Skip to content

Commit 0046b16

Browse files
corhererobmry
corhere
authored and
robmry
committed
daemon: set libnetwork sandbox key w/o OCI hook
Signed-off-by: Cory Snider <[email protected]>
1 parent 31ccdbb commit 0046b16

6 files changed

Lines changed: 68 additions & 25 deletions

File tree

‎daemon/oci_linux.go‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ import (
2323
"github.com/docker/docker/oci/caps"
2424
"github.com/docker/docker/pkg/idtools"
2525
"github.com/docker/docker/pkg/rootless/specconv"
26-
"github.com/docker/docker/pkg/stringid"
2726
volumemounts "github.com/docker/docker/volume/mounts"
2827
"github.com/moby/sys/mount"
2928
"github.com/moby/sys/mountinfo"
@@ -61,28 +60,6 @@ func withRlimits(daemon *Daemon, daemonCfg *dconfig.Config, c *container.Contain
6160
}
6261
}
6362

64-
// withLibnetwork sets the libnetwork hook
65-
func withLibnetwork(daemon *Daemon, daemonCfg *dconfig.Config, c *container.Container) coci.SpecOpts {
66-
return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
67-
if c.Config.NetworkDisabled {
68-
return nil
69-
}
70-
for _, ns := range s.Linux.Namespaces {
71-
if ns.Type == specs.NetworkNamespace && ns.Path == "" {
72-
if s.Hooks == nil {
73-
s.Hooks = &specs.Hooks{}
74-
}
75-
shortNetCtlrID := stringid.TruncateID(daemon.netController.ID())
76-
s.Hooks.Prestart = append(s.Hooks.Prestart, specs.Hook{
77-
Path: filepath.Join("/proc", strconv.Itoa(os.Getpid()), "exe"),
78-
Args: []string{"libnetwork-setkey", "-exec-root=" + daemonCfg.GetExecRoot(), c.ID, shortNetCtlrID},
79-
})
80-
}
81-
}
82-
return nil
83-
}
84-
}
85-
8663
// withRootless sets the spec to the rootless configuration
8764
func withRootless(daemon *Daemon, daemonCfg *dconfig.Config) coci.SpecOpts {
8865
return func(_ context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
@@ -1070,7 +1047,6 @@ func (daemon *Daemon) createSpec(ctx context.Context, daemonCfg *configStore, c
10701047
WithCapabilities(c),
10711048
WithSeccomp(daemon, c),
10721049
withMounts(daemon, daemonCfg, c, mounts),
1073-
withLibnetwork(daemon, &daemonCfg.Config, c),
10741050
WithApparmor(c),
10751051
WithSelinux(c),
10761052
WithOOMScore(&c.HostConfig.OomScoreAdj),

‎daemon/start.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,10 @@ func (daemon *Daemon) containerStart(ctx context.Context, daemonCfg *configStore
236236
}
237237
}()
238238

239+
if err := daemon.initializeCreatedTask(ctx, tsk, container, spec); err != nil {
240+
return err
241+
}
242+
239243
if err := tsk.Start(context.TODO()); err != nil { // passing ctx caused integration tests to be stuck in the cleanup phase
240244
return setExitCodeFromError(container.SetExitCode, err)
241245
}

‎daemon/start_linux.go‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
package daemon // import "github.com/docker/docker/daemon"
2+
3+
import (
4+
"context"
5+
"fmt"
6+
7+
specs "github.com/opencontainers/runtime-spec/specs-go"
8+
9+
"github.com/docker/docker/container"
10+
"github.com/docker/docker/errdefs"
11+
"github.com/docker/docker/libcontainerd/types"
12+
"github.com/docker/docker/oci"
13+
)
14+
15+
// initializeCreatedTask performs any initialization that needs to be done to
16+
// prepare a freshly-created task to be started.
17+
func (daemon *Daemon) initializeCreatedTask(ctx context.Context, tsk types.Task, container *container.Container, spec *specs.Spec) error {
18+
if !container.Config.NetworkDisabled {
19+
nspath, ok := oci.NamespacePath(spec, specs.NetworkNamespace)
20+
if ok && nspath == "" { // the runtime has been instructed to create a new network namespace for tsk.
21+
sb, err := daemon.netController.GetSandbox(container.ID)
22+
if err != nil {
23+
return errdefs.System(err)
24+
}
25+
if err := sb.SetKey(fmt.Sprintf("/proc/%d/ns/net", tsk.Pid())); err != nil {
26+
return errdefs.System(err)
27+
}
28+
}
29+
}
30+
return nil
31+
}

‎daemon/start_notlinux.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
//go:build !linux
2+
3+
package daemon // import "github.com/docker/docker/daemon"
4+
5+
import (
6+
"context"
7+
8+
"github.com/docker/docker/container"
9+
"github.com/docker/docker/libcontainerd/types"
10+
specs "github.com/opencontainers/runtime-spec/specs-go"
11+
)
12+
13+
// initializeCreatedTask performs any initialization that needs to be done to
14+
// prepare a freshly-created task to be started.
15+
func (daemon *Daemon) initializeCreatedTask(ctx context.Context, tsk types.Task, container *container.Container, spec *specs.Spec) error {
16+
return nil
17+
}

‎libnetwork/osl/namespace_linux.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,7 +226,11 @@ func NewSandbox(key string, osCreate, isRestore bool) (*Namespace, error) {
226226
}
227227

228228
func mountNetworkNamespace(basePath string, lnPath string) error {
229-
return syscall.Mount(basePath, lnPath, "bind", syscall.MS_BIND, "")
229+
err := syscall.Mount(basePath, lnPath, "bind", syscall.MS_BIND, "")
230+
if err != nil {
231+
return fmt.Errorf("bind-mount %s -> %s: %w", basePath, lnPath, err)
232+
}
233+
return nil
230234
}
231235

232236
// GetSandboxForExternalKey returns sandbox object for the supplied path

‎oci/namespaces.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,14 @@ func RemoveNamespace(s *specs.Spec, nsType specs.LinuxNamespaceType) {
1414
}
1515
}
1616
}
17+
18+
// NamespacePath returns the configured Path of the first namespace in
19+
// s.Linux.Namespaces of type nsType.
20+
func NamespacePath(s *specs.Spec, nsType specs.LinuxNamespaceType) (path string, ok bool) {
21+
for _, n := range s.Linux.Namespaces {
22+
if n.Type == nsType {
23+
return n.Path, true
24+
}
25+
}
26+
return "", false
27+
}

0 commit comments

Comments
 (0)