Configuring communication between containers in QM and root partitions¶

Cross-environment communication enables containers in the root partition to communicate with containers in the quality-managed (QM) partition using UNIX domain sockets. This configuration requires mounting a shared volume in both partitions and configuring appropriate SELinux security labels to enable inter-process communication (IPC) between the containers.

About the demo code¶

The demo code uses a pair of C applications packaged as containers — a server running in the root partition and a client running in the QM partition — that communicate over a UNIX domain socket at /run/ipc/ipc_server.socket.

To configure the AutoSD OS image build, the Automotive Image Builder (AIB) manifest file specifies:

The server container image to add to the root partition
The client container image to add to the QM partition
The Quadlet unit configurations for both applications
A shared volume mount at /run/ipc for socket communication

When the built AutoSD system starts, the server creates and binds to the UNIX domain socket, and the client connects to it, enabling IPC between the two applications running in separate partitions.

The sample Containerfiles and C source code available in the demo directory illustrate how to create these containerized applications with proper socket handling.

Prerequisites

A custom aib.yml Automotive Image Builder (AIB) manifest file, such as the manifest file that you created in Configuring communication between containers in the root partition

Procedure

Using Podman, create local containerized versions of the server and client applications using the sample code located in the demo code.

Note

The demo code includes C source files (echo-uds-server.c and echo-uds-client.c) and Containerfiles for building the applications. You can use the provided build.sh script to build both container images locally. For AIB to find the the built container images during the build process, you must run the build script as a user with elevated privileges: sudo bash build.sh builds both the application containers and the AutoSD OS image from the AIB manifest, and sudo bash build.sh --noimage builds only the application containers.

To copy the local container images to their respective partitions in the OS image, add the following sections to your manifest file:

Add the server container image to the root partition in the content section:

    container_images:
      # Get the auto-apps container image from gitlab
      - source: "localhost/ipc_server"
        tag: latest
        name: "localhost/ipc_server"
        containers-transport: containers-storage

Add the client container image to the QM partition in the qm section:

      # For testing the image only:
      - openssh-server
      - openssh-clients

    container_images:
      # Get the auto-apps container image from gitlab

Create Quadlet unit files for both the server and client containers:
1. Create an ipc_server.container Quadlet unit file for the server running in the root partition:
```
[Unit]
Description=Demo server service container

[Container]
Image=localhost/ipc_server
Volume=/run/ipc:/run/ipc
SecurityLabelType=ipc_t

[Install]
WantedBy=multi-user.target
```
2. Create an ipc_client.container Quadlet unit file for the client running in the QM partition:
```
[Unit]
Description=Demo client service container

[Container]
Image=localhost/ipc_client
Volume=/run/ipc:/run/ipc
SecurityLabelType=qm_container_ipc_t

[Install]
WantedBy=multi-user.target
```
Note

Both containers mount the same volume /run/ipc:/run/ipc but use different SELinux security label types:
- Server (root partition): SecurityLabelType=ipc_t
- Client (QM partition): SecurityLabelType=qm_container_ipc_t
Create a Quadlet drop-in configuration file for the QM container to ensure the shared volume is mounted. Create a 10-ipc-demo.conf file:
```
[Container]
Volume=/run/ipc:/run/ipc
```
Note

QM configuration is built into the partition and should not be changed. By using drop-in files, you can make additional modifications to the QM partition without overwriting the built-in configuration settings.

Configure the manifest file to copy the Quadlet files and create necessary directories:

Add the directory creation for the QM container drop-in configuration:

    make_dirs:
      - path: /etc/containers/systemd/qm.container.d
        mode: 0755
        parents: true
        exist_ok: true

Add the file copying configuration for all Quadlet files and configurations:

    add_files:
      - path: /etc/containers/systemd/qm.container.d/10-ipc-demo.conf
        source_path: ./10-ipc-demo.conf
      - path: /etc/containers/systemd/ipc_server.container
        source_path: ./ipc_server.container
      - path: /usr/lib/tmpfiles.d/qm_ipc.conf
        source_path: ./qm_ipc.conf

Copy the client Quadlet file to the QM partition:

        tag: latest
        name: "localhost/ipc_client"
        containers-transport: containers-storage

Configure the runtime directory creation by adding a systemd tmpfiles configuration. The demo includes a qm_ipc.conf file that creates the /run/ipc directory:
```
D! /run/ipc 0755 root root
```
This file is copied to /usr/lib/tmpfiles.d/qm_ipc.conf as shown in the manifest file above.

Sample code

The following is a fully functioning demo code sample of an AIB manifest so that two containerized C applications will be added to separate partitions and will automatically start communicating through an IPC Unix domain socket.

Sample ipc_between_qm_root_2.aib.yml file

# Example manifest building an image with two applications talking to each
# other over IPC (here an unix domain socket) between the QM partition and
# outside of it

name: ipc_between_qm_root_2

content:
    rpms:
      # For testing the image only:
      - openssh-server
      - openssh-clients

    container_images:
      # Get the auto-apps container image from gitlab
      - source: "localhost/ipc_server"
        tag: latest
        name: "localhost/ipc_server"
        containers-transport: containers-storage

    make_dirs:
      - path: /etc/containers/systemd/qm.container.d
        mode: 0755
        parents: true
        exist_ok: true

    add_files:
      - path: /etc/containers/systemd/qm.container.d/10-ipc-demo.conf
        source_path: ./10-ipc-demo.conf
      - path: /etc/containers/systemd/ipc_server.container
        source_path: ./ipc_server.container
      - path: /usr/lib/tmpfiles.d/qm_ipc.conf
        source_path: ./qm_ipc.conf
      - path: /usr/lib/systemd/system/ipc.socket
        source_path: ./ipc.socket

    systemd:
      enabled_services:
        # Enable ssh daemon - Required for testing the image only
        - sshd.service
        # Enable UDS socket for server-client communication
        - ipc.socket

qm:
  content:
    repos:
      - id: epel
        baseurl: https://dl.fedoraproject.org/pub/epel/10/Everything/$arch/
    rpms:
      - podman
      - vsomeip3-routingmanager
      - dlt-daemon
      # For testing the image only:
      - openssh-server
      - openssh-clients

    container_images:
      # Get the auto-apps container image from gitlab
      - source: "localhost/ipc_client"
        tag: latest
        name: "localhost/ipc_client"
        containers-transport: containers-storage

    add_files:
      - path: /etc/containers/systemd/ipc_client.container
        source_path: ./ipc_client.container

    systemd:
      enabled_services:
        # Enable the dlt daemon
        - dlt

auth:
  # "password"
  root_password: $6$xoLqEUz0cGGJRx01$H3H/bFm0myJPULNMtbSsOFd/2BnHqHkMD92Sfxd.EKM9hXTWSmELG8cf205l6dktomuTcgKGGtGDgtvHVXSWU.
  # Required for testing the image only:
  sshd_config:
    PasswordAuthentication: true
    PermitRootLogin: true

Next steps

Now that you have configured the manifest and Quadlet unit files to set up communication between containers in different partitions, you can build your AutoSD OS image. For more information, see Building an image from a custom manifest.
Alternatively, you can continue customizing your image. For more information, see Containerized applications.

Additional resources