TEE Cgroups

Configuring Cgroups for Confidential Containers

To better manage resources in the TEE, the TEE allows using cgroups to configure memory and CPU resources for confidential containers.

1. Download the Docker hook tool package for the REE from itrustee_sdk. The tool is used during container startup to configure TEE resources for containers through the hook mechanism.

   1 2	git clone https://gitcode.com/openeuler/itrustee_sdk.git cd itrustee_sdk/build/tools/docker_config_tools

2. Copy the hook scripts to the /var/lib/docker/hooks directory. These scripts are used to automatically configure and release TEE resources during container startup and destruction.

   1	cp start.sh stop.sh prestart_container.sh poststop_container.sh /var/lib/docker/hooks

3. Use the script to generate the cgroup resource configuration file for containers in the TEE.

   1	python3 gen_config.py config_dir --memory=200M --cpus=10000 --cpuset-cpus="0,1" --disk-size=300M

   In the preceding command, config_dir must be an absolute path. A config.json file that complies with the hook mechanism will be generated in the config_dir directory. This file specifies additional operations to be performed during container creation and destruction in the REE.

   

   The TEE supports the following cgroup configuration items:

   • --memory: specifies the upper limit of the memory space available to all TAs within the corresponding TEE-side group.
   • --cpus: specifies the maximum CPU utilization limit for all TAs within the corresponding TEE-side group.
   • --cpuset-cpus: specifies the IDs of the CPUs available to all TAs within the corresponding TEE-side group.

     To query the ID of an online CPU in the TEE, run the following command:

     1	tee_teleport --config-resource --nsid=$(lsns -t pid | grep systemd | awk '{print $1}')

   • --disk-size: specifies the upper limit of the file system space that can be used by all TAs of the group in the TEE. Because file systems in the TEE are temporary file systems (tmpfs), the files deployed and generated in the TEE are included in the memory and file system quotas.
4. Start the container. Cgroup resources are then automatically configured for the container in the TEE.

   1	docker run --hook-spec=<config_dir>/config.json -it --mount type=bind,source=/var/itrustee/teecd,target=/var/itrustee/teecd,readonly --device /dev/teelog:/dev/teelog:wr --device /dev/tc_ns_cvm:/dev/tc_ns_cvm:wr -d <docker_image>

5. Destroy the container. When the docker rm or docker stop command is executed, the resources occupied by the container in the TEE are automatically released.
   

   By default, the cgroup feature is automatically enabled after the OS is upgraded to the CCOS. If you do not configure memory and CPU resources in the TEE for a confidential container, the resources in the TEE are not restricted for the corresponding group. All resource configuration parameters are optional.