mirror of
https://github.com/containers/podman
synced 2024-10-19 16:54:07 +00:00
Merge pull request #6965 from giuseppe/followup-pr6324
allow switching of port-forward approaches in rootless/using slirp4netns
This commit is contained in:
commit
d86bae2a01
|
@ -2,6 +2,7 @@ package common
|
|||
|
||||
import (
|
||||
"net"
|
||||
"strings"
|
||||
|
||||
"github.com/containers/libpod/v2/cmd/podman/parse"
|
||||
"github.com/containers/libpod/v2/libpod/define"
|
||||
|
@ -164,11 +165,18 @@ func NetFlagsToNetOptions(cmd *cobra.Command) (*entities.NetOptions, error) {
|
|||
return nil, err
|
||||
}
|
||||
|
||||
parts := strings.SplitN(network, ":", 2)
|
||||
|
||||
ns, cniNets, err := specgen.ParseNetworkNamespace(network)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if len(parts) > 1 {
|
||||
opts.NetworkOptions = make(map[string][]string)
|
||||
opts.NetworkOptions[parts[0]] = strings.Split(parts[1], ",")
|
||||
cniNets = nil
|
||||
}
|
||||
opts.Network = ns
|
||||
opts.CNINetworks = cniNets
|
||||
}
|
||||
|
|
|
@ -417,6 +417,7 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *ContainerCLIOpts, args []string
|
|||
s.DNSOptions = c.Net.DNSOptions
|
||||
s.StaticIP = c.Net.StaticIP
|
||||
s.StaticMAC = c.Net.StaticMAC
|
||||
s.NetworkOptions = c.Net.NetworkOptions
|
||||
s.UseImageHosts = c.Net.NoHosts
|
||||
|
||||
s.ImageVolumeMode = c.ImageVolume
|
||||
|
|
|
@ -553,7 +553,10 @@ Valid values are:
|
|||
- `<network-name>|<network-id>`: connect to a user-defined network, multiple networks should be comma separated
|
||||
- `ns:<path>`: path to a network namespace to join
|
||||
- `private`: create a new namespace for the container (default)
|
||||
- `slirp4netns`: use slirp4netns to create a user network stack. This is the default for rootless containers
|
||||
- `slirp4netns[:OPTIONS,...]`: use slirp4netns to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options:
|
||||
**port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default.
|
||||
**port_handler=slirp4netns**: Use the slirp4netns port forwarding.
|
||||
**allow_host_loopback=true|false**: Allow the slirp4netns to reach the host loopback IP (`10.0.2.2`). Default to false.
|
||||
|
||||
**--network-alias**=*alias*
|
||||
|
||||
|
|
|
@ -561,7 +561,10 @@ Valid _mode_ values are:
|
|||
- _network-id_: connect to a user-defined network, multiple networks should be comma separated;
|
||||
- **ns:**_path_: path to a network namespace to join;
|
||||
- `private`: create a new namespace for the container (default)
|
||||
- **slirp4netns**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers.
|
||||
- **slirp4netns[:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options:
|
||||
**port_handler=rootlesskit**: Use rootlesskit for port forwarding. Default.
|
||||
**port_handler=slirp4netns**: Use the slirp4netns port forwarding.
|
||||
**allow_host_loopback=true|false**: Allow the slirp4netns to reach the host loopback IP (`10.0.2.2`). Default to false.
|
||||
|
||||
**--network-alias**=*alias*
|
||||
|
||||
|
|
|
@ -341,6 +341,8 @@ type ContainerConfig struct {
|
|||
Networks []string `json:"networks,omitempty"`
|
||||
// Network mode specified for the default network.
|
||||
NetMode namespaces.NetworkMode `json:"networkMode,omitempty"`
|
||||
// NetworkOptions are additional options for each network
|
||||
NetworkOptions map[string][]string `json:"network_options,omitempty"`
|
||||
|
||||
// Image Config
|
||||
|
||||
|
|
|
@ -173,6 +173,19 @@ type slirpFeatures struct {
|
|||
HasEnableSeccomp bool
|
||||
}
|
||||
|
||||
type slirp4netnsCmdArg struct {
|
||||
Proto string `json:"proto,omitempty"`
|
||||
HostAddr string `json:"host_addr"`
|
||||
HostPort int32 `json:"host_port"`
|
||||
GuestAddr string `json:"guest_addr"`
|
||||
GuestPort int32 `json:"guest_port"`
|
||||
}
|
||||
|
||||
type slirp4netnsCmd struct {
|
||||
Execute string `json:"execute"`
|
||||
Args slirp4netnsCmdArg `json:"arguments"`
|
||||
}
|
||||
|
||||
func checkSlirpFlags(path string) (*slirpFeatures, error) {
|
||||
cmd := exec.Command(path, "--help")
|
||||
out, err := cmd.CombinedOutput()
|
||||
|
@ -210,12 +223,33 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) error {
|
|||
havePortMapping := len(ctr.Config().PortMappings) > 0
|
||||
logPath := filepath.Join(ctr.runtime.config.Engine.TmpDir, fmt.Sprintf("slirp4netns-%s.log", ctr.config.ID))
|
||||
|
||||
isSlirpHostForward := false
|
||||
disableHostLoopback := true
|
||||
if ctr.config.NetworkOptions != nil {
|
||||
slirpOptions := ctr.config.NetworkOptions["slirp4netns"]
|
||||
for _, o := range slirpOptions {
|
||||
switch o {
|
||||
case "port_handler=slirp4netns":
|
||||
isSlirpHostForward = true
|
||||
case "port_handler=rootlesskit":
|
||||
isSlirpHostForward = false
|
||||
case "allow_host_loopback=true":
|
||||
disableHostLoopback = false
|
||||
case "allow_host_loopback=false":
|
||||
disableHostLoopback = true
|
||||
default:
|
||||
return errors.Errorf("unknown option for slirp4netns: %q", o)
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
cmdArgs := []string{}
|
||||
slirpFeatures, err := checkSlirpFlags(path)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "error checking slirp4netns binary %s: %q", path, err)
|
||||
}
|
||||
if slirpFeatures.HasDisableHostLoopback {
|
||||
if disableHostLoopback && slirpFeatures.HasDisableHostLoopback {
|
||||
cmdArgs = append(cmdArgs, "--disable-host-loopback")
|
||||
}
|
||||
if slirpFeatures.HasMTU {
|
||||
|
@ -228,6 +262,12 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) error {
|
|||
cmdArgs = append(cmdArgs, "--enable-seccomp")
|
||||
}
|
||||
|
||||
var apiSocket string
|
||||
if havePortMapping && isSlirpHostForward {
|
||||
apiSocket = filepath.Join(ctr.runtime.config.Engine.TmpDir, fmt.Sprintf("%s.net", ctr.config.ID))
|
||||
cmdArgs = append(cmdArgs, "--api-socket", apiSocket)
|
||||
}
|
||||
|
||||
// the slirp4netns arguments being passed are describes as follows:
|
||||
// from the slirp4netns documentation: https://github.com/rootless-containers/slirp4netns
|
||||
// -c, --configure Brings up the tap interface
|
||||
|
@ -291,7 +331,11 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) error {
|
|||
}
|
||||
|
||||
if havePortMapping {
|
||||
return r.setupRootlessPortMapping(ctr, netnsPath)
|
||||
if isSlirpHostForward {
|
||||
return r.setupRootlessPortMappingViaSlirp(ctr, cmd, apiSocket)
|
||||
} else {
|
||||
return r.setupRootlessPortMappingViaRLK(ctr, netnsPath)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
@ -342,7 +386,7 @@ func waitForSync(syncR *os.File, cmd *exec.Cmd, logFile io.ReadSeeker, timeout t
|
|||
return nil
|
||||
}
|
||||
|
||||
func (r *Runtime) setupRootlessPortMapping(ctr *Container, netnsPath string) error {
|
||||
func (r *Runtime) setupRootlessPortMappingViaRLK(ctr *Container, netnsPath string) error {
|
||||
syncR, syncW, err := os.Pipe()
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to open pipe")
|
||||
|
@ -419,6 +463,90 @@ func (r *Runtime) setupRootlessPortMapping(ctr *Container, netnsPath string) err
|
|||
return nil
|
||||
}
|
||||
|
||||
func (r *Runtime) setupRootlessPortMappingViaSlirp(ctr *Container, cmd *exec.Cmd, apiSocket string) (err error) {
|
||||
const pidWaitTimeout = 60 * time.Second
|
||||
chWait := make(chan error)
|
||||
go func() {
|
||||
interval := 25 * time.Millisecond
|
||||
for i := time.Duration(0); i < pidWaitTimeout; i += interval {
|
||||
// Check if the process is still running.
|
||||
var status syscall.WaitStatus
|
||||
pid, err := syscall.Wait4(cmd.Process.Pid, &status, syscall.WNOHANG, nil)
|
||||
if err != nil {
|
||||
break
|
||||
}
|
||||
if pid != cmd.Process.Pid {
|
||||
continue
|
||||
}
|
||||
if status.Exited() || status.Signaled() {
|
||||
chWait <- fmt.Errorf("slirp4netns exited with status %d", status.ExitStatus())
|
||||
}
|
||||
time.Sleep(interval)
|
||||
}
|
||||
}()
|
||||
defer close(chWait)
|
||||
|
||||
// wait that API socket file appears before trying to use it.
|
||||
if _, err := WaitForFile(apiSocket, chWait, pidWaitTimeout); err != nil {
|
||||
return errors.Wrapf(err, "waiting for slirp4nets to create the api socket file %s", apiSocket)
|
||||
}
|
||||
|
||||
// for each port we want to add we need to open a connection to the slirp4netns control socket
|
||||
// and send the add_hostfwd command.
|
||||
for _, i := range ctr.config.PortMappings {
|
||||
conn, err := net.Dial("unix", apiSocket)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "cannot open connection to %s", apiSocket)
|
||||
}
|
||||
defer func() {
|
||||
if err := conn.Close(); err != nil {
|
||||
logrus.Errorf("unable to close connection: %q", err)
|
||||
}
|
||||
}()
|
||||
hostIP := i.HostIP
|
||||
if hostIP == "" {
|
||||
hostIP = "0.0.0.0"
|
||||
}
|
||||
apiCmd := slirp4netnsCmd{
|
||||
Execute: "add_hostfwd",
|
||||
Args: slirp4netnsCmdArg{
|
||||
Proto: i.Protocol,
|
||||
HostAddr: hostIP,
|
||||
HostPort: i.HostPort,
|
||||
GuestPort: i.ContainerPort,
|
||||
},
|
||||
}
|
||||
// create the JSON payload and send it. Mark the end of request shutting down writes
|
||||
// to the socket, as requested by slirp4netns.
|
||||
data, err := json.Marshal(&apiCmd)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "cannot marshal JSON for slirp4netns")
|
||||
}
|
||||
if _, err := conn.Write([]byte(fmt.Sprintf("%s\n", data))); err != nil {
|
||||
return errors.Wrapf(err, "cannot write to control socket %s", apiSocket)
|
||||
}
|
||||
if err := conn.(*net.UnixConn).CloseWrite(); err != nil {
|
||||
return errors.Wrapf(err, "cannot shutdown the socket %s", apiSocket)
|
||||
}
|
||||
buf := make([]byte, 2048)
|
||||
readLength, err := conn.Read(buf)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "cannot read from control socket %s", apiSocket)
|
||||
}
|
||||
// if there is no 'error' key in the received JSON data, then the operation was
|
||||
// successful.
|
||||
var y map[string]interface{}
|
||||
if err := json.Unmarshal(buf[0:readLength], &y); err != nil {
|
||||
return errors.Wrapf(err, "error parsing error status from slirp4netns")
|
||||
}
|
||||
if e, found := y["error"]; found {
|
||||
return errors.Errorf("error from slirp4netns while setting up port redirection: %v", e)
|
||||
}
|
||||
}
|
||||
logrus.Debug("slirp4netns port-forwarding setup via add_hostfwd is ready")
|
||||
return nil
|
||||
}
|
||||
|
||||
// Configure the network namespace using the container process
|
||||
func (r *Runtime) setupNetNS(ctr *Container) error {
|
||||
nsProcess := fmt.Sprintf("/proc/%d/ns/net", ctr.state.PID)
|
||||
|
|
|
@ -1003,6 +1003,19 @@ func WithStaticIP(ip net.IP) CtrCreateOption {
|
|||
}
|
||||
}
|
||||
|
||||
// WithNetworkOptions sets additional options for the networks.
|
||||
func WithNetworkOptions(options map[string][]string) CtrCreateOption {
|
||||
return func(ctr *Container) error {
|
||||
if ctr.valid {
|
||||
return define.ErrCtrFinalized
|
||||
}
|
||||
|
||||
ctr.config.NetworkOptions = options
|
||||
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
// WithStaticMAC indicates that the container should request a static MAC from
|
||||
// the CNI plugins.
|
||||
// It cannot be set unless WithNetNS has already been passed.
|
||||
|
|
|
@ -42,6 +42,8 @@ type NetOptions struct {
|
|||
PublishPorts []specgen.PortMapping
|
||||
StaticIP *net.IP
|
||||
StaticMAC *net.HardwareAddr
|
||||
// NetworkOptions are additional options for each network
|
||||
NetworkOptions map[string][]string
|
||||
}
|
||||
|
||||
// All CLI inspect commands and inspect sub-commands use the same options
|
||||
|
|
|
@ -385,7 +385,7 @@ func (n NetworkMode) IsBridge() bool {
|
|||
|
||||
// IsSlirp4netns indicates if we are running a rootless network stack
|
||||
func (n NetworkMode) IsSlirp4netns() bool {
|
||||
return n == slirpType
|
||||
return n == slirpType || strings.HasPrefix(string(n), slirpType+":")
|
||||
}
|
||||
|
||||
// IsNS indicates a network namespace passed in by path (ns:<path>)
|
||||
|
|
|
@ -2,6 +2,7 @@ package generate
|
|||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
|
@ -226,7 +227,11 @@ func namespaceOptions(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.
|
|||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
toReturn = append(toReturn, libpod.WithNetNS(portMappings, postConfigureNetNS, "slirp4netns", nil))
|
||||
val := "slirp4netns"
|
||||
if s.NetNS.Value != "" {
|
||||
val = fmt.Sprintf("slirp4netns:%s", s.NetNS.Value)
|
||||
}
|
||||
toReturn = append(toReturn, libpod.WithNetNS(portMappings, postConfigureNetNS, val, nil))
|
||||
case specgen.Bridge:
|
||||
portMappings, err := createPortMappings(ctx, s, img)
|
||||
if err != nil {
|
||||
|
@ -261,6 +266,9 @@ func namespaceOptions(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.
|
|||
if s.StaticMAC != nil {
|
||||
toReturn = append(toReturn, libpod.WithStaticMAC(*s.StaticMAC))
|
||||
}
|
||||
if s.NetworkOptions != nil {
|
||||
toReturn = append(toReturn, libpod.WithNetworkOptions(s.NetworkOptions))
|
||||
}
|
||||
|
||||
return toReturn, nil
|
||||
}
|
||||
|
@ -465,7 +473,7 @@ func GetNamespaceOptions(ns []string) ([]libpod.PodCreateOption, error) {
|
|||
case "pid":
|
||||
options = append(options, libpod.WithPodPID())
|
||||
case "user":
|
||||
return erroredOptions, errors.Errorf("User sharing functionality not supported on pod level")
|
||||
continue
|
||||
case "ipc":
|
||||
options = append(options, libpod.WithPodIPC())
|
||||
case "uts":
|
||||
|
|
|
@ -108,7 +108,9 @@ func validateNetNS(n *Namespace) error {
|
|||
return nil
|
||||
}
|
||||
switch n.NSMode {
|
||||
case "", Default, Host, Path, FromContainer, FromPod, Private, NoNetwork, Bridge, Slirp:
|
||||
case Slirp:
|
||||
break
|
||||
case "", Default, Host, Path, FromContainer, FromPod, Private, NoNetwork, Bridge:
|
||||
break
|
||||
default:
|
||||
return errors.Errorf("invalid network %q", n.NSMode)
|
||||
|
@ -119,8 +121,8 @@ func validateNetNS(n *Namespace) error {
|
|||
if len(n.Value) < 1 {
|
||||
return errors.Errorf("namespace mode %s requires a value", n.NSMode)
|
||||
}
|
||||
} else {
|
||||
// All others must NOT set a string value
|
||||
} else if n.NSMode != Slirp {
|
||||
// All others except must NOT set a string value
|
||||
if len(n.Value) > 0 {
|
||||
return errors.Errorf("namespace value %s cannot be provided with namespace mode %s", n.Value, n.NSMode)
|
||||
}
|
||||
|
@ -250,7 +252,7 @@ func ParseNetworkNamespace(ns string) (Namespace, []string, error) {
|
|||
var cniNetworks []string
|
||||
// Net defaults to Slirp on rootless
|
||||
switch {
|
||||
case ns == "slirp4netns":
|
||||
case ns == "slirp4netns", strings.HasPrefix(ns, "slirp4netns:"):
|
||||
toReturn.NSMode = Slirp
|
||||
case ns == "pod":
|
||||
toReturn.NSMode = FromPod
|
||||
|
|
|
@ -379,6 +379,9 @@ type ContainerNetworkConfig struct {
|
|||
// Conflicts with UseImageHosts.
|
||||
// Optional.
|
||||
HostAdd []string `json:"hostadd,omitempty"`
|
||||
// NetworkOptions are additional options for each network
|
||||
// Optional.
|
||||
NetworkOptions map[string][]string `json:"network_options,omitempty"`
|
||||
}
|
||||
|
||||
// ContainerResourceConfig contains information on container resource limits.
|
||||
|
|
|
@ -235,6 +235,35 @@ var _ = Describe("Podman run networking", func() {
|
|||
Expect(ncBusy).To(ExitWithError())
|
||||
})
|
||||
|
||||
It("podman run network expose host port 8081 to container port 8000 using rootlesskit port handler", func() {
|
||||
session := podmanTest.Podman([]string{"run", "--network", "slirp4netns:port_handler=rootlesskit", "-dt", "-p", "8081:8000", ALPINE, "/bin/sh"})
|
||||
session.Wait(30)
|
||||
Expect(session.ExitCode()).To(Equal(0))
|
||||
|
||||
ncBusy := SystemExec("nc", []string{"-l", "-p", "8081"})
|
||||
Expect(ncBusy).To(ExitWithError())
|
||||
})
|
||||
|
||||
It("podman run network expose host port 8082 to container port 8000 using slirp4netns port handler", func() {
|
||||
session := podmanTest.Podman([]string{"run", "--network", "slirp4netns:port_handler=slirp4netns", "-dt", "-p", "8082:8000", ALPINE, "/bin/sh"})
|
||||
session.Wait(30)
|
||||
Expect(session.ExitCode()).To(Equal(0))
|
||||
ncBusy := SystemExec("nc", []string{"-l", "-p", "8082"})
|
||||
Expect(ncBusy).To(ExitWithError())
|
||||
})
|
||||
|
||||
It("podman run network expose host port 8080 to container port 8000 using invalid port handler", func() {
|
||||
session := podmanTest.Podman([]string{"run", "--network", "slirp4netns:port_handler=invalid", "-dt", "-p", "8080:8000", ALPINE, "/bin/sh"})
|
||||
session.Wait(30)
|
||||
Expect(session.ExitCode()).To(Not(Equal(0)))
|
||||
})
|
||||
|
||||
It("podman run slirp4netns network with host loopback", func() {
|
||||
session := podmanTest.Podman([]string{"run", "--network", "slirp4netns:allow_host_loopback=true", ALPINE, "ping", "-c1", "10.0.2.2"})
|
||||
session.Wait(30)
|
||||
Expect(session.ExitCode()).To(Equal(0))
|
||||
})
|
||||
|
||||
It("podman run network expose ports in image metadata", func() {
|
||||
session := podmanTest.Podman([]string{"create", "-dt", "-P", nginx})
|
||||
session.Wait(90)
|
||||
|
|
Loading…
Reference in a new issue