Allowed libnetwork caller to set ephemeral port #2461
Conversation
|
Please sign your commits following these rules: $ git clone -b "master" [email protected]:suwang48404/libnetwork.git somewhere
$ cd somewhere
$ git commit --amend -s --no-edit
$ git push -fAmending updates the existing PR. You DO NOT need to open a new one. |
37c2827 to
21902cc
Compare
selansen
changed the title
|
Pls edit description and rephrase it (coz now the commit message start in middle and starting explanation is missing). I still see "…ntime." |
Also reduce the allowed port range as the total number of containers per host is typically less than 1K. This change helps in scenarios where there are other services on the same host that uses ephemeral ports in iptables manipulation. The workflow requires changes in docker engine ( moby/moby#40055) and this change. It works as follows: 1. user can now specified to docker engine an option --published-port-range="50000-60000" as cmdline argument or in daemon.json. 2. docker engine read and pass this info to libnetwork via config.go:OptionDynamicPortRange. 3. libnetwork uses this range to allocate dynamic port henceforth. 4. --published-port-range can be set either via SIGHUP or restart docker engine 5. if --published-port-range is not set by user, a OS specific default range is used for dynamic port allocation. Linux: 49153-60999, Windows: 60000-65000 6 if --published-port-range is invalid, that is, the range given is outside of allowed default range, no change takes place. libnetwork will continue to use old/existing port range for dynamic port allocation. Signed-off-by: Su Wang <[email protected]>
| ) | ||
|
|
||
| func sanitizePortRange(start int, end int) (newStart, newEnd int, err error) { | ||
| if start > defaultPortRangeEnd || end < defaultPortRangeStart || start > end { |
There was a problem hiding this comment.
why do we need start > defaultPortRangeEnd || end < defaultPortRangeStart
There was a problem hiding this comment.
this is sanity check.
say initially, port range is set to 43456-60999, everything works great. Now a (naive) customer comes in and changes published-port-range 80000-90000 ( which is larger (2<<16-1)). libnetwork would reject this illegal range and continue to use existing/working range for port allocation.
4 participants
Also reduce the allowed port range as the total number of containers
per host is typically less than 1K.
This change helps in scenarios where there are other services on
the same host that uses ephemeral ports in iptables manipulation.
The workflow requires changes in docker engine (
moby/moby#40055) and this change. It
works as follows:
--published-port-range="50000-60000" as cmdline argument or
in daemon.json.
config.go:OptionDynamicPortRange.
restart docker engine
default range is used for dynamic port allocation.
Linux: 49153-60999, Windows: 60000-65000
6 if --published-port-range is invalid, that is, the range
given is outside of allowed default range, no change takes place.
libnetwork will continue to use old/existing port range for
dynamic port allocation.