opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-06 19:44:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

Create new network namespaces when initializing containers

Browse Source 
Also fix a few lingering lint issues

Signed-off-by: Matthew Heon <matthew.heon@gmail.com>

Closes: #109
Approved by: mheon
This commit is contained in:
Matthew Heon
2017-12-06 16:43:23 -05:00
committed by Atomic Bot
parent 0ff92f8e20
commit ff9c965335
3 changed files with 23 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
libpod/container.go
View File

@ -551,6 +551,20 @@ func (c *Container) Init() (err error) {
return err return err
} }
// Make a network namespace for the container
if c.config.CreateNetNS && c.state.NetNS == nil {
if err := c.runtime.createNetNS(c); err != nil {
return err
}
}
defer func() {
if err != nil {
if err2 := c.runtime.teardownNetNS(c); err2 != nil {
logrus.Errorf("Error tearing down network namespace for container %s: %v", c.ID(), err2)
}
}
}()
// If the OCI spec already exists, we need to replace it // If the OCI spec already exists, we need to replace it
// Cannot guarantee some things, e.g. network namespaces, have the same // Cannot guarantee some things, e.g. network namespaces, have the same
// paths // paths
@ -580,6 +594,10 @@ func (c *Container) Init() (err error) {
// Save OCI spec to disk // Save OCI spec to disk
g := generate.NewFromSpec(c.config.Spec) g := generate.NewFromSpec(c.config.Spec)
// If network namespace was requested, add it now
if c.config.CreateNetNS {
g.AddOrReplaceLinuxNamespace(spec.NetworkNamespace, c.state.NetNS.Path())
}
// Mount ShmDir from host into container // Mount ShmDir from host into container
g.AddBindMount(c.config.ShmDir, "/dev/shm", []string{"rw"}) g.AddBindMount(c.config.ShmDir, "/dev/shm", []string{"rw"})
// Bind mount resolv.conf // Bind mount resolv.conf

8
libpod/networking.go
View File

@ -20,19 +20,19 @@ func getPodNetwork(id, name, nsPath string, ports []ocicni.PortMapping) ocicni.P
// Create and configure a new network namespace for a container // Create and configure a new network namespace for a container
func (r *Runtime) createNetNS(ctr *Container) (err error) { func (r *Runtime) createNetNS(ctr *Container) (err error) {
ns, err := ns.NewNS() ctrNS, err := ns.NewNS()
if err != nil { if err != nil {
return errors.Wrapf(err, "error creating network namespace for container %s", ctr.ID()) return errors.Wrapf(err, "error creating network namespace for container %s", ctr.ID())
} }
defer func() { defer func() {
if err != nil { if err != nil {
if err2 := ns.Close(); err2 != nil { if err2 := ctrNS.Close(); err2 != nil {
logrus.Errorf("Error closing partially created network namespace for container %s: %v", ctr.ID(), err2) logrus.Errorf("Error closing partially created network namespace for container %s: %v", ctr.ID(), err2)
} }
} }
}() }()
podNetwork := getPodNetwork(ctr.ID(), ctr.Name(), ns.Path(), ctr.config.PortMappings) podNetwork := getPodNetwork(ctr.ID(), ctr.Name(), ctrNS.Path(), ctr.config.PortMappings)
if err := r.netPlugin.SetUpPod(podNetwork); err != nil { if err := r.netPlugin.SetUpPod(podNetwork); err != nil {
return errors.Wrapf(err, "error configuring network namespace for container %s", ctr.ID()) return errors.Wrapf(err, "error configuring network namespace for container %s", ctr.ID())
@ -40,7 +40,7 @@ func (r *Runtime) createNetNS(ctr *Container) (err error) {
// TODO hostport mappings for forwarded ports // TODO hostport mappings for forwarded ports
ctr.state.NetNS = ns ctr.state.NetNS = ctrNS
return nil return nil
} }

2
libpod/sql_state.go
View File

@ -482,7 +482,7 @@ func (s *SQLState) UpdateContainer(ctr *Container) error {
} }
newState.NetNS = ns newState.NetNS = ns
} }
} else { } else {
// The container no longer has a network namespace // The container no longer has a network namespace
// Tear down the old one // Tear down the old one
if err := s.runtime.teardownNetNS(ctr); err != nil { if err := s.runtime.teardownNetNS(ctr); err != nil {