libnetwork: provide endpoint name for IPAM drivers by olljanat · Pull Request #50586 · moby/moby

olljanat · 2025-07-31T19:49:53Z

- What I did
I'm building IPAM driver which integrates Docker and HashiCorp Nomad in way that it is possible dynamically allocate sub ranges (like can do manually with --ip-range) by utilizing Nomad namespace metadata.

So for example I would create network to Windows nodes like this:

docker network create `
  --driver transparent `
  --subnet 10.0.0.0/16 `
  --gateway 10.0.0.1 `
  containers

and to Linux nodes like this:

docker network create \
  -d ipvlan \
  --subnet 10.0.0.0/16 \
  --gateway 10.0.0.1 \
  --opt parent=eth0 \
  --opt ipvlan_mode=l2 \
  containers

And then create application environments with Nomad namespace configuration like this:

name = "example"
meta {
  subnet = "10.0.1.0/24"
}
name = "foobar"
meta {
  subnet = "10.0.2.0/24"
}

But it requires that IPAM driver knows that to which Nomad namespace container sending RequestAddress belongs to.

Initially I tried to solve that by enabling RequiresMACAddress capability and using that to find correct container and it's labels but it turns out that ContainerInspect cannot be called inside of RequestAddress function because libnetwork has locks enabled in that point.

So this PR provides minimal change to libnetwork allowing this to be done in IPAM drivers.

- How I did it
Added logic which will always send com.docker.network.endpoint.name label to IPAM driver containing name of the endpoint (=> name of the container).

That solves issue for me because containers naming is hardcoded in Nomad so I can simply parse allocation ID from it and call Read Allocation API

- How to verify it
In current form it it should not need anything more than pass CI. If maintainers want, this can be also put behind of capability flag but I don't think that it is necessary as it is just extra label.

EDIT: Plugin described above is now available in here and seems to be working fine with this.

- A picture of a cute animal (not mandatory but encouraged)

austinvazquez

Approach lgtm, just a minor suggestion.

olljanat · 2025-08-11T20:08:22Z

@akerouanton PTAL

akerouanton · 2025-08-12T07:42:49Z

 	var err error

-	ep := &Endpoint{name: name, generic: make(map[string]any), iface: &EndpointInterface{}}
+	ep := &Endpoint{name: name, generic: make(map[string]any), iface: &EndpointInterface{}, ipamOptions: map[string]string{netlabel.EndpointName: name}}


CreateOptionIpam overwrites ipamOptions:

moby/daemon/libnetwork/endpoint.go

Lines 1057 to 1072 in 16f2e81

func CreateOptionIpam(ipV4, ipV6 net.IP, llIPs []net.IP, ipamOptions map[string]string) EndpointOption {

return func(ep *Endpoint) {

ep.prefAddress = ipV4

ep.prefAddressV6 = ipV6

if len(llIPs) != 0 {

for _, ip := range llIPs {

nw := &net.IPNet{IP: ip, Mask: linkLocalMask}

if ip.To4() == nil {

nw.Mask = linkLocalMaskIPv6

}

ep.iface.llAddrs = append(ep.iface.llAddrs, nw)

}

}

ep.ipamOptions = ipamOptions

}

}

So, I believe this currently works because no CreateOptionIpam was passed to (*Network).CreateEndpoint(), which means no IPAM flags were specified on docker network create ….

Could you touch CreateOptionIpam up, and add a unit test please?

Ah, and it's probably worth putting &Endpoint{} instantiation on multiple lines to improve readability.

Afaiu options provided with docker network create --ipam-opt ... are only passed to IPAM driver functionRequestPool. Not to RequestAddress. So CreateOptionIpam will not need update but will add unit test for this.

So CreateOptionIpam will not need update but will add unit test for this.

Ah, right. I confused myself, sorry 🙈 You're changing createEndpoint, so it's definitely docker run --ip ….

For the record, I ran the following commands with breakpoints set before / after ep.processOptions(options...) and I can confirm that CreateOptionIpam removes the predefined endpoint name label.

$ docker network create --subnet 172.21.0.0/24 testnet $ docker run --rm --network testnet --ip 172.21.0.10 alpine true

One way to test this PR would be to add a test specifically for CreateOptionIpam. Call the func it returns with an endpoint initialized with a non-empty map of labels, and verify that CreateOptionIpam preserve them. (And you can remove the change you made in TestIpamReleaseOnNetDriverFailures as it's not related to this PR.)

Afaiu options provided with docker network create --ipam-opt ... are only passed to IPAM driver functionRequestPool. Not to RequestAddress.

Ah, right. I confused myself, sorry 🙈 You're changing createEndpoint, so it's definitely docker run --ip ….

For the record, I ran the following commands with breakpoints set before / after ep.processOptions(options...) and I can confirm that CreateOptionIpam removes the predefined endpoint name label.

$ docker network create --subnet 172.21.0.0/24 testnet $ docker run --rm --network testnet --ip 172.21.0.10 alpine true

One way to test this PR would be to add a test specifically for CreateOptionIpam. Call the func it returns with an endpoint initialized with a non-empty map of labels, and verify that CreateOptionIpam preserve them. (And you can remove the change you made in TestIpamReleaseOnNetDriverFailures as it's not related to this PR.)

Oh, my original solution was actually correct. It was change suggested in #50586 (comment) which broke case where --ip flag is used.

This cannot be handled in CreateOptionIpam because endpoint name is not known in there so perhaps it would be enough for now just leave comment for those who might touch this in future?

Also I think that ep.ipamOptions is always nil before initialization so it should not be needed to check it but let's see what is result of CI.

@akerouanton test added and verified that it would fail if ipamOptions was added in line 1188 like it was in f4a72b8 which you tested.

Ping also @corhere as I see that you self-requested a review for this.

EDIT: Ended up to disable new test in Windows because creating and removing networks like this will easily get HNS to unknown state and this is not OS specific logic.

akerouanton

A few nits, otherwise LGTM

Signed-off-by: Olli Janatuinen <[email protected]>

olljanat · 2025-08-28T09:13:07Z

A few nits, otherwise LGTM

@akerouanton Those are fixed now.

akerouanton

LGTM

olljanat force-pushed the endpoint-name-label branch from 6dc78eb to 827c0c7 Compare July 31, 2025 20:21

olljanat mentioned this pull request Jul 31, 2025

docker: validate namespace network mode limits hashicorp/nomad#26363

Closed

6 tasks

olljanat force-pushed the endpoint-name-label branch 2 times, most recently from e49bd02 to e934704 Compare July 31, 2025 21:08

austinvazquez reviewed Aug 5, 2025

View reviewed changes

Comment thread daemon/libnetwork/network.go Outdated

austinvazquez added kind/enhancement Enhancements are not bugs or new features but can improve usability or performance. area/networking Networking area/networking/ipam Networking labels Aug 5, 2025

austinvazquez added this to the 29.1.0 milestone Aug 5, 2025

olljanat force-pushed the endpoint-name-label branch from e934704 to 1f909d8 Compare August 5, 2025 13:19

austinvazquez approved these changes Aug 5, 2025

View reviewed changes

corhere self-requested a review August 5, 2025 16:21

akerouanton requested changes Aug 12, 2025

View reviewed changes

olljanat force-pushed the endpoint-name-label branch 3 times, most recently from f4a72b8 to d678c1d Compare August 14, 2025 17:20

olljanat force-pushed the endpoint-name-label branch 3 times, most recently from 6a4cb4e to 875f3b0 Compare August 25, 2025 19:59

akerouanton mentioned this pull request Aug 26, 2025

d/libnet: remove unused arg from CreateOptionIpam #50815

Merged

akerouanton reviewed Aug 26, 2025

View reviewed changes

Comment thread daemon/libnetwork/network.go Outdated

Comment thread daemon/libnetwork/libnetwork_internal_test.go Outdated

Comment thread daemon/libnetwork/libnetwork_internal_test.go Outdated

Comment thread daemon/libnetwork/libnetwork_internal_test.go Outdated

libnetwork: provide endpoint name for IPAM drivers

c6717f4

Signed-off-by: Olli Janatuinen <[email protected]>

olljanat force-pushed the endpoint-name-label branch from 875f3b0 to c6717f4 Compare August 28, 2025 07:55

akerouanton approved these changes Aug 28, 2025

View reviewed changes

corhere added this to 🔦 Maintainer spotlight Sep 4, 2025

github-project-automation Bot moved this to New in 🔦 Maintainer spotlight Sep 4, 2025

corhere approved these changes Sep 4, 2025

View reviewed changes

thaJeztah merged commit aead996 into moby:master Sep 4, 2025
175 checks passed

corhere modified the milestones: 29.1.0, 29.0.0 Sep 4, 2025

thompson-shaun moved this from New to Complete in 🔦 Maintainer spotlight Sep 4, 2025

	func CreateOptionIpam(ipV4, ipV6 net.IP, llIPs []net.IP, ipamOptions map[string]string) EndpointOption {
	return func(ep *Endpoint) {
	ep.prefAddress = ipV4
	ep.prefAddressV6 = ipV6
	if len(llIPs) != 0 {
	for _, ip := range llIPs {
	nw := &net.IPNet{IP: ip, Mask: linkLocalMask}
	if ip.To4() == nil {
	nw.Mask = linkLocalMaskIPv6
	}
	ep.iface.llAddrs = append(ep.iface.llAddrs, nw)
	}
	}
	ep.ipamOptions = ipamOptions
	}
	}

Conversation

olljanat commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

austinvazquez left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

olljanat commented Aug 11, 2025

Uh oh!

akerouanton Aug 12, 2025

Choose a reason for hiding this comment

Uh oh!

akerouanton Aug 12, 2025

Choose a reason for hiding this comment

Uh oh!

olljanat Aug 12, 2025

Choose a reason for hiding this comment

Uh oh!

akerouanton Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

akerouanton Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

olljanat Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

olljanat Aug 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akerouanton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

olljanat commented Aug 28, 2025

Uh oh!

akerouanton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

olljanat commented Jul 31, 2025 •

edited

Loading

akerouanton Aug 13, 2025 •

edited

Loading

olljanat Aug 14, 2025 •

edited

Loading

olljanat Aug 25, 2025 •

edited

Loading