[rootless] Support detach netns #2535
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| 74baab4363ff68d060c788605f5bc5979d3c662f0351b033ae874a3a72e6ebce rootlesskit-aarch64.tar.gz | ||
| 630dce1a26263d6a7a9461656f3e004c63386b7d4ca71fdaaa37cd075e0f677c rootlesskit-armv7l.tar.gz | ||
| 4377eb874bb202b7a00354b0924898de81d818753ac730cee8d16262eadd5617 rootlesskit-ppc64le.tar.gz | ||
| 92861409fa4db5e8344a1b5409ea4e5cb47fa7db706b4647ff627e15bc806ffc rootlesskit-riscv64.tar.gz | ||
| 5ea02fba90e5656660aa7eca66aece2b5c3207e01d147495da2f55cfb4726663 rootlesskit-s390x.tar.gz | ||
| 3db2ac3022efc7d030f48fb60a0d568e9dcf8700bb3e0c926e02a4b080caa629 rootlesskit-x86_64.tar.gz |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| /* | ||
| Copyright The containerd Authors. | ||
|
|
||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
|
|
||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
|
|
||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package container | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "path/filepath" | ||
|
|
||
| "github.com/containerd/containerd/oci" | ||
| "github.com/containernetworking/plugins/pkg/ns" | ||
| "github.com/opencontainers/runtime-spec/specs-go" | ||
| "github.com/rootless-containers/rootlesskit/v2/pkg/child" | ||
| ) | ||
|
|
||
| func newContainerDetachNetNs(stateDir, id string, opts *[]oci.SpecOpts) error { | ||
| return ns.WithNetNSPath(filepath.Join(stateDir, "netns"), func(_ ns.NetNS) error { | ||
| containerDetachNetNs := filepath.Join(stateDir, fmt.Sprintf("netns-%s", id)) | ||
| if err := child.NewNetNsWithPathWithoutEnter(containerDetachNetNs); err != nil { | ||
| return err | ||
| } | ||
| *opts = append(*opts, oci.WithLinuxNamespace(specs.LinuxNamespace{ | ||
| Type: specs.NetworkNamespace, | ||
| Path: containerDetachNetNs, | ||
| })) | ||
| return nil | ||
| }) | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| //go:build !linux | ||
|
|
||
| /* | ||
| Copyright The containerd Authors. | ||
|
|
||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
|
|
||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
|
|
||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package container | ||
|
|
||
| import "github.com/containerd/containerd/oci" | ||
|
|
||
| func newContainerDetachNetNs(_, _ string, _ *[]oci.SpecOpts) error { | ||
| //no op for !linux | ||
| return nil | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -27,6 +27,8 @@ import ( | |
| "path/filepath" | ||
| "strings" | ||
|
|
||
| "runtime" | ||
|
|
||
| gocni "github.com/containerd/go-cni" | ||
| "github.com/containerd/log" | ||
| "github.com/containerd/nerdctl/pkg/bypass4netnsutil" | ||
|
|
@@ -38,9 +40,9 @@ import ( | |
| "github.com/containerd/nerdctl/pkg/rootlessutil" | ||
| types100 "github.com/containernetworking/cni/pkg/types/100" | ||
| "github.com/opencontainers/runtime-spec/specs-go" | ||
| b4nndclient "github.com/rootless-containers/bypass4netns/pkg/api/daemon/client" | ||
| rlkclient "github.com/rootless-containers/rootlesskit/pkg/api/client" | ||
| "github.com/vishvananda/netns" | ||
| ) | ||
|
|
||
| const ( | ||
|
|
@@ -86,6 +88,24 @@ func Run(stdin io.Reader, stderr io.Writer, event, dataStore, cniPath, cniNetcon | |
| return err | ||
| } | ||
|
|
||
| detachNetNs, err := rootlessutil.DetectRootlesskitFeature("--detach-netns") | ||
| if err != nil { | ||
| return err | ||
| } | ||
| if rootlessutil.IsRootlessChild() && detachNetNs { | ||
| stateDir, err := rootlessutil.RootlessKitStateDir() | ||
| if err != nil { | ||
| return err | ||
| } | ||
| ns, err := netns.GetFromPath(filepath.Join(stateDir, "netns")) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| if err = netns.Set(ns); err != nil { | ||
| return fmt.Errorf("switch to detached netns: %w", err) | ||
| } | ||
| } | ||
|
|
||
| switch event { | ||
| case "createRuntime": | ||
| return onCreateRuntime(opts) | ||
|
|
@@ -268,16 +288,15 @@ func getExtraHosts(state *specs.State) (map[string]string, error) { | |
|
|
||
| func getNetNSPath(state *specs.State) (string, error) { | ||
| // If we have a network-namespace annotation we use it over the passed Pid. | ||
| if netNsPath, netNsFound := state.Annotations[NetworkNamespace]; netNsFound { | ||
| if _, err := os.Stat(netNsPath); err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| return netNsPath, nil | ||
| } | ||
|
|
||
| if state.Pid == 0 { | ||
| return "", errors.New("both state.Pid and the netNs annotation are unset") | ||
| } | ||
|
|
||
|
|
@@ -403,10 +422,15 @@ func onCreateRuntime(opts *handlerOpts) error { | |
| ExtraHosts: opts.extraHosts, | ||
| Name: opts.state.Annotations[labels.Name], | ||
| } | ||
| runtime.LockOSThread() | ||
| // nsents verified here we are in detached netwoprk ns | ||
| // nsPath verified is pointing to the nested detached ns | ||
| // user ns is the detch user ns | ||
| cniRes, err := opts.cni.Setup(ctx, opts.fullID, nsPath, namespaceOpts...) | ||
|
There was a problem hiding this comment. https://github.com/containerd/nerdctl/actions/runs/6683660354/job/18160087021?pr=2535 There was a problem hiding this comment. Can you dump There was a problem hiding this comment. Maybe we need to re-exec the ocihook process to gain the caps There was a problem hiding this comment. There was a problem hiding this comment.
@AkihiroSuda There was a problem hiding this comment. hasCaps() There was a problem hiding this comment. Some progress in: We can just run the hook with |
||
| if err != nil { | ||
| return fmt.Errorf("failed to call cni.Setup: %w", err) | ||
| } | ||
| runtime.UnlockOSThread() | ||
| cniResRaw := cniRes.Raw() | ||
| for i, cniName := range opts.cniNames { | ||
| hsMeta.Networks[cniName] = cniResRaw[i] | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| //go:build !linux | ||
|
|
||
| /* | ||
| Copyright The containerd Authors. | ||
|
|
||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
|
|
||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
|
|
||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package rootlessutil | ||
|
|
||
| func RootlessKitStateDir() (string, error) { | ||
| // no op for !linux | ||
| return "", nil | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.