Skip to content

Commit a3f97a7

Browse files
gvisor-botgvisor-bot
committed
Merge pull request google#2513 from amscanne:website-integrated
PiperOrigin-RevId: 311184385
2 parents 6a4466a + 5f3a256 commit a3f97a7

File tree

150 files changed

+6240
-16
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

150 files changed

+6240
-16
lines changed

‎BUILD

+39
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,48 @@
11
load("//tools:defs.bzl", "build_test", "gazelle", "go_path")
2+
load("//website:defs.bzl", "doc")
23

34
package(licenses = ["notice"])
45

56
exports_files(["LICENSE"])
67

8+
doc(
9+
name = "contributing",
10+
src = "CONTRIBUTING.md",
11+
category = "Project",
12+
permalink = "/contributing/",
13+
visibility = ["//website:__pkg__"],
14+
weight = "20",
15+
)
16+
17+
doc(
18+
name = "security",
19+
src = "SECURITY.md",
20+
category = "Project",
21+
permalink = "/security/",
22+
visibility = ["//website:__pkg__"],
23+
weight = "30",
24+
)
25+
26+
doc(
27+
name = "governance",
28+
src = "GOVERNANCE.md",
29+
category = "Project",
30+
permalink = "/community/governance/",
31+
subcategory = "Community",
32+
visibility = ["//website:__pkg__"],
33+
weight = "91",
34+
)
35+
36+
doc(
37+
name = "code_of_conduct",
38+
src = "CODE_OF_CONDUCT.md",
39+
category = "Project",
40+
permalink = "/community/code_of_conduct/",
41+
subcategory = "Community",
42+
visibility = ["//website:__pkg__"],
43+
weight = "99",
44+
)
45+
746
# The sandbox filegroup is used for sandbox-internal dependencies.
847
package_group(
948
name = "sandbox",

‎CODE_OF_CONDUCT.md

+2-3
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,5 @@ harassment or threats to anyone's safety, we may take action without notice.
8787

8888
## Attribution
8989

90-
This Code of Conduct is adapted from the Contributor Covenant, version 1.4,
91-
available at
92-
https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
90+
This Code of Conduct is adapted from the
91+
[Contributor Covenant, version 1.4](https://www.contributor-covenant.org/version/1/4/code-of-conduct.html).

‎CONTRIBUTING.md

+2-3
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ Dependencies can be added by using `go mod get`. In order to keep the
3939

4040
All Go code should conform to the [Go style guidelines][gostyle]. C++ code
4141
should conform to the [Google C++ Style Guide][cppstyle] and the guidelines
42-
described for [tests][teststyle]. Note that code may be automatically formatted
43-
per the guidelines when merged.
42+
described for tests. Note that code may be automatically formatted per the
43+
guidelines when merged.
4444

4545
As a secure runtime, we need to maintain the safety of all of code included in
4646
gVisor. The following rules help mitigate issues.
@@ -131,4 +131,3 @@ one above, the
131131
[github]: https://github.com/google/gvisor/compare
132132
[gvisor-dev-list]: https://groups.google.com/forum/#!forum/gvisor-dev
133133
[gostyle]: https://github.com/golang/go/wiki/CodeReviewComments
134-
[teststyle]: ./test/

‎GOVERNANCE.md

+113
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
# Governance
2+
3+
## Projects
4+
5+
A *project* is the primary unit of collaboration. Each project may have its own
6+
repository and contribution process.
7+
8+
All projects are covered by the [Code of Conduct](CODE_OF_CONDUCT.md), and
9+
should include an up-to-date copy in the project repository or a link here.
10+
11+
## Contributors
12+
13+
Anyone can be a *contributor* to a project, provided they have signed relevant
14+
Contributor License Agreements (CLAs) and follow the project's contribution
15+
guidelines. Contributions will be reviewed by a maintainer, and must pass all
16+
applicable tests.
17+
18+
Reviews check for code quality and style, including documentation, and enforce
19+
other policies. Contributions may be rejected for reasons unrelated to the code
20+
in question. For example, a change may be too complex to maintain or duplicate
21+
existing functionality.
22+
23+
Note that contributions are not limited to code alone. Bugs, documentation,
24+
experience reports or public advocacy are all valuable ways to contribute to a
25+
project and build trust in the community.
26+
27+
## Maintainers
28+
29+
Each project has one or more *maintainers*. Maintainers set technical direction,
30+
facilitate contributions and exercise overall stewardship.
31+
32+
Maintainers have write access to the project repository. Maintainers review and
33+
approve changes. They can also assign issues and add additional reviewers.
34+
35+
Note that some repositories may not allow direct commit access, which is
36+
reserved for administrators or automated processes. In this case, maintainers
37+
have approval rights, and a separate process exists for merging a change.
38+
39+
Maintainers are responsible for upholding the code of conduct in interactions
40+
via project communication channels. If comments or exchanges are in violation,
41+
they may remove them at their discretion.
42+
43+
### Repositories requiring synchronization
44+
45+
For some projects initiated by Google, the infrastructure which synchronizes and
46+
merges internal and external changes requires that merges are performed by a
47+
Google employee. In such cases, Google will initiate a rotation to merge changes
48+
once they pass tests and are approved by a maintainer. This does not preclude
49+
non-Google contributors from becoming maintainers, in which case the maintainer
50+
holds approval rights and the merge is an automated process. In some cases,
51+
Google-internal tests may fail and have to be fixed: the Google employee will
52+
work with the submitter to achieve this.
53+
54+
### Becoming a maintainer
55+
56+
The list of maintainers is defined by the list of people with commit access or
57+
approval authority on a repository, typically via a Gerrit group or a GitHub
58+
team.
59+
60+
Existing maintainers may elevate a contributor to maintainer status on evidence
61+
of previous contributions and established trust. This decision is based on lazy
62+
consensus from existing maintainers. While contributors may ask maintainers to
63+
make this decision, existing maintainers will also pro-actively identify
64+
contributors who have demonstrated a sustained track record of technical
65+
leadership and direct contributions.
66+
67+
## Special Interest Groups (SIGs)
68+
69+
From time-to-time, a SIG may be formed in order to solve larger, more complex
70+
problems across one or more projects. There are many avenues for collaboration
71+
outside a SIG, but a SIG can provide structure for collaboration on a single
72+
topic.
73+
74+
Each group will be established by a charter, and governed by the Code of
75+
Conduct. Some resources may be provided to the group, such as mailing lists or
76+
meeting space, and archives will be public.
77+
78+
## Security disclosure
79+
80+
Projects may maintain security mailing lists for vulnerability reports and
81+
internal project audits may occasionally reveal security issues. Access to these
82+
lists and audits will be limited to project *maintainers*; individual
83+
maintainers should opt to participate in these lists based on need and
84+
expertise. Once maintainers become aware of a potential security issue, they
85+
will assess the scope and potential impact. If reported externally, maintainers
86+
will determine a reasonable embargo period with the reporter.
87+
88+
During the embargo period, the maintainers will prioritize a fix for the
89+
security issue. They may choose to disclose the issue to additional trusted
90+
contributors in order to facilitate a fix, subjecting them to the embargo, or
91+
notify affected users in order to give them an advanced opportunity to mitigate
92+
the issue. The inclusion of specific users in this disclosure is left to the
93+
discretion of the maintainers and contributors involved, and depends on the
94+
scale of known project use and exposure.
95+
96+
Once a fix is widely available or the embargo period ends, the maintainers will
97+
make technical details about the vulnerability and associated fixes available.
98+
99+
## Mailing lists
100+
101+
There are four key mailing lists that span projects.
102+
103+
* [gvisor-users](mailto:[email protected]): general purpose user
104+
list.
105+
* [gvisor-dev](mailto:[email protected]): general purpose
106+
development list.
107+
* [gvisor-security](mailto:[email protected]): private security
108+
list. Access to this list is restricted to maintainers of the core gVisor
109+
project, subject to the security disclosure policy described above.
110+
* [gvisor-syzkaller](mailto:[email protected]): private
111+
syzkaller bug tracking list. Access to this list is not limited to
112+
maintainers, but will be granted to those who can credibly contribute to
113+
fixes.

‎Makefile

+33-1
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ runsc: ## Builds the runsc binary.
108108
.PHONY: runsc
109109

110110
smoke-test: ## Runs a simple smoke test after build runsc.
111-
@$(MAKE) run DOCKER_RUN_OPTIONS="" ARGS="--alsologtostderr --network none --debug --TESTONLY-unsafe-nonroot=true --rootless do true"
111+
@$(MAKE) run DOCKER_PRIVILEGED="" ARGS="--alsologtostderr --network none --debug --TESTONLY-unsafe-nonroot=true --rootless do true"
112112
.PHONY: smoke-tests
113113

114114
unit-tests: ## Runs all unit tests in pkg runsc and tools.
@@ -119,6 +119,38 @@ tests: ## Runs all local ptrace system call tests.
119119
@$(MAKE) test OPTIONS="--test_tag_filter runsc_ptrace test/syscalls/..."
120120
.PHONY: tests
121121

122+
##
123+
## Website & documentation helpers.
124+
##
125+
## The website is built from repository documentation and wrappers, using
126+
## using a locally-defined Docker image (see images/jekyll). The following
127+
## variables may be set when using website-push:
128+
## WEBSITE_IMAGE - The name of the container image.
129+
## WEBSITE_SERVICE - The backend service.
130+
## WEBSITE_PROJECT - The project id to use.
131+
## WEBSITE_REGION - The region to deploy to.
132+
##
133+
WEBSITE_IMAGE := gcr.io/gvisordev/gvisordev
134+
WEBSITE_SERVICE := gvisordev
135+
WEBSITE_PROJECT := gvisordev
136+
WEBSITE_REGION := us-central1
137+
138+
website-build: load-jekyll ## Build the site image locally.
139+
@$(MAKE) run TARGETS="//website:website"
140+
.PHONY: website-build
141+
142+
website-server: website-build ## Run a local server for development.
143+
@docker run -i -p 8080:8080 gvisor.dev/images/website
144+
.PHONY: website-server
145+
146+
website-push: website-build ## Push a new image and update the service.
147+
@docker tag gvisor.dev/images/website $(WEBSITE_IMAGE) && docker push $(WEBSITE_IMAGE)
148+
.PHONY: website-push
149+
150+
website-deploy: website-push ## Deploy a new version of the website.
151+
@gcloud run deploy $(WEBSITE_SERVICE) --platform=managed --region=$(WEBSITE_REGION) --project=$(WEBSITE_PROJECT) --image=$(WEBSITE_IMAGE)
152+
.PHONY: website-push
153+
122154
##
123155
## Development helpers and tooling.
124156
##

‎SECURITY.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ the [gvisor-security mailing list][gvisor-security-list]. You should receive a
55
prompt response, typically within 48 hours.
66

77
Policies for security list access, vulnerability embargo, and vulnerability
8-
disclosure are outlined in the [community][community] repository.
8+
disclosure are outlined in the [governance policy](GOVERNANCE.md).
99

1010
[community]: https://gvisor.googlesource.com/community
1111
[gvisor-security-list]: https://groups.google.com/forum/#!forum/gvisor-security

‎WORKSPACE

+2-2
Original file line numberDiff line numberDiff line change
@@ -380,15 +380,15 @@ go_repository(
380380
go_repository(
381381
name = "org_uber_go_atomic",
382382
importpath = "go.uber.org/atomic",
383-
version = "v1.6.0",
384383
sum = "h1:Ezj3JGmsOnG1MoRWQkPBsKLe9DwWD9QeXzTRzzldNVk=",
384+
version = "v1.6.0",
385385
)
386386

387387
go_repository(
388388
name = "org_uber_go_multierr",
389389
importpath = "go.uber.org/multierr",
390-
version = "v1.5.0",
391390
sum = "h1:KCa4XfM8CWFCpxXRGok+Q0SS/0XBhMDbHHGABQLvD2A=",
391+
version = "v1.5.0",
392392
)
393393

394394
# BigQuery Dependencies for Benchmarks

‎g3doc/BUILD

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
load("//website:defs.bzl", "doc")
2+
3+
package(
4+
default_visibility = ["//website:__pkg__"],
5+
licenses = ["notice"],
6+
)
7+
8+
doc(
9+
name = "index",
10+
src = "README.md",
11+
category = "Project",
12+
permalink = "/docs/",
13+
weight = "0",
14+
)
15+
16+
doc(
17+
name = "roadmap",
18+
src = "roadmap.md",
19+
category = "Project",
20+
permalink = "/roadmap/",
21+
weight = "10",
22+
)
23+
24+
doc(
25+
name = "community",
26+
src = "community.md",
27+
category = "Project",
28+
permalink = "/community/",
29+
subcategory = "Community",
30+
weight = "95",
31+
)

‎g3doc/README.md

+27-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,27 @@
1-
The gVisor logo files are licensed under CC BY-SA 4.0 (Creative Commons
2-
Attribution-ShareAlike 4.0 International).
1+
# What is gVisor?
2+
3+
gVisor is a user-space kernel, written in Go, that implements a substantial
4+
portion of the [Linux system call interface][linux]. It provides an additional
5+
layer of isolation between running applications and the host operating system.
6+
7+
gVisor includes an [Open Container Initiative (OCI)][oci] runtime called `runsc`
8+
that makes it easy to work with existing container tooling. The `runsc` runtime
9+
integrates with Docker and Kubernetes, making it simple to run sandboxed
10+
containers.
11+
12+
gVisor takes a distinct approach to container sandboxing and makes a different
13+
set of technical trade-offs compared to existing sandbox technologies, thus
14+
providing new tools and ideas for the container security landscape.
15+
16+
gVisor can be used with Docker, Kubernetes, or directly using `runsc`. Use the
17+
links below to see detailed instructions for each of them:
18+
19+
* [Docker](./user_guide/quick_start/docker/): The quickest and easiest way to
20+
get started.
21+
* [Kubernetes](./user_guide/quick_start/kubernetes/): Isolate Pods in your K8s
22+
cluster with gVisor.
23+
* [OCI Quick Start](./user_guide/quick_start/oci/): Expert mode. Customize
24+
gVisor for your environment.
25+
26+
[linux]: https://en.wikipedia.org/wiki/Linux_kernel_interfaces
27+
[oci]: https://www.opencontainers.org

‎g3doc/architecture_guide/BUILD

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
load("//website:defs.bzl", "doc")
2+
3+
package(
4+
default_visibility = ["//website:__pkg__"],
5+
licenses = ["notice"],
6+
)
7+
8+
doc(
9+
name = "index",
10+
src = "README.md",
11+
category = "Architecture Guide",
12+
data = [
13+
"Layers.png",
14+
"Layers.svg",
15+
"Machine-Virtualization.png",
16+
"Machine-Virtualization.svg",
17+
"Rule-Based-Execution.png",
18+
"Rule-Based-Execution.svg",
19+
"Sentry-Gofer.png",
20+
"Sentry-Gofer.svg",
21+
],
22+
permalink = "/docs/architecture_guide/",
23+
weight = "0",
24+
)
25+
26+
doc(
27+
name = "platforms",
28+
src = "platforms.md",
29+
category = "Architecture Guide",
30+
data = [
31+
"Sentry-Gofer.png",
32+
"Sentry-Gofer.svg",
33+
],
34+
permalink = "/docs/architecture_guide/platforms/",
35+
weight = "40",
36+
)
37+
38+
doc(
39+
name = "resources",
40+
src = "resources.md",
41+
category = "Architecture Guide",
42+
permalink = "/docs/architecture_guide/resources/",
43+
weight = "30",
44+
)
45+
46+
doc(
47+
name = "security",
48+
src = "security.md",
49+
category = "Architecture Guide",
50+
data = [
51+
"Layers.png",
52+
"Layers.svg",
53+
],
54+
permalink = "/docs/architecture_guide/security/",
55+
weight = "10",
56+
)
57+
58+
doc(
59+
name = "performance",
60+
src = "performance.md",
61+
category = "Architecture Guide",
62+
permalink = "/docs/architecture_guide/performance/",
63+
weight = "20",
64+
)

‎g3doc/architecture_guide/Layers.png

10.8 KB
Loading

‎g3doc/architecture_guide/Layers.svg

+1
Loading

‎g3doc/architecture_guide/Machine-Virtualization.png

12.9 KB
Loading

‎g3doc/architecture_guide/Machine-Virtualization.svg

+1
Loading

0 commit comments

Comments
 (0)