Develop custom container images for ACS PPU

Create a DinD Pod

1. Save the following YAML content as acs-dind-demo.yaml.

   Important

   In pay-as-you-go scenarios, specifications may vary by card type. For details on resource limitations, see P16EN. This limitation does not apply to capacity reservation scenarios.

   Pay-as-you-go

   apiVersion: v1
   kind: Pod
   metadata:
     labels:
       alibabacloud.com/compute-class: gpu
       alibabacloud.com/gpu-model-series: PPU810E
       alibabacloud.com/compute-qos: default
       alibabacloud.com/hpn-type: "rdma" # Optional
     name: acs-dind-demo
   spec:
     containers:
     - image: registry.cn-hangzhou.aliyuncs.com/acs-demo-ns/docker:27-dind
       name: main
       resources: # Adjust resources as needed.
         limits:
           cpu: "16"
           ephemeral-storage: 256Gi
           memory: 128Gi
           alibabacloud.com/ppu: "2"
         requests:
           cpu: "16"
           ephemeral-storage: 256Gi
           memory: 128Gi
           alibabacloud.com/ppu: "2"
       volumeMounts:
       - mountPath: /var/lib/docker
         name: docker
       # Optional. Required if you use buildkit.
       - mountPath: /var/lib/buildkit
         name: buildkit
       securityContext:
         #  Declare this as a privileged container. You must submit a ticket to request this capability.
         privileged: true
     volumes:
     - emptyDir: {}
       name: docker
     # Optional. Required if you use buildkit.
     - emptyDir: {}
       name: buildkit

   Capacity reservation

   apiVersion: v1
   kind: Pod
   metadata:
     labels:
       alibabacloud.com/compute-class: gpu-hpn
       alibabacloud.com/gpu-model-series: PPU810E
       alibabacloud.com/compute-qos: default
       alibabacloud.com/hpn-type: "rdma"
     name: acs-dind-demo
   spec:
     containers:
     - image: registry.cn-hangzhou.aliyuncs.com/acs-demo-ns/docker:27-dind
       name: main
       resources: # Adjust resources as needed.
         limits:
           cpu: "16"
           ephemeral-storage: 256Gi
           memory: 128Gi
           alibabacloud.com/ppu: "2"
         requests:
           cpu: "16"
           ephemeral-storage: 256Gi
           memory: 128Gi
           alibabacloud.com/ppu: "2"
       volumeMounts:
       - mountPath: /var/lib/docker
         name: docker
       # Optional. Required if you use buildkit.
       - mountPath: /var/lib/buildkit
         name: buildkit
       securityContext:
         #  Declare this as a privileged container. You must submit a ticket to request this capability.
         privileged: true
     volumes:
     - emptyDir: {}
       name: docker
     # Optional. Required if you use buildkit.
     - emptyDir: {}
       name: buildkit

2. Run the following command to create the Pod.

   kubectl apply -f acs-dind-demo.yaml

3. Run the following command to check the Pod status.

   kubectl get pod acs-dind-demo

   Expected output:

   NAME            READY   STATUS    RESTARTS   AGE
   acs-dind-demo   1/1     Running   0          7m41s

Develop a PPU image in DinD

The workflow is to start a privileged PPU container inside the DinD Pod, install your software, and then commit the container as a new custom image from the outer Pod.

1. Pull a PPU container image into the DinD container to use as the base image.

2. In the DinD container, run the id=$(docker run -tid --privileged {ppu-image-uri} bash) command to start an inner PPU container, and run the docker exec -it $id bash command to enter the inner PPU container.

3. Inside the inner PPU container, you can install Linux packages and Python PIP packages as you would on a standard Linux host. You can either convert the installation commands from your Dockerfile into a shell script or run them manually.

4. After the installation is complete and temporary files are cleaned up, run exit in the inner PPU container to exit to the outer DinD container.

5. Run the docker commit $id {new-image}:{new-tag} command in the DinD container to commit the internal PPU container environment to a new container image. For detailed steps on how to push the new image to your image repository, see Push and pull images by using an Enterprise Edition instance.

6. After you finish developing the new image, run docker stop $id && docker rm $id to stop and remove the inner PPU container.

Create a Buildah Pod

1. Save the following YAML content as acs-buildah-demo.yaml.

   Important

   In pay-as-you-go scenarios, specifications may vary by card type. For details on resource limitations, see P16EN. This limitation does not apply to capacity reservation scenarios.

   kind: Pod
   apiVersion: v1
   metadata:
     name: acs-buildah-demo
     labels:
       alibabacloud.com/compute-class: gpu
       alibabacloud.com/gpu-model-series: PPU810E
       alibabacloud.com/compute-qos: default
   spec:
     restartPolicy: OnFailure
     volumes:
     - emptyDir: {}
       name: buildah
     containers:
     - name: builder
       image: registry-cn-hangzhou.ack.aliyuncs.com/ack-demo/buildah:v1.40.1
       command:
       - sh
       - -c
       - sleep infinity 
       imagePullPolicy: Always
       volumeMounts:
       - mountPath: /var/lib/containers/storage
         name: buildah
       resources: # Adjust resources as needed.
         limits:
           cpu: "16"
           memory: "128Gi"
           ephemeral-storage: 500Gi
           alibabacloud.com/ppu: 2
         requests:
           cpu: "16"
           memory: "128Gi"
           ephemeral-storage: 500Gi
           alibabacloud.com/ppu: 2

2. Run the following command to create the Pod.

   kubectl apply -f acs-buildah-demo.yaml

3. Run the following command to check the Pod status.

   kubectl get pod acs-buildah-demo

   Expected output:

   NAME               READY   STATUS    RESTARTS   AGE
   acs-buildah-demo   1/1     Running   0          7m41s

Build a custom image in Buildah

The procedure is as follows:

1. Run the cd command to change to the Dockerfile directory.

   The following is an example of a Dockerfile that uses a PPU container image as its base image:

   # If you use a standard image provided by ACS
   # FROM egslingjun-registry.cn-wulanchabu.cr.aliyuncs.com/egslingjun/{image:tag}
   
   # You can also use a PPU image that you have copied to your own repository
   # FROM {customers-docker-registery}/{image:tag}
   
   # Other Dockerfile commands are omitted

2. Run the buildah --storage-driver=overlay build -t test:v1 . command to build the image.

3. (Optional) Check the built image: buildah --storage-driver=overlay images.

4. Push the new image to your own image repository:

   1. Log in to the repository: buildah login -u "{LOGIN_USERNAME}" -p "{LOGIN_PASSWORD}" {target-registry-domain}.

   2. Push the image to the repository: buildah --storage-driver=overlay push test:v1 docker://{target-registry-prefix}/{target-image}.

If the ACS VPC CIDR block is set to 172.17.0.0/16, the DinD Pod cannot be accessed remotely. How do I fix this?

• Analysis: This problem occurs because the default Docker CIDR block in the ACS Pod, 172.17.0.0/16, conflicts with the VPC CIDR block.

• Solution: You can specify the bip parameter for dockerd to change its default CIDR block. To do this:

  1. Create a ConfigMap where the bip field can be customized to a different, non-conflicting address block, such as 192.168.5.1/24.

     kubectl create configmap docker-daemon-config \
       --from-literal=daemon.json='{
       "bip": "192.168.5.1/24"
     }' \
       -n <your-namespace>  # If you do not specify the -n flag, the ConfigMap is created in the default namespace.

  2. Add the following volume mount configuration to the DinD Pod's YAML file (from the Create a DinD Pod section) to mount the ConfigMap.

             volumeMounts:
             - name: docker-config-volume
               mountPath: /etc/docker/daemon.json  
               subPath: daemon.json                
     
           
           volumes:
           - name: docker-config-volume
             configMap:
               name: docker-daemon-config
               items:
               - key: daemon.json         
                 path: daemon.json