This slides were used to explain the K8s pod sandbox creation process used by Dockershim during the Cloud-Native MX meetup. During this presentation is clarified what Dockershim deprecation means and what are the "pause" containers?

1. Pod Sandbox workflow
creation from Dockershim
Victor Morales

2. Victor Morales
• +15 yrs as a Software Engineer
• .NET, Java, python, Go programmer
• OpenStack, OPNFV, ONAP and CNCF
contributor.
https://about.me/electrocucaracha

3. Goals
• Understand Kubelet workflow
• What does the dockershim deprecation mean?
• What are the pause containers?

4. kubernetes/pkg/kubelet
kubernetes/cmd/kubelet/
kubelet.go
command.Execute()
app/server.go
Run()
kubelet.go
PreInitRuntimeService()
app/server.go
RunKubelet()
Kubelet init workflow
Responsible for setting up and running a kubelet

5. Dockershim deprecated!!!
TL;DR Docker as an underlying runtime is being deprecated in favor of runtimes that use the Container Runtime
Interface (CRI) created for Kubernetes. Docker-produced images will continue to work in your cluster with all
runtimes, as they always have.
https://kubernetes.io/blog/2020/12/02/dockershim-faq/
https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/
Kubelet
Remote Container
Runtime
PreInitRuntimeService()
https://github.com/kubernetes/kubernetes/blob/v1.20.4/pkg/kubelet/kubelet.go#L298-L317
Docker Container
Runtime
Docker Server
(dockershim)
DockerServer.Start()
https://github.com/kubernetes/kubernetes/blob/v1.20.4/pkg/kubelet/dockershim/
remote/docker_server.go#L53-L79
/usr/bin/dockerd
/var/run/dockershim.sock

6. https://github.com/kubernetes/kubernetes/blob/v1.20.4/pkg/kubelet/kubelet.go#L298-L317

7. Mirantis to take over support
This means that you can continue to build Kubernetes based on the Docker Engine as before, just switching
from the built in dockershim to the external one.
https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/
Kubelet
Remote Container
Runtime
PreInitRuntimeService()
https://github.com/kubernetes/kubernetes/blob/v1.20.4/pkg/kubelet/kubelet.go#L298-L317
cri-dockerd?
https://github.com/Mirantis/cri-dockerd
https://www.mirantis.com/company/press-center/company-news/mirantis-acquires-docker-enterprise/

8. kubernetes/pkg/kubelet
kubernetes/cmd/kubelet/
kubelet.go
command.Execute()
app/server.go
Run()
kubelet.go
PreInitRuntimeService()
app/server.go
RunKubelet()
Kubelet init workflow
Responsible for setting up and running a kubelet

9. Kubelet workflow
Syncs the running pod into the desired pod.
1. Compute sandbox and container changes
2. Kill pod sandbox if necessary
3. Kill any containers that should not be running
4. Create sandbox if necessary
5. Create ephemeral containers
6. Create init containers
7. Create normal containers
https://github.com/kubernetes/kubernetes/blob/v1.20.4/pkg/kubelet/kuberuntime/kuberuntime_manager.go#L752
RunKubelet() Kubelet.RunOnce() ContainerRuntime.SyncPod() RuntimeService.RunPodSandbox()

10. Dockershim – RunPodSandbox()
1.Pull the image for the sandbox
2.Create the sandbox container
3.Create Sandbox Checkpoint
4.Start the sandbox container
5.Setup networking for the sandbox
https://github.com/kubernetes/kubernetes/blob/v1.20.4/pkg/kubelet/dockershim/docker_sandbox.go#L84-L205

11. Demo
https://github.com/electrocucaracha/k8s-NetworkingDeepDive-demo/tree/master/pause

12. Pull the image for the sandbox
Pause container
Kubelet flag
https://github.com/kubernetes/kubernetes/blob/v1.20.4/pkg/kubelet/dockershim/docker_sandbox.go#L102

13. What are the "pause" containers?
In Kubernetes, the pause container serves as the "parent container" for all of the containers in your pod. The
pause container has two core responsibilities:
1. Serves as the basis of Linux namespace sharing in the pod.
2. With PID (process ID) namespace sharing enabled, it serves as PID 1 for each pod and reaps zombie
processes.
https://www.ianlewis.org/en/almighty-pause-container
After `kubectl apply –f`

14. Create the sandbox container
https://github.com/kubernetes/kubernetes/blob/v1.20.4/pkg/kubelet/dockershim/docker_sandbox.go#L114
oci-runtime-tool generate https://github.com/opencontainers/runtime-tools

15. Create Sandbox Checkpoint
https://github.com/kubernetes/kubernetes/blob/v1.20.4/pkg/kubelet/dockershim/docker_sandbox.go#L134
https://github.com/kubernetes/kubernetes/blob/v1.20.4/pkg/kubelet/checkpointmanager/checkpoint_manager.go#L65-L74
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/cri-dockershim-checkpoint.md

16. Start the sandbox container
https://github.com/kubernetes/kubernetes/blob/v1.20.4/pkg/kubelet/dockershim/docker_sandbox.go#L141

17. Setup networking
for the sandbox
https://github.com/kubernetes/kubernetes/blob/v1.20.4/pkg/kubelet/dockershim/docker_sandbox.go#L185
https://github.com/kubernetes/kubernetes/blob/v1.20.4/pkg/kubelet/dockershim/network/cni/cni.go#L364
https://github.com/containernetworking/cni/tree/master/cnitool

18. Q&A