faas-containerd

KO | EN

gitlite — search

#python #hacktoberfest #react #go #golang #android #machine-learning #rust #linux #docker #java #windows #cli #security

faas-containerd

(★ 60)

containerd and CNI provider for OpenFaaS

faas-containerd Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# faas-containerd

[![Build Status](https://travis-ci.com/alexellis/faas-containerd.svg?branch=master)](https://travis-ci.com/alexellis/faas-containerd)

[OpenFaaS](https://github.com/openfaas/faas) provider for containerd - single node / edge workloads

What's the use-case?

OpenFaaS providers can be built for any backend, even for an in-memory datastore. Some users could benefit from a lightweight, single-node execution environment. Using containerd and bypassing Kubernetes or Docker should reduce the start-time for functions and allow for running in resource-constrained environments.

Pros:
* Fast cold-start
* containerd features available such as pause/snapshot
* Super lightweight
* Basic service-discovery and inter-service communication through /etc/hosts and bridge

Cons:
* No clustering (yet)

## Status

Proof of concept.

This project implements the [faas-provider](https://github.com/openfaas/faas-provider) SDK.

![Architecture](https://github.com/openfaas/faas-provider/raw/master/docs/conceptual.png)

*faas-provider conceptual architecture*

See other examples:

* [faas-memory](https://github.com/openfaas-incubator/faas-memory/)
* [faas-swarm](https://github.com/openfaas/faas-swarm/)
* [faas-netes](https://github.com/openfaas/faas-netes/)

Goals:

- [x] Deploy container specified via `PUT` to `/system/functions`
- [x] Serve HTTP traffic from deployed container via `/function/NAME`
- [x] List running containers via GET on `/system/functions`
- [ ] Clean-up containers on exit
- [ ] Give configuration for running faas-containerd / OpenFaaS gateway and Prometheus via systemd unit files or similar

### An update - Jan 2020

faas-containerd is now part of the [faasd](https://github.com/alexellis/faasd) project, which adds additional orchestration to bring the whole OpenFaaS experience and ecosystem to containerd.

See my tutorial on how to get started with faasd. It is written for RPi users, but faasd is designed to be portable and also runs on x86_64 and ARM64:

* [faasd - lightweight Serverless for your Raspberry Pi](https://blog.alexellis.io/faasd-for-lightweight-serverless/)

## Demo

![](https://pbs.twimg.com/media/EMEg1OEWkAAIDPO?format=jpg&name=medium)

* [View the Tweet](https://twitter.com/alexellisuk/status/1207282296459595776)

## Test it out

You need a Linux computer, VM, or bare-metal cloud host.

### Get some build dependencies

I used Ubuntu 18.04 LTS on [Packet.com using the c1.small.x86](https://www.packet.com/cloud/servers/c1-small/) host. You can use [multipass.run](https://multipass.run) to get an Ubuntu host on any OS - Windows, MacOS, or Linux.

```sh
sudo apt update && \
  sudo apt install -qy runc \
  	bridge-utils \
	tmux git \
  	build-essential \
	libbtrfs-dev libseccomp-dev
```

### Install Go 1.12 (x86_64)

```sh
curl -SLsf https://dl.google.com/go/go1.12.14.linux-amd64.tar.gz > go.tgz
sudo rm -rf /usr/local/go/
sudo mkdir -p /usr/local/go/
sudo tar -xvf go.tgz -C /usr/local/go/ --strip-components=1

export GOPATH=$HOME/go/
export PATH=$PATH:/usr/local/go/bin/

go version
```

### Or on Raspberry Pi (armhf)

```sh
curl -SLsf https://dl.google.com/go/go1.12.14.linux-armv6l.tar.gz > go.tgz
sudo rm -rf /usr/local/go/
sudo mkdir -p /usr/local/go/
sudo tar -xvf go.tgz -C /usr/local/go/ --strip-components=1

export GOPATH=$HOME/go/
export PATH=$PATH:/usr/local/go/bin/

go version
```

### Get containerd

* Install containerd (or build from source)

> Note: This can only be run on x86_64

```sh
export VER=1.3.2
curl -sLSf https://github.com/containerd/containerd/releases/download/v$VER/containerd-$VER.linux-amd64.tar.gz > /tmp/containerd.tar.gz \
  && sudo tar -xvf /tmp/containerd.tar.gz -C /usr/local/bin/ --strip-components=1

containerd -version
```

* Or clone / build / install [containerd](https://github.com/containerd/containerd) from source:

```sh
export GOPATH=$HOME/go/
mkdir -p $GOPATH/src/github.com/containerd
cd $GOPATH/src/github.com/containerd
git clone https://github.com/containerd/containerd
cd containerd
git fetch origin --tags
git checkout v1.3.2

make
sudo make install

containerd --version
```

Kill any old containerd version:

```sh
# Kill any old version
sudo killall containerd
sudo systemctl disable containerd
```

Start containerd in a new terminal:

```sh
sudo containerd &
```

### CNI Plugins

Install the CNI plugins like this:

```sh
export CNI_VERSION=v0.8.2

```

* For PC run `export ARCH=amd64`
* For RPi/armhf run `export ARCH=arm`
* For arm64 run `export ARCH=arm64`

Then run:

```
mkdir -p /opt/cni/bin
curl -sSL https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-linux-${ARCH}-${CNI_VERSION}.tgz | tar -xz -C /opt/cni/bin
```

Check it worked:

```
/opt/cni/bin/bridge --help

CNI bridge plugin v0.8.2
```

### Enable forwarding

> This is required to allow containers in containerd to access the Internet via your computer's primary network interface.

```sh
sudo /sbin/sysctl -w net.ipv4.conf.all.forwarding=1
```

Make the setting permanent:

```sh
echo "net.ipv4.conf.all.forwarding=1" | sudo tee -a /etc/sysctl.conf
```

### Build and run faas-containerd

* Get a binary

```sh
	# For x86_64
	sudo curl -fSLs "https://github.com/alexellis/faas-containerd/releases/download/0.4.0/faas-containerd" \
	  -o "/usr/local/bin/faas-containerd" \
	  && sudo chmod a+x "/usr/local/bin/faas-containerd"

# armhf
	sudo curl -fSLs "https://github.com/alexellis/faas-containerd/releases/download/0.4.0/faas-containerd-armhf" \
	  -o "/usr/local/bin/faas-containerd" \
	  && sudo chmod a+x "/usr/local/bin/faas-containerd"

# arm64
	sudo curl -fSLs "https://github.com/alexellis/faas-containerd/releases/download/0.4.0/faas-containerd-arm64" \
	  -o "/usr/local/bin/faas-containerd" \
	  && sudo chmod a+x "/usr/local/bin/faas-containerd"

# run faas-containerd
	sudo service_timeout=1m ./faas-containerd
	```

* Or build from source

```sh
	export GOPATH=$HOME/go/

mkdir -p $GOPATH/src/github.com/alexellis/faas-containerd
	cd $GOPATH/src/github.com/alexellis/faas-containerd
	git clone https://github.com/alexellis/faas-containerd
	cd faas-containerd

go build && sudo service_timeout=1m ./faas-containerd
	```

> Listens on port TCP/8081

## Test out your faas-containerd

Get the OpenFaaS CLI:

```sh
curl -sLfS https://cli.openfaas.com | sudo sh
```

Deploy a function with a server

```sh
faas store deploy figlet -g 127.0.0.1:8081 --update=true --replace=false
```

Deploy a ping function with a server

```sh
faas-cli deploy --image alexellis2/ping:0.1 \
  -g 127.0.0.1:8081 --update=true --replace=false --name ping
```

Deploy nodeinfo function with a server

```sh
faas-cli store deploy nodeinfo \
  -g 127.0.0.1:8081 --update=true --replace=false
```

Try to list functions:

```sh
faas-cli list -g 127.0.0.1:8081
```

Get a function's status:
```sh
faas-cli describe nodeinfo -g 127.0.0.1:8081
```

Try to invoke a function:

```sh
echo "-c 1 8.8.8.8" | faas-cli invoke ping -g 127.0.0.1:8081

echo "verbose" | faas-cli invoke nodeinfo -g 127.0.0.1:8081
```

List containers with `ctr`:

```sh
sudo ctr --namespace openfaas-fn container list
```

Delete container, snapshot and task:

```sh
sudo ctr --namespace openfaas-fn task kill figlet
sudo ctr --namespace openfaas-fn task delete figlet
sudo ctr --namespace openfaas-fn container delete figlet
sudo ctr --namespace openfaas-fn snapshot remove figlet-snapshot
```

## Enable Basic Auth

Basic auth requires three things: a username file, a password file, and an env variable.

First, create the username and password, make sure to pick a secure password for production deployments:
```sh
echo admin >> basic-auth-user
echo localdev >> basic-auth-password
```

Then set the `basic_auth` and `secret_mount_path` env variables when starting `faas-containerd`:
```sh
service_timeout=1m basic_auth=true secret_mount_path=`pwd` sudo ./bin/faas-containerd
```

The default value for `secret_mount_path` is `/run/secrets/`.

Once it is running, you can quickly verify that auth is being enforced by using the CLI:

```sh
$ faas-cli list -g 127.0.0.1:8081
Unauthorized access, run "faas-cli login" to setup authentication for this server
```

Now login:

```sh
cat basic-auth-password | faas-cli login -g 127.0.0.1:8081 --tls-no-verify -u admin --password-stdin
```

You can now deploy and invoke a function as before:
```sh
faas-cli deploy --image alexellis2/ping:0.1 \
  -g 127.0.0.1:8081 --update=true --replace=false --name ping
echo "-c 1 8.8.8.8" | faas-cli invoke ping -g 127.0.0.1:8081
```

The auth is saved in `~/.openfaas/config.yml`.

## Links

* [Detailed explanation on netns](https://pierrchen.blogspot.com/2018/05/understand-container-6-hooks-and-network.html)

## License

MIT

faas-containerd

faas-containerd Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

faas-containerd

faas-containerd Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README