)]}'
{"specs/container-networking.rst":[{"author":{"_account_id":10206,"name":"Madhuri Kumari","email":"madhuri.kumari@intel.com","username":"Madhuri"},"change_message_id":"fa649891412987bbf5b7787c923de68a64d97679","unresolved":false,"context_lines":[{"line_number":42,"context_line":"   After a Zun container attaches to a sandbox, it will have the same"},{"line_number":43,"context_line":"   networking as the sandbox container. For example, it shares the private IP"},{"line_number":44,"context_line":"   address, floating IP address, security groups, etc."},{"line_number":45,"context_line":"3. For docker, use nova-docker to provision a sandbox container. Nova has"},{"line_number":46,"context_line":"   already implemented the logic for providing networking for a Nova instance."},{"line_number":47,"context_line":"   Leverage nova-docker will effectively reuse all the networking"},{"line_number":48,"context_line":"   implementation from Nova."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a89bdaa_42021d0b","line":45,"range":{"start_line":45,"start_character":19,"end_line":45,"end_character":30},"updated":"2016-09-08 09:16:41.000000000","message":"Hongbin, is it intended? Could you please let us know why do we need to leverage nova-docker when it is not maintained anymore?","commit_id":"b8442aa389bd106e7052d8a1a375c805aaa913a1"},{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"2e3bfc8a7e1ff732eba8872e46ec694e61355516","unresolved":false,"context_lines":[{"line_number":42,"context_line":"   After a Zun container attaches to a sandbox, it will have the same"},{"line_number":43,"context_line":"   networking as the sandbox container. For example, it shares the private IP"},{"line_number":44,"context_line":"   address, floating IP address, security groups, etc."},{"line_number":45,"context_line":"3. For docker, use nova-docker to provision a sandbox container. Nova has"},{"line_number":46,"context_line":"   already implemented the logic for providing networking for a Nova instance."},{"line_number":47,"context_line":"   Leverage nova-docker will effectively reuse all the networking"},{"line_number":48,"context_line":"   implementation from Nova."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a89bdaa_420f542e","line":45,"range":{"start_line":45,"start_character":19,"end_line":45,"end_character":30},"in_reply_to":"9a89bdaa_42021d0b","updated":"2016-09-08 20:27:46.000000000","message":"Clarified this in a new version.\n\nWe don\u0027t have to use nova-docker, but it is recommended to use Nova. I spent a lot of time to look into the Nova code. It seems if we don\u0027t reuse Nova, we have to re-implement almost the entire Nova in Zun (the Neutron ports management, IP allocation, the scheduler, resource tracker, availability zone, cells, etc.), which is infeasible.","commit_id":"b8442aa389bd106e7052d8a1a375c805aaa913a1"},{"author":{"_account_id":6348,"name":"xu-haiwei","email":"hai-xu@xr.jp.nec.com","username":"xu-haiwei"},"change_message_id":"bd62799484c5f6134e509f0e2dea8a8e30805d31","unresolved":false,"context_lines":[{"line_number":54,"context_line":"   networking implementation from Nova (i.e. security groups)."},{"line_number":55,"context_line":"5. Zun containers will be managed by Zun as before. After a sandbox is"},{"line_number":56,"context_line":"   provisioned, Zun is responsible to connect a container to the sandbox."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Design Principles"},{"line_number":59,"context_line":"-----------------"},{"line_number":60,"context_line":"1. Use Neutron for container networking."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a89bdaa_08a14246","line":57,"updated":"2016-09-13 09:17:31.000000000","message":"Containers can be started on vms or baremetal, is it different to create the sandbox between them?","commit_id":"118a66a26f8dddda4734d33d0a336cb6c4748178"},{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"942603fe19634e1b3f2f8be7fa85765c20dbe2c7","unresolved":false,"context_lines":[{"line_number":54,"context_line":"   networking implementation from Nova (i.e. security groups)."},{"line_number":55,"context_line":"5. Zun containers will be managed by Zun as before. After a sandbox is"},{"line_number":56,"context_line":"   provisioned, Zun is responsible to connect a container to the sandbox."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Design Principles"},{"line_number":59,"context_line":"-----------------"},{"line_number":60,"context_line":"1. Use Neutron for container networking."}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8ec9b2_123afc36","line":57,"in_reply_to":"9a89bdaa_08a14246","updated":"2016-09-13 18:52:26.000000000","message":"The container runtimes may interpret the sandbox concept differently based on how it operates. So it could be different or same, depending on how the Sandbox driver implements it.","commit_id":"118a66a26f8dddda4734d33d0a336cb6c4748178"}],"specs/container-sandbox.rst":[{"author":{"_account_id":10206,"name":"Madhuri Kumari","email":"madhuri.kumari@intel.com","username":"Madhuri"},"change_message_id":"4112a52046e0b35f36e6ffb4cbaa85553e071ca0","unresolved":false,"context_lines":[{"line_number":41,"context_line":"To provide a full-featured container experience with minimized duplication"},{"line_number":42,"context_line":"with Nova, an approach is to decouple the management of containers (implemented"},{"line_number":43,"context_line":"in Zun) from management of other resources (implemented in Nova). This"},{"line_number":44,"context_line":"motivates the introduction of sandbox that can be implemented as a Nova"},{"line_number":45,"context_line":"instance. As a result, we obtain flexibility to offload complex tasks to Nova."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Proposed change"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a8ec9b2_26e7a8ad","line":45,"range":{"start_line":44,"start_character":67,"end_line":45,"end_character":8},"updated":"2016-09-19 17:58:43.000000000","message":"You mean VM here? In starting I had get an understanding that sandbox will be container. This point confused me. Could you please explain?","commit_id":"113503a2fe2ccf0de2314ebe9f86f02e1b1779bf"},{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"683006efaf70e70819561aed3a33b748f264b27b","unresolved":false,"context_lines":[{"line_number":41,"context_line":"To provide a full-featured container experience with minimized duplication"},{"line_number":42,"context_line":"with Nova, an approach is to decouple the management of containers (implemented"},{"line_number":43,"context_line":"in Zun) from management of other resources (implemented in Nova). This"},{"line_number":44,"context_line":"motivates the introduction of sandbox that can be implemented as a Nova"},{"line_number":45,"context_line":"instance. As a result, we obtain flexibility to offload complex tasks to Nova."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Proposed change"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a8ec9b2_a8029b6d","line":45,"range":{"start_line":44,"start_character":67,"end_line":45,"end_character":8},"in_reply_to":"7a8ec9b2_26e7a8ad","updated":"2016-09-19 23:04:48.000000000","message":"I mean docker container here (a nova instance doesn\u0027t have to be a VM), but agree with you that this might be confusing. Clarify it in a new patchset.","commit_id":"113503a2fe2ccf0de2314ebe9f86f02e1b1779bf"},{"author":{"_account_id":10206,"name":"Madhuri Kumari","email":"madhuri.kumari@intel.com","username":"Madhuri"},"change_message_id":"4112a52046e0b35f36e6ffb4cbaa85553e071ca0","unresolved":false,"context_lines":[{"line_number":66,"context_line":"   own drivers if they are not statisfied by the built-in sandbox"},{"line_number":67,"context_line":"   implementation(s)."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"The diagram below offers an overview of the system architecture. The Zun"},{"line_number":70,"context_line":"service may communicate with Nova to create Nova instances that are used as"},{"line_number":71,"context_line":"sandboxes. Like a normal Nova instance, A sandbox is scheduled by Nova"},{"line_number":72,"context_line":"scheduler and have Neutron ports attached for providing networking."},{"line_number":73,"context_line":"Containers are created by Zun, and run inside the namespaces of sandboxes."},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a8ec9b2_e648608d","line":71,"range":{"start_line":69,"start_character":65,"end_line":71,"end_character":9},"updated":"2016-09-19 17:58:43.000000000","message":"Does this mean one VM will be created per container?","commit_id":"113503a2fe2ccf0de2314ebe9f86f02e1b1779bf"},{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"683006efaf70e70819561aed3a33b748f264b27b","unresolved":false,"context_lines":[{"line_number":66,"context_line":"   own drivers if they are not statisfied by the built-in sandbox"},{"line_number":67,"context_line":"   implementation(s)."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"The diagram below offers an overview of the system architecture. The Zun"},{"line_number":70,"context_line":"service may communicate with Nova to create Nova instances that are used as"},{"line_number":71,"context_line":"sandboxes. Like a normal Nova instance, A sandbox is scheduled by Nova"},{"line_number":72,"context_line":"scheduler and have Neutron ports attached for providing networking."},{"line_number":73,"context_line":"Containers are created by Zun, and run inside the namespaces of sandboxes."},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a8ec9b2_08f2af9a","line":71,"range":{"start_line":69,"start_character":65,"end_line":71,"end_character":9},"in_reply_to":"7a8ec9b2_e648608d","updated":"2016-09-19 23:04:48.000000000","message":"No, one docker container will be created per container.","commit_id":"113503a2fe2ccf0de2314ebe9f86f02e1b1779bf"},{"author":{"_account_id":9775,"name":"Sudipta Biswas","email":"sbiswas7@in.ibm.com","username":"sudswas"},"change_message_id":"6df6d4d61fabbee582e5d3db076f44130d654a6f","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Zun needs to manage containers as well as their associated IaaS resources,"},{"line_number":15,"context_line":"such as IP addresses, security groups, ports, volumes, etc.. To decouple the"},{"line_number":16,"context_line":"management of containers from their associated resources, we proposed to"},{"line_number":17,"context_line":"introduce a new concept called ``sandbox``."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"A sandbox represents an isolated environment for one or multiple containers."}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a8bc5a2_87cd1c68","line":16,"updated":"2016-09-27 04:21:22.000000000","message":"The very essence of having an IP address for a container - makes me think like a VM. However, containers aren\u0027t like VMs - so when we talk about security groups in particular - what do we mean? A container is not supposed to expose a port without let\u0027s say the EXPOSE clause in a DOCKERFILE.\n\nAlso - when we talk about IP addresses, what are they used for? Exposing services? Is this beyond what the host can expose via it\u0027s port?\n\nI think - i will work with you in defining what use case we want to put forward for this.","commit_id":"19e3d9ce434c3e0b6c0d9deae3462ecf9a8213ea"},{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"fb0538a3259ed0097ffc43ea4b96e8b1e7e3a4d1","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Zun needs to manage containers as well as their associated IaaS resources,"},{"line_number":15,"context_line":"such as IP addresses, security groups, ports, volumes, etc.. To decouple the"},{"line_number":16,"context_line":"management of containers from their associated resources, we proposed to"},{"line_number":17,"context_line":"introduce a new concept called ``sandbox``."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"A sandbox represents an isolated environment for one or multiple containers."}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a8bc5a2_a684ba5d","line":16,"in_reply_to":"5a8bc5a2_87cd1c68","updated":"2016-09-27 15:28:29.000000000","message":"I think the major enabling use case is communication between containers in different hosts. For example, you have container A running in host A and container B running in host B. Assigning each container an IP address will allow container A to ping container B.\n\nArguable, as you said, an alternative approach is to enable port-mapping from containers to hosts. Then, container A needs to communicate with container B via a port in host B (assuming using -P option). Then, if the container B is die and re-created, it might be assigned to a different port. Then, the communication channel breaks or need re-configuration. There are other cons of the port-mapping approach. For example, how to isolate traffic from different tenants.\n\nI think the argument of IP address VS port-mapping is a typical overlay network vs ports management. Assigning each container an IP address is what the major overlay network solution is doing (i.e. flannel). The overlay network allows containers in different hosts to communicate with each other without be affecting by the underlying infrastructure. The con is performance penalty of double encapsulation.\n\nIn Zun (or Kuryr), it is basically trying to address the performance issue of overlay network, by directly connecting containers to Neutron. I think here is the enabling use cases:\n* Allow containers in different hosts to communicate independent of underlying infrastructure. As a result, users can pre-assign IP addresses for containers.\n* Allow containers/VMs/BMs in the same neutron network.","commit_id":"19e3d9ce434c3e0b6c0d9deae3462ecf9a8213ea"},{"author":{"_account_id":9775,"name":"Sudipta Biswas","email":"sbiswas7@in.ibm.com","username":"sudswas"},"change_message_id":"6df6d4d61fabbee582e5d3db076f44130d654a6f","unresolved":false,"context_lines":[{"line_number":16,"context_line":"management of containers from their associated resources, we proposed to"},{"line_number":17,"context_line":"introduce a new concept called ``sandbox``."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"A sandbox represents an isolated environment for one or multiple containers."},{"line_number":20,"context_line":"The primary responsibility of sandbox is to provision and manage IaaS"},{"line_number":21,"context_line":"resources associated with a container or a group of containers. In this model,"},{"line_number":22,"context_line":"each container must have a sandbox, and resources (i.e. Neutron ports) are"}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a8bc5a2_a7cf7854","line":19,"updated":"2016-09-27 04:21:22.000000000","message":"Exactly - so are we already talking about container orchestration here?\nBefore we go there, we may have to also sort out how we want to represent docker networking to the user? \n\nFor example, with every container created, docker would put that on docker0 bridge. https://docs.docker.com/engine/userguide/networking/\n\nSo that port is completely out of scope from zun. How do we take this into account or do we really have to take it into account?","commit_id":"19e3d9ce434c3e0b6c0d9deae3462ecf9a8213ea"},{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"fb0538a3259ed0097ffc43ea4b96e8b1e7e3a4d1","unresolved":false,"context_lines":[{"line_number":16,"context_line":"management of containers from their associated resources, we proposed to"},{"line_number":17,"context_line":"introduce a new concept called ``sandbox``."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"A sandbox represents an isolated environment for one or multiple containers."},{"line_number":20,"context_line":"The primary responsibility of sandbox is to provision and manage IaaS"},{"line_number":21,"context_line":"resources associated with a container or a group of containers. In this model,"},{"line_number":22,"context_line":"each container must have a sandbox, and resources (i.e. Neutron ports) are"}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a8bc5a2_c61d4674","line":19,"in_reply_to":"5a8bc5a2_a7cf7854","updated":"2016-09-27 15:28:29.000000000","message":"Re. how to represent docker networking to users. I think there are several options:\n1. port-mapping:\n  $ zun run -p8080:80 ...\n2. create from network:\n  $ neutron network-create mynet ...\n  $ zun run --network\u003dmynet busybox\n3. create from network with a fixed IP address\n  $ zun run --network network_name\u003dmynet,ip\u003d10.0.0.4 ...\n4. create from neutron ports\n  $ zun run --network port\u003dneutronport ...\n\nI don\u0027t have strong opinions in any of the options above. Maybe, we could support them all.\n\nRe. docker0 bridge. I am not sure. In nova-docker, it doesn\u0027t seem to use that bridge (it disable the raw docker network by passing \"--net\u003dnone\"). Do you have any suggestions to deal with that bridge?","commit_id":"19e3d9ce434c3e0b6c0d9deae3462ecf9a8213ea"},{"author":{"_account_id":9775,"name":"Sudipta Biswas","email":"sbiswas7@in.ibm.com","username":"sudswas"},"change_message_id":"6df6d4d61fabbee582e5d3db076f44130d654a6f","unresolved":false,"context_lines":[{"line_number":27,"context_line":"For docker driver, sandbox can be implemented by using docker container itself."},{"line_number":28,"context_line":"In this case, creating a container in Zun might create two docker containers"},{"line_number":29,"context_line":"internally: a sandbox container and a \u0027real\u0027 container. The real container"},{"line_number":30,"context_line":"might use the sandbox container as a proxy for networking, storage, or others."},{"line_number":31,"context_line":"Alternatively, users might create a container in an existing sandbox if they"},{"line_number":32,"context_line":"don\u0027t want to create an extra sandbox."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a8bc5a2_c74804cf","line":30,"updated":"2016-09-27 04:21:22.000000000","message":"The container won\u0027t really use the network for storage - the host would i suppose? With the docker0 and the NAT interface inside the container - it would still be able to ping let\u0027s say \"google.com\". We should probably NEVER have a use case of \u0027login\u0027 in case of a container. These are meant to immutable entities anyway.","commit_id":"19e3d9ce434c3e0b6c0d9deae3462ecf9a8213ea"},{"author":{"_account_id":12407,"name":"Shubham Kumar Sharma","email":"shubham.git@gmail.com","username":"shubham.git"},"change_message_id":"8b7ea1b2bce9657eb9963bf5a4fc5b43d6cc2855","unresolved":false,"context_lines":[{"line_number":29,"context_line":"internally: a sandbox container and a \u0027real\u0027 container. The real container"},{"line_number":30,"context_line":"might use the sandbox container as a proxy for networking, storage, or others."},{"line_number":31,"context_line":"Alternatively, users might create a container in an existing sandbox if they"},{"line_number":32,"context_line":"don\u0027t want to create an extra sandbox."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Problem description"},{"line_number":35,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a8bc5a2_b277389e","line":32,"updated":"2016-09-23 11:29:00.000000000","message":"This seems a good enhancement over previous approach. +1.\n\nWhat will be the default policy for zun ? one sandbox container for one \"zun create\" or accommodate each new container from \"zun create\" in existing sandbox unless explicitly specified the user . I think later is better.","commit_id":"19e3d9ce434c3e0b6c0d9deae3462ecf9a8213ea"},{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"0c76bc5e54e96afa6ff3b73f22f5463233c9bf82","unresolved":false,"context_lines":[{"line_number":29,"context_line":"internally: a sandbox container and a \u0027real\u0027 container. The real container"},{"line_number":30,"context_line":"might use the sandbox container as a proxy for networking, storage, or others."},{"line_number":31,"context_line":"Alternatively, users might create a container in an existing sandbox if they"},{"line_number":32,"context_line":"don\u0027t want to create an extra sandbox."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Problem description"},{"line_number":35,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a8bc5a2_c8ffa365","line":32,"in_reply_to":"5a8bc5a2_b277389e","updated":"2016-09-23 15:54:35.000000000","message":"Personally, I lean to one sandbox per container as the default because the following reasons:\n* Containers in the same sandbox will share the ports, which might cause a port conflict. For example, if two containers listen to port 80, one of them will fail.\n* Containers in the same sandbox will share the ipc namespace.\n* Containers in the same sandbox will share the volumes. For example, one container write to a volume, another container can read it.\n\nFor these reasons, it is not a good idea to accommodate container to existing sandbox by default. If users want to put two containers into one sandbox, they must know what they are doing and the security implications.","commit_id":"19e3d9ce434c3e0b6c0d9deae3462ecf9a8213ea"},{"author":{"_account_id":11034,"name":"Yanyan Hu","email":"huyanyan84@gmail.com","username":"yanyanhu"},"change_message_id":"c0fcdd6c62b45ed6e83295fcae8d2cbf755638ff","unresolved":false,"context_lines":[{"line_number":29,"context_line":"internally: a sandbox container and a \u0027real\u0027 container. The real container"},{"line_number":30,"context_line":"might use the sandbox container as a proxy for networking, storage, or others."},{"line_number":31,"context_line":"Alternatively, users might create a container in an existing sandbox if they"},{"line_number":32,"context_line":"don\u0027t want to create an extra sandbox."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Problem description"},{"line_number":35,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a8bc5a2_d6619cd4","line":32,"in_reply_to":"5a8bc5a2_c8ffa365","updated":"2016-09-27 02:08:44.000000000","message":"Agree with Hongbin. For bonding multiple containers to the same \u0027sandbox\u0027 means their will share resources like network, storage, etc., we\u0027d better ask users to specify that requirement explicitly when they request to create new container(s).","commit_id":"19e3d9ce434c3e0b6c0d9deae3462ecf9a8213ea"},{"author":{"_account_id":11034,"name":"Yanyan Hu","email":"huyanyan84@gmail.com","username":"yanyanhu"},"change_message_id":"c0fcdd6c62b45ed6e83295fcae8d2cbf755638ff","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Proposed change"},{"line_number":51,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":52,"context_line":"1. Introduce a new abstraction called ``sandbox``. Sandbox represents an"},{"line_number":53,"context_line":"   isolated environment for one or multiple containers. All drivers are"},{"line_number":54,"context_line":"   required to implement the sandbox abstraction with business logic to create"},{"line_number":55,"context_line":"   and manage the isolated environment. For Linux container, an isolated"}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a8bc5a2_56fd8c6c","line":52,"updated":"2016-09-27 02:08:44.000000000","message":"\u0027sandbox\u0027 will be helpful to help us build conception like \u0027pod\u0027 in future.","commit_id":"19e3d9ce434c3e0b6c0d9deae3462ecf9a8213ea"},{"author":{"_account_id":13248,"name":"Wenzhi Yu","email":"wenzhi_yu@163.com","username":"yuywz"},"change_message_id":"f5e3faa44c6c9c427b5a398ff10bda19b6dc0d26","unresolved":false,"context_lines":[{"line_number":58,"context_line":"2. For docker container, its sandbox could be implemented by using docker"},{"line_number":59,"context_line":"   container itself. The sandbox container might not do anything real, but"},{"line_number":60,"context_line":"   has one or multiple Neutron ports (or other resources) attached."},{"line_number":61,"context_line":"   The sandbox container is provisioned and managed by Nova (with a"},{"line_number":62,"context_line":"   Zun-provided docker virt-driver). After the sandbox container is created,"},{"line_number":63,"context_line":"   the real container can be created with the options"},{"line_number":64,"context_line":"   ``--net\u003dcontainer:\u003csandbox\u003e``, ``--ipc\u003dcontainer:\u003csandbox\u003e``,"},{"line_number":65,"context_line":"   ``--pid\u003dcontainer:\u003csandbox\u003e`` and/or ``--volumes-from\u003d\u003csandbox\u003e``."}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a8bc5a2_5ebc03dc","line":62,"range":{"start_line":61,"start_character":3,"end_line":62,"end_character":36},"updated":"2016-09-26 05:30:49.000000000","message":"This approach (use Nova to provision/manage sandbox container) will save a lot of code copying from Nova by reuse networking code in Nova.\n\nHowever, a side effect is that it will make Zun closely coupled with Nova, I think it\u0027s acceptable for now. But in the future, we may want to decouple from Nova. So we\u0027d better make the decouple work easier in the very beginning.","commit_id":"19e3d9ce434c3e0b6c0d9deae3462ecf9a8213ea"},{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"8853f2575a4647e70faa6a37e92396431b9c2a16","unresolved":false,"context_lines":[{"line_number":58,"context_line":"2. For docker container, its sandbox could be implemented by using docker"},{"line_number":59,"context_line":"   container itself. The sandbox container might not do anything real, but"},{"line_number":60,"context_line":"   has one or multiple Neutron ports (or other resources) attached."},{"line_number":61,"context_line":"   The sandbox container is provisioned and managed by Nova (with a"},{"line_number":62,"context_line":"   Zun-provided docker virt-driver). After the sandbox container is created,"},{"line_number":63,"context_line":"   the real container can be created with the options"},{"line_number":64,"context_line":"   ``--net\u003dcontainer:\u003csandbox\u003e``, ``--ipc\u003dcontainer:\u003csandbox\u003e``,"},{"line_number":65,"context_line":"   ``--pid\u003dcontainer:\u003csandbox\u003e`` and/or ``--volumes-from\u003d\u003csandbox\u003e``."}],"source_content_type":"text/x-rst","patch_set":10,"id":"5a8bc5a2_bfbc0507","line":62,"range":{"start_line":61,"start_character":3,"end_line":62,"end_character":36},"in_reply_to":"5a8bc5a2_5ebc03dc","updated":"2016-09-26 15:14:54.000000000","message":"Agree. In the future, we might implement a second driver to implement the sandbox interface. That driver possibly won\u0027t depend on Nova. That means the \"core\" of Zun needs be generic and extensible.","commit_id":"19e3d9ce434c3e0b6c0d9deae3462ecf9a8213ea"}]}