Configuring IPC and shared memory between containers in QM and root partitions

Configuring IPC and shared memory between containers in QM and root partitions

Cross-environment communication enables containers in the root partition to communicate with containers in the quality-managed (QM) partition using both UNIX domain sockets for inter-process communication (IPC) and shared memory for efficient data sharing. This configuration requires mounting shared volumes in both partitions and configuring appropriate SELinux security labels to enable IPC and shared memory access between the containers.

About the demo code

The demo code uses a pair of C applications packaged as containers — a server running in the root partition and a client running in the QM partition — that communicate over a UNIX domain socket at /run/ipc/ipc_server.socket and share data through shared memory.

To configure the AutoSD OS image build, the Automotive Image Builder (AIB) manifest file specifies:

• The server container image to add to the root partition
• The client container image to add to the QM partition
• The Quadlet unit configurations for both applications
• A shared volume mount at /run/ipc for socket communication
• A shared memory mount configuration to enable data sharing between partitions
• A custom SELinux policy to enable shared memory access

When the built AutoSD system starts, the server creates and binds to the UNIX domain socket, creates shared memory segments, and the client connects to both, enabling IPC and shared memory access between the two applications running in separate partitions.

The sample Containerfiles and C source code available in the demo directory illustrate how to create these containerized applications with proper socket and shared memory handling.

Prerequisites

A custom aib.yml Automotive Image Builder (AIB) manifest file, such as the manifest file that you created in Configuring communication between containers in the root partition.

Procedure

1. Using Podman, create local containerized versions of the server and client applications using the sample code located in the demo code.

   Note

   The demo code includes C source files (server.c and client.c) and Containerfiles for building the applications. You can use the provided build.sh script to build both container images locally. For AIB to find the the built container images during the build process, you must run the build script as a user with elevated privileges: sudo bash build.sh builds both the application containers and the AutoSD OS image from the AIB manifest, and sudo bash build.sh --noimage builds only the application containers.

2. Build the custom SELinux policy RPM that enables shared memory access. The demo includes a policy package in the policy/ directory:

   console --8<-- "demos/shared_memory_qm_root/policy/build.sh"

   Note

   This custom policy is required to fix container mount issues with shared memory. For more information, see issue #912.

3. To copy the local container images to their respective partitions in the OS image, add the following sections to your manifest file:

   1. Add the server container image to the root partition in the content section:

      console --8<-- "demos/shared_memory_qm_root/shared_memory_qm_root.aib.yml:7:7" ... --8<-- "demos/shared_memory_qm_root/shared_memory_qm_root.aib.yml:17:22"

   2. Add the custom SELinux policy RPM to the root partition:

      console --8<-- "demos/shared_memory_qm_root/shared_memory_qm_root.aib.yml:7:15"

   3. Add the client container image to the QM partition in the qm section:

      console --8<-- "demos/shared_memory_qm_root/shared_memory_qm_root.aib.yml:45:46" ... --8<-- "demos/shared_memory_qm_root/shared_memory_qm_root.aib.yml:58:63"

4. Create Quadlet unit files for both the server and client containers:

   1. Create a server.container Quadlet unit file for the server running in the root partition:

      console --8<-- "demos/shared_memory_qm_root/server.container"

   2. Create a client.container Quadlet unit file for the client running in the QM partition:

      console --8<-- "demos/shared_memory_qm_root/client.container"

   Note

   Both containers mount the same volume /dev/shm/qm:/dev/shm/qm for IPC and shared memory, but they use different SELinux security label types:

   • Server (root partition): SecurityLabelType=ipc_t
   • Client (QM partition): SecurityLabelType=qm_container_ipc_t

5. Create a Quadlet drop-in configuration file for the QM container to ensure the shared volumes are mounted. Create a 10-shm-demo.conf file:

   console --8<-- "demos/shared_memory_qm_root/10-shm-demo.conf"

   Note

   QM configuration is built into the partition and should not be changed. By using drop-in files, you can make additional modifications to the QM partition without overwriting the built-in configuration settings.

6. Configure the manifest file to copy the Quadlet files and create necessary directories:

   1. Add the directory for the QM container drop-in configuration:

      console --8<-- "demos/shared_memory_qm_root/shared_memory_qm_root.aib.yml:7:7" ... --8<-- "demos/shared_memory_qm_root/shared_memory_qm_root.aib.yml:24:28"

   2. Add the file copying configuration for all Quadlet files and configurations:

      console --8<-- "demos/shared_memory_qm_root/shared_memory_qm_root.aib.yml:7:7" ... --8<-- "demos/shared_memory_qm_root/shared_memory_qm_root.aib.yml:30:38"

   3. Copy the client Quadlet file to the QM partition:

      console --8<-- "demos/shared_memory_qm_root/shared_memory_qm_root.aib.yml:45:46" ... --8<-- "demos/shared_memory_qm_root/shared_memory_qm_root.aib.yml:65:67"

7. Configure the runtime directory creation by adding a systemd tmpfiles configuration. The demo includes a qm_ipc.conf file that creates the /run/ipc directory:

   console --8<-- "demos/shared_memory_qm_root/qm_ipc.conf"

   This file is copied to /usr/lib/tmpfiles.d/qm_ipc.conf as shown in the manifest file above.

Sample code

The following is a fully functioning demo code sample of an AIB manifest so that two containerized C applications will be added to separate partitions and will automatically start communicating through an IPC Unix domain socket and shared memory.

console title="Sample shared_memory_qm_root.aib.yml file" --8<-- "demos/shared_memory_qm_root/shared_memory_qm_root.aib.yml"

Next steps

• Now that you have configured the manifest and Quadlet unit files to set up communication between containers in different partitions using both IPC and shared memory, you can build your AutoSD OS image. For more information, see Building an image from a custom manifest.
• Alternatively, you can continue customizing your image. For more information, see Containerized applications.

Additional resources

• Sample Automotive Image Builder manifest
• Embedding containerized applications in the QM partition
• Configuring communication between containers in QM and root partitions