
68
    }
69
    // 4. 等待容器退出
70
    go func() {
71
        cmd.Process.Wait()
72
        c.Status = "stopped"
73
        c.saveState()
74
    }()
75
    return nil
76
}
77
func (c *Container) Kill(signal syscall.Signal) error {
78
    if c.PID == 0 {
79
        return fmt.Errorf("container not running")
80
    }
81
    return syscall.Kill(c.PID, signal)
82
}
83
func (c *Container) Delete() error {
84
    if c.Cgroup != nil {
85
        c.Cgroup.Destroy()
86
    }
87
    if c.Overlay != nil {
88
        c.Overlay.Unmount()
89
    }
90
    stateDir := filepath.Join("/var/run/minirunc", c.ID)
91
    return os.RemoveAll(stateDir)
92
}
93
func (c *Container) saveState() error {
94
    stateDir := filepath.Join("/var/run/minirunc", c.ID)
95
    if err := os.MkdirAll(stateDir, 0755); err != nil {
96
        return err
97
    }
98
    data, _ := json.Marshal(c)
99
    return os.WriteFile(filepath.Join(stateDir, "state.json"), data, 0644)
100
}

1
// main.go - CLI 入口
2
package main
3
import (
4
    "fmt"
5
    "os"
6
    "syscall"
7
)
8
func main() {
9
    if len(os.Args) < 2 {
10
        printUsage()
11
        os.Exit(1)
12
    }
13
    switch os.Args[1] {
14
    case "run":
15
        if err := runCommand(); err != nil {
16
            fmt.Fprintf(os.Stderr, "Error: %v\n", err)
17
            os.Exit(1)
18
        }
19
    case "init":
20
        if err := initCommand(); err != nil {
21
            fmt.Fprintf(os.Stderr, "Init error: %v\n", err)
22
            os.Exit(1)
23
        }
24
    case "kill":
25
        if err := killCommand(); err != nil {
26
            fmt.Fprintf(os.Stderr, "Error: %v\n", err)
27
            os.Exit(1)
28
        }
29
    case "delete":
30
        if err := deleteCommand(); err != nil {
31
            fmt.Fprintf(os.Stderr, "Error: %v\n", err)
32
            os.Exit(1)
33
        }
34
    default:
35
        printUsage()
36
        os.Exit(1)
37
    }
38
}
39
func runCommand() error {
40
    if len(os.Args) < 4 {
41
        return fmt.Errorf("usage: minirunc run <bundle> <id>")
42
    }
43
    bundlePath := os.Args[2]
44
    id := os.Args[3]
45
    c, err := CreateContainer(id, bundlePath)
46
    if err != nil {
47
        return err
48
    }
49
    return c.Start()
50
}
51
func initCommand() error {
52
    if len(os.Args) < 3 {
53
        return fmt.Errorf("usage: minirunc init <id>")
54
    }
55
    id := os.Args[2]
56
    // 加载容器状态
57
    stateDir := filepath.Join("/var/run/minirunc", id)
58
    data, err := os.ReadFile(filepath.Join(stateDir, "state.json"))
59
    if err != nil {
60
        return err
61
    }
62
    var c Container
63
    if err := json.Unmarshal(data, &c); err != nil {
64
        return err
65
    }
66

67
    // 执行容器初始化
68
    return containerInit(c.Bundle.Spec, c.Overlay.MergedDir)
69
}
70

71
func killCommand() error {
72
    if len(os.Args) < 3 {
73
        return fmt.Errorf("usage: minirunc kill <id>")
74
    }
75
    id := os.Args[2]
76

77
    c, err := loadContainer(id)
78
    if err != nil {
79
        return err
80
    }
81
    return c.Kill(syscall.SIGTERM)
82
}
83

84
func deleteCommand() error {
85
    if len(os.Args) < 3 {
86
        return fmt.Errorf("usage: minirunc delete <id>")
87
    }
88
    id := os.Args[2]
89

90
    c, err := loadContainer(id)
91
    if err != nil {
92
        return err
93
    }
94
    return c.Delete()
95
}
96

97
func printUsage() {
98
    fmt.Println("minirunc - A minimal container runtime")
99
    fmt.Println("")
100
    fmt.Println("Commands:")
101
    fmt.Println("  run <bundle> <id>    Create and start a container")
102
    fmt.Println("  init <id>            Initialize container (internal)")
103
    fmt.Println("  kill <id>            Kill a container")
104
    fmt.Println("  delete <id>          Delete a container")
105
}

1
#!/bin/bash
2

3
mkdir -p minirunc && cd minirunc
4
go mod init minirunc
5
go get github.com/opencontainers/runtime-spec/specs-go
6

7
go build -o minirunc .
8

9
mkdir -p /tmp/test-bundle/rootfs
10
docker export $(docker create busybox) | tar -C /tmp/test-bundle/rootfs -xvf -
11
cd /tmp/test-bundle
12

13
cat > config.json << 'EOF'
14
{
15
  "ociVersion": "1.0.2",
16
  "process": {
17
    "terminal": true,
18
    "user": {"uid": 0, "gid": 0},
19
    "args": ["/bin/sh"],
20
    "env": ["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"],
21
    "cwd": "/"
22
  },
23
  "root": {"path": "rootfs", "readonly": false},
24
  "hostname": "minicontainer",
25
  "linux": {
26
    "namespaces": [
27
      {"type": "pid"},
28
      {"type": "mount"},
29
      {"type": "ipc"},
30
      {"type": "uts"},
31
      {"type": "network"}
32
    ],
33
    "resources": {
34
      "memory": {"limit": 536870912},
35
      "cpu": {"quota": 100000, "period": 100000},
36
      "pids": {"limit": 100}
37
    }
38
  }
39
}
40
EOF
41

42
sudo ./minirunc run /tmp/test-bundle test-container
43

44
hostname
45
# minicontainer
46

47
ps aux
48
# PID   USER     COMMAND
49

50
cat /proc/self/cgroup
51
# 0::/minirunc/test-container
52

53
exit

1
#!/bin/bash
2

3
echo "=== PID Namespace ==="
4
echo "容器内 PID 1 = 容器进程在新 Namespace 中的 PID"
5

6
echo ""
7
echo "=== Mount Namespace ==="
8
echo "容器内的 /proc 是独立的 procfs"
9
echo "容器内的 /sys 是只读的 sysfs"
10

11
echo ""
12
echo "=== UTS Namespace ==="
13
echo "容器内的 hostname = minicontainer"
14
echo "宿主机的 hostname 不受影响"
15

16
echo ""
17
echo "=== Cgroup ==="
18
echo "容器的 Cgroup 路径: /sys/fs/cgroup/minirunc/test-container"
19
cat /sys/fs/cgroup/minirunc/test-container/memory.max
20
# 536870912 (512MB)
21
cat /sys/fs/cgroup/minirunc/test-container/cpu.max
22
# 100000 100000 (1 CPU)
23
cat /sys/fs/cgroup/minirunc/test-container/pids.max
24
# 100