opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-06 19:44:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

Do not configure CNI when slirp4netns is requested

Browse Source 
Our networking code bakes in a lot of assumptions about how
networking should work - that CNI is *always* used with root, and
that slirp4netns is *always* used only with rootless. These are
not safe assumptions. This fixes one particular issue, which
would cause CNI to also be run when slirp4netns was requested as
root.

Fixes: #4687

Signed-off-by: Matthew Heon <mheon@redhat.com>
This commit is contained in:
Matthew Heon
2020-01-13 11:10:10 -05:00
parent 9e2e4d7615
commit 6e2ed9ad2e
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libpod/networking_linux.go
View File

@ -148,7 +148,7 @@ func (r *Runtime) createNetNS(ctr *Container) (n ns.NetNS, q []*cnitypes.Result,
logrus.Debugf("Made network namespace at %s for container %s", ctrNS.Path(), ctr.ID()) logrus.Debugf("Made network namespace at %s for container %s", ctrNS.Path(), ctr.ID())
networkStatus := []*cnitypes.Result{} networkStatus := []*cnitypes.Result{}
if !rootless.IsRootless() { if !rootless.IsRootless() && ctr.config.NetMode != "slirp4netns" {
networkStatus, err = r.configureNetNS(ctr, ctrNS) networkStatus, err = r.configureNetNS(ctr, ctrNS)
} }
return ctrNS, networkStatus, err return ctrNS, networkStatus, err
@ -462,7 +462,7 @@ func (r *Runtime) teardownNetNS(ctr *Container) error {
logrus.Debugf("Tearing down network namespace at %s for container %s", ctr.state.NetNS.Path(), ctr.ID()) logrus.Debugf("Tearing down network namespace at %s for container %s", ctr.state.NetNS.Path(), ctr.ID())
// rootless containers do not use the CNI plugin // rootless containers do not use the CNI plugin
if !rootless.IsRootless() { if !rootless.IsRootless() && ctr.config.NetMode != "slirp4netns" {
var requestedIP net.IP var requestedIP net.IP
if ctr.requestedIP != nil { if ctr.requestedIP != nil {
requestedIP = ctr.requestedIP requestedIP = ctr.requestedIP