Lazy image pulling with eStargz

[jacksgt]

Hello everyone!

I have recently taken a look at how we can benefit from eStargz-formatted container images on OKD.
From my experience, containers deployed on OpenShift always end up pretty big (for one reason or another), so downloading just the necessary bits can really make a significant difference (as opposed to deploying minimal containers with just a single binary inside).

In the end I arrived at the following MachineConfig manifests that sets up all the required bits and pieces.
Vadim has already given me some pointers for CoreOS Layering, but that's only available from 4.12 onwards, so it'll be something to look into next year. :-)

You can read the blog post for all the details and considerations: https://blog.cubieserver.de/2022/experimenting-with-estargz-image-pulling-on-openshift/

# stargz-worker-machineconfig.yaml
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  name: 99-worker-stargz
  labels:
    machineconfiguration.openshift.io/role: worker
spec:
  config:
    ignition:
      version: 3.2.0

    # https://coreos.github.io/ignition/examples/#create-files-on-the-root-filesystem
    storage:
      files:
      - path: "/etc/containers/storage.conf"
        mode: 420 # corresponds to 644 in octal
        overwrite: true
        # Base64 encoded version of storage.conf in data URL scheme
        # https://www.rfc-editor.org/rfc/rfc2397
        contents:
          source: data:text/plain;charset=utf-8;base64,W3N0b3JhZ2VdCmRyaXZlciA9ICJvdmVybGF5IgpncmFwaHJvb3QgPSAiL3Zhci9saWIvY29udGFpbmVycy9zdG9yYWdlIgpydW5yb290ID0gIi9ydW4vY29udGFpbmVycy9zdG9yYWdlIgoKW3N0b3JhZ2Uub3B0aW9uc10KYWRkaXRpb25hbGxheWVyc3RvcmVzID0gWyIvdmFyL2xpYi9zdGFyZ3otc3RvcmUvc3RvcmU6cmVmIl0=

    systemd:
      units:
      - name: "stargz.service"
        enabled: true
        contents: |
          [Unit]
          Description=Stargz Store plugin for CRI-O
          Before=crio.service
          After=network.target

          [Service]
          Type=notify
          Environment=HOME=/root
          Environment=STARGZ_VERSION=v0.13.0
          Environment=STARGZ_SHA256=4f3133a225c424a3dd075029a50efc44d28033099aa27ddf22e48fd2764b5301
          # 1. Ensure fuse kernel module is loaded
          # 2. Download stargz archive and verify checksum
          # 3. Unpack the binary
          ExecStartPre=/bin/sh -xec 'modprobe fuse && \
          curl -o /tmp/stargz.tar.gz -sL https://github.com/containerd/stargz-snapshotter/releases/download/${STARGZ_VERSION}/stargz-snapshotter-${STARGZ_VERSION}-linux-amd64.tar.gz && \
          echo "${STARGZ_SHA256}  /tmp/stargz.tar.gz" | sha256sum -c && \
          tar -C /usr/local/bin -xvf /tmp/stargz.tar.gz stargz-store && \
          rm /tmp/stargz.tar.gz'
          # Start stargz-store daemon
          ExecStart=/usr/local/bin/stargz-store --log-level=debug --config=/etc/stargz-store/config.toml /var/lib/stargz-store/store
          ExecStopPost=umount /var/lib/stargz-store/store
          Restart=always
          RestartSec=1

          [Install]
          WantedBy=multi-user.target