|
| 1 | +version = 1 |
| 2 | +# Snapshotter's own home directory where it stores and creates necessary resources |
| 3 | +root = "/var/lib/containerd-nydus" |
| 4 | +# The snapshotter's GRPC server socket, containerd will connect to plugin on this socket |
| 5 | +address = "/run/containerd-nydus/containerd-nydus-grpc.sock" |
| 6 | +# The nydus daemon mode can be one of the following options: multiple, dedicated, shared, or none. |
| 7 | +# If `daemon_mode` option is not specified, the default value is multiple. |
| 8 | +daemon_mode = "dedicated" |
| 9 | +# Whether snapshotter should try to clean up resources when it is closed |
| 10 | +cleanup_on_close = false |
| 11 | + |
| 12 | +[prefetch] |
| 13 | +enable = true |
| 14 | +distribution_pull_endpoint = "http://localhost:1323/api/v1/prefetch" |
| 15 | + |
| 16 | +[system] |
| 17 | +# Snapshotter's debug and trace HTTP server interface |
| 18 | +enable = true |
| 19 | +# Unix domain socket path where system controller is listening on |
| 20 | +address = "/run/containerd-nydus/system.sock" |
| 21 | + |
| 22 | +[system.debug] |
| 23 | +# Snapshotter can profile the CPU utilization of each nydusd daemon when it is being started. |
| 24 | +# This option specifies the profile duration when nydusd is downloading and uncomproessing data. |
| 25 | +daemon_cpu_profile_duration_secs = 5 |
| 26 | +# Enable by assigning an address, empty indicates pprof server is disabled |
| 27 | +pprof_address = "" |
| 28 | + |
| 29 | +[daemon] |
| 30 | +# Specify a configuration file for nydusd |
| 31 | +nydusd_config = "/etc/nydus/nydusd-config.fusedev.json" |
| 32 | +nydusd_path = "/usr/local/bin/nydusd" |
| 33 | +nydusimage_path = "/usr/local/bin/nydus-image" |
| 34 | +# The fs driver can be one of the following options: fusedev, fscache, blockdev, proxy, or nodev. |
| 35 | +# If `fs_driver` option is not specified, the default value is fusedev. |
| 36 | +fs_driver = "fusedev" |
| 37 | +# How to process when daemon dies: "none", "restart" or "failover" |
| 38 | +recover_policy = "restart" |
| 39 | +# Nydusd worker thread number to handle FUSE or fscache requests, [0-1024]. |
| 40 | +# Setting to 0 will use the default configuration of nydusd. |
| 41 | +threads_number = 4 |
| 42 | +# Log rotation size for nydusd, in unit MB(megabytes). (default 100MB) |
| 43 | +log_rotation_size = 100 |
| 44 | + |
| 45 | +[cgroup] |
| 46 | +# Whether to use separate cgroup for nydusd. |
| 47 | +enable = true |
| 48 | +# The memory limit for nydusd cgroup, which contains all nydusd processes. |
| 49 | +# Percentage is supported as well, please ensure it is end with "%". |
| 50 | +# The default unit is bytes. Acceptable values include "209715200", "200MiB", "200Mi" and "10%". |
| 51 | +memory_limit = "" |
| 52 | + |
| 53 | +[log] |
| 54 | +# Print logs to stdout rather than logging files |
| 55 | +log_to_stdout = false |
| 56 | +# Snapshotter's log level |
| 57 | +level = "info" |
| 58 | +log_rotation_compress = true |
| 59 | +log_rotation_local_time = true |
| 60 | +# Max number of days to retain logs |
| 61 | +log_rotation_max_age = 7 |
| 62 | +log_rotation_max_backups = 5 |
| 63 | +# In unit MB(megabytes) |
| 64 | +log_rotation_max_size = 100 |
| 65 | + |
| 66 | +[metrics] |
| 67 | +# Enable by assigning an address, empty indicates metrics server is disabled |
| 68 | +address = ":9110" |
| 69 | + |
| 70 | +[remote] |
| 71 | +convert_vpc_registry = false |
| 72 | + |
| 73 | +[remote.mirrors_config] |
| 74 | +# Snapshotter will overwrite daemon's mirrors configuration |
| 75 | +# if the values loaded from this driectory are not null before starting a daemon. |
| 76 | +# Set to "" or an empty directory to disable it. |
| 77 | +#dir = "/etc/nydus/certs.d" |
| 78 | + |
| 79 | +[remote.auth] |
| 80 | +# Fetch the private registry auth by listening to K8s API server |
| 81 | +enable_kubeconfig_keychain = false |
| 82 | +# synchronize `kubernetes.io/dockerconfigjson` secret from kubernetes API server with specified kubeconfig (default `$KUBECONFIG` or `~/.kube/config`) |
| 83 | +kubeconfig_path = "" |
| 84 | +# Fetch the private registry auth as CRI image service proxy |
| 85 | +enable_cri_keychain = false |
| 86 | +# the target image service when using image proxy |
| 87 | +#image_service_address = "/run/containerd/containerd.sock" |
| 88 | + |
| 89 | +[snapshot] |
| 90 | +# Let containerd use nydus-overlayfs mount helper |
| 91 | +enable_nydus_overlayfs = false |
| 92 | +# Insert Kata Virtual Volume option to `Mount.Options` |
| 93 | +enable_kata_volume = false |
| 94 | +# Whether to remove resources when a snapshot is removed |
| 95 | +sync_remove = false |
| 96 | + |
| 97 | +[cache_manager] |
| 98 | +# Disable or enable recyclebin |
| 99 | +disable = false |
| 100 | +# How long to keep deleted files in recyclebin |
| 101 | +gc_period = "24h" |
| 102 | +# Directory to host cached files |
| 103 | +cache_dir = "" |
| 104 | + |
| 105 | +[image] |
| 106 | +public_key_file = "" |
| 107 | +validate_signature = false |
| 108 | + |
| 109 | +# The configuraions for features that are not production ready |
| 110 | +[experimental] |
| 111 | +# Whether to enable stargz support |
| 112 | +enable_stargz = false |
| 113 | +# Whether to enable referrers support |
| 114 | +# The option enables trying to fetch the Nydus image associated with the OCI image and run it. |
| 115 | +# Also see https://github.com/opencontainers/distribution-spec/blob/main/spec.md#listing-referrers |
| 116 | +enable_referrer_detect = false |
| 117 | +# Whether to enable authentication support |
| 118 | +# The option enables nydus snapshot to provide backend information to nydusd. |
| 119 | +enable_backend_source = false |
| 120 | +[experimental.tarfs] |
| 121 | +# Whether to enable nydus tarfs mode. Tarfs is supported by: |
| 122 | +# - The EROFS filesystem driver since Linux 6.4 |
| 123 | +# - Nydus Image Service release v2.3 |
| 124 | +enable_tarfs = false |
| 125 | +# Mount rafs on host by loopdev and EROFS |
| 126 | +mount_tarfs_on_host = false |
| 127 | +# Only enable nydus tarfs mode for images with `tarfs hint` label when true |
| 128 | +tarfs_hint = false |
| 129 | +# Maximum of concurrence to converting OCIv1 images to tarfs, 0 means default |
| 130 | +max_concurrent_proc = 0 |
| 131 | +# Mode to export tarfs images: |
| 132 | +# - "none" or "": do not export tarfs |
| 133 | +# - "layer_verity_only": only generate disk verity information for a layer blob |
| 134 | +# - "image_verity_only": only generate disk verity information for all blobs of an image |
| 135 | +# - "layer_block": generate a raw block disk image with tarfs for a layer |
| 136 | +# - "image_block": generate a raw block disk image with tarfs for an image |
| 137 | +# - "layer_block_with_verity": generate a raw block disk image with tarfs for a layer with dm-verity info |
| 138 | +# - "image_block_with_verity": generate a raw block disk image with tarfs for an image with dm-verity info |
| 139 | +export_mode = "" |
0 commit comments