Welcome to Quark Container.
This repository is the home of Quark Containers code.
Quark Container is high performance secure container runtime with following features:
- OCI compatible: Quark Container includes an Open Container Initiative (OCI) interface. Common Docker container image can run in Quark Container.
- Secure: It provides Virtual Machine level workload isolation and security.
- High Performance: Quark Container is born for container workload execution with high performance. It is developed with the Rust programming language.
The performance slices is performance.pdf. The detail test steps and result is here
Quark Container takes classic Linux Virtual Machine architecture as below. It includes an HyperVisor named QVisor and a guest kernel named QKernel. Unlike the common Linux Virtual Machine design, in which standard OS image such as Linux/Windows can run on Qumu. QVisor and QKernel are tightly coupled. QVisor only supports QKernel.
Quark Container's high level design is as below. It handles Container Application request with following steps.
- Container Application System Call: In Quark Container, Container Application run as a Guest Application. And it sends request to Quark through Guest System Call, e.g. X86-64 SysCall/SysRet.
- Host System Call: From Host OS perspective, Quark is running as a common Linux application. When Quark gets Guest System Call, it will explained that in the Quark runtime. If it needs to access the host system, e.g. read host file, it will call Host OS through Host System Call.
- QCall: For the communication between Guest Space and Host Space, QKernel doesn't call QVisor through HyperCall directly as common Virtual Machine design. Instead, it sends request to QVisor through QCall, which is based on Share memory queue. There is a dedicated QCall handing thread waiting in Host Space to process QCall request. Based on that, VCPU thread's high cost Guest/Host switch is avoid. For the host IO data operation, such as socket read/write, Qkernel will call the Host Kernel direclty with IO-Uring, which could bypass QVisor to achieve better performance. (Note: IO-Uring won't handle IO control operation, such as Open, for security purpose)
- OS: Linux Kernel > 5.8.0
- Processor: X86-64 (Quark only support 64 bit architecture, So far only support Intel CPU)
- Docker: > 17.09.0
Quark builds on X86-64 only. Other architecture will be available in the future.
Quark is developed with Rust language. The build OS needs to install Rust nightly.
git clone [email protected]:QuarkContainer/Quark.git
cd Quark
make
make install
- Install binary: Quark has 2 binaries: "quark" and "qkernel.bin". Both of them was copied to /usr/local/bin/ folder when running
make install
. "quark" contains QVisor code and it also implement the OCI interface. - Setup Docker: To enable Docker to run container with Quark Container, "/etc/docker/daemon.json" needs to be updated. Example is as daemon.json
- Restart Docker: After the "/etc/docker/daemon.json" is updated, The Docker daemon restart is need to enable the configuration change
sudo systemctl restart docker
The helloworld docker sample application can be executed as below:
sudo systemctl restart docker
docker run --rm --runtime=quark hello-world
Quark Container's configuration file is at /etc/quark/config.json. Configuration detail is TBD...
Quark Container's debug log is put in /var/log/quark/quark.log. It could enable or disable by "DebugLevel" of /etc/quark/config.json. There are 5 possible value of "DebugLevel" as below.
Off,
Error,
Warn,
Info,
Debug,
Trace,
When log is enabled, e.g. Debug. After run a docker image with Quark Container, the logs will be generated in the /var/log/quark/quark.log. doc