Skip to content

Commit 933fcc9

Browse files
robmryrobmry
committed
Re-remove the SetKey OCI prestart hook
Second attempt to stop using the OCI prestart hook to call SetKey to set up the OS Sandbox's key and perform network config in the new network namespace. The first attempt was reverted because it made it impossible to use --sysctl to set per-interface sysctls on an interface that had not yet been moved into the new network namespace. Now, per-interface sysctls can be used to do that (with less ambiguity because the setting is not tied to the interface using an unpredictably assigned name). Signed-off-by: Rob Murray <[email protected]>
1 parent 6ac445c commit 933fcc9

3 files changed

Lines changed: 18 additions & 60 deletions

File tree

‎daemon/oci_linux.go‎

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,11 @@ import (
1717
"github.com/docker/docker/container"
1818
dconfig "github.com/docker/docker/daemon/config"
1919
"github.com/docker/docker/errdefs"
20-
"github.com/docker/docker/internal/otelutil"
2120
"github.com/docker/docker/internal/rootless/mountopts"
2221
"github.com/docker/docker/internal/rootless/specconv"
2322
"github.com/docker/docker/oci"
2423
"github.com/docker/docker/oci/caps"
2524
"github.com/docker/docker/pkg/idtools"
26-
"github.com/docker/docker/pkg/stringid"
2725
volumemounts "github.com/docker/docker/volume/mounts"
2826
"github.com/moby/sys/mount"
2927
"github.com/moby/sys/mountinfo"
@@ -32,7 +30,6 @@ import (
3230
"github.com/opencontainers/runc/libcontainer/cgroups"
3331
"github.com/opencontainers/runtime-spec/specs-go"
3432
"github.com/pkg/errors"
35-
"go.opentelemetry.io/otel"
3633
)
3734

3835
const inContainerInitPath = "/sbin/" + dconfig.DefaultInitBinary
@@ -62,33 +59,6 @@ func withRlimits(daemon *Daemon, daemonCfg *dconfig.Config, c *container.Contain
6259
}
6360
}
6461

65-
// withLibnetwork sets the libnetwork hook
66-
func withLibnetwork(daemon *Daemon, daemonCfg *dconfig.Config, c *container.Container) coci.SpecOpts {
67-
return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
68-
if c.Config.NetworkDisabled {
69-
return nil
70-
}
71-
for _, ns := range s.Linux.Namespaces {
72-
if ns.Type == specs.NetworkNamespace && ns.Path == "" {
73-
if s.Hooks == nil {
74-
s.Hooks = &specs.Hooks{}
75-
}
76-
shortNetCtlrID := stringid.TruncateID(daemon.netController.ID())
77-
78-
var carrier otelutil.EnvironCarrier
79-
otel.GetTextMapPropagator().Inject(ctx, &carrier)
80-
81-
s.Hooks.Prestart = append(s.Hooks.Prestart, specs.Hook{ //nolint:staticcheck // FIXME(thaJeztah); replace prestart hook with a non-deprecated one.
82-
Path: filepath.Join("/proc", strconv.Itoa(os.Getpid()), "exe"),
83-
Env: carrier.Environ(),
84-
Args: []string{"libnetwork-setkey", "-exec-root=" + daemonCfg.GetExecRoot(), c.ID, shortNetCtlrID},
85-
})
86-
}
87-
}
88-
return nil
89-
}
90-
}
91-
9262
// withRootless sets the spec to the rootless configuration
9363
func withRootless(daemon *Daemon, daemonCfg *dconfig.Config) coci.SpecOpts {
9464
return func(_ context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
@@ -1038,7 +1008,6 @@ func (daemon *Daemon) createSpec(ctx context.Context, daemonCfg *configStore, c
10381008
WithCapabilities(c),
10391009
WithSeccomp(daemon, c),
10401010
withMounts(daemon, daemonCfg, c, mounts),
1041-
withLibnetwork(daemon, &daemonCfg.Config, c),
10421011
WithApparmor(c),
10431012
WithSelinux(c),
10441013
WithOOMScore(&c.HostConfig.OomScoreAdj),

‎daemon/start_linux.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package daemon // import "github.com/docker/docker/daemon"
22

33
import (
44
"context"
5+
"fmt"
56

67
"github.com/docker/docker/container"
78
"github.com/docker/docker/errdefs"
@@ -24,7 +25,9 @@ func (daemon *Daemon) initializeCreatedTask(ctx context.Context, tsk types.Task,
2425
if err != nil {
2526
return errdefs.System(err)
2627
}
27-
return sb.FinishConfig(ctx)
28+
if err := sb.SetKey(ctx, fmt.Sprintf("/proc/%d/ns/net", tsk.Pid())); err != nil {
29+
return errdefs.System(err)
30+
}
2831
}
2932
}
3033
return nil

‎libnetwork/sandbox_linux.go‎

Lines changed: 14 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,12 @@ func (sb *Sandbox) updateGateway(ep *Endpoint) error {
9696
return fmt.Errorf("failed to set gateway while updating gateway: %v", err)
9797
}
9898

99-
if err := osSbox.SetGatewayIPv6(joinInfo.gw6); err != nil {
100-
return fmt.Errorf("failed to set IPv6 gateway while updating gateway: %v", err)
99+
// If IPv6 has been disabled in the sandbox a gateway may still have been
100+
// configured, don't attempt to apply it.
101+
if ipv6, _ := sb.ipv6Enabled(); ipv6 {
102+
if err := osSbox.SetGatewayIPv6(joinInfo.gw6); err != nil {
103+
return fmt.Errorf("failed to set IPv6 gateway while updating gateway: %v", err)
104+
}
101105
}
102106

103107
return nil
@@ -164,10 +168,8 @@ func (sb *Sandbox) SetKey(ctx context.Context, basePath string) error {
164168
}
165169
}
166170

167-
// Set up hosts and resolv.conf files. IPv6 support in the container can't be
168-
// determined yet, as sysctls haven't been applied by the runtime. Calling
169-
// FinishInit after the container task has been created, when sysctls have been
170-
// applied will regenerate these files.
171+
// Set up hosts and resolv.conf files.
172+
osSbox.RefreshIPv6LoEnabled()
171173
if err := sb.finishInitDNS(ctx); err != nil {
172174
return err
173175
}
@@ -181,27 +183,6 @@ func (sb *Sandbox) SetKey(ctx context.Context, basePath string) error {
181183
return nil
182184
}
183185

184-
// FinishConfig completes Sandbox configuration. If called after the container task has been
185-
// created, and sysctl settings applied, the configuration will be based on the container's
186-
// IPv6 support.
187-
func (sb *Sandbox) FinishConfig(ctx context.Context) error {
188-
if sb.config.useDefaultSandBox {
189-
return nil
190-
}
191-
192-
sb.mu.Lock()
193-
osSbox := sb.osSbox
194-
sb.mu.Unlock()
195-
if osSbox == nil {
196-
return nil
197-
}
198-
199-
// If sysctl changes have been made, IPv6 may have been enabled/disabled since last checked.
200-
osSbox.RefreshIPv6LoEnabled()
201-
202-
return sb.finishInitDNS(ctx)
203-
}
204-
205186
// IPv6 support can always be determined for host networking. For other network
206187
// types it can only be determined once there's a container namespace to probe,
207188
// return ok=false in that case.
@@ -314,7 +295,12 @@ func (sb *Sandbox) populateNetworkResources(ctx context.Context, ep *Endpoint) e
314295

315296
ifaceOptions = append(ifaceOptions, osl.WithIPv4Address(i.addr), osl.WithRoutes(i.routes))
316297
if i.addrv6 != nil && i.addrv6.IP.To16() != nil {
317-
ifaceOptions = append(ifaceOptions, osl.WithIPv6Address(i.addrv6))
298+
// If IPv6 has been disabled in the Sandbox, an IPv6 address will still have
299+
// been allocated. Don't apply it, because doing so would enable IPv6 on the
300+
// interface.
301+
if ipv6, ok := sb.ipv6Enabled(); !ok || ipv6 {
302+
ifaceOptions = append(ifaceOptions, osl.WithIPv6Address(i.addrv6))
303+
}
318304
}
319305
if len(i.llAddrs) != 0 {
320306
ifaceOptions = append(ifaceOptions, osl.WithLinkLocalAddresses(i.llAddrs))

0 commit comments

Comments
 (0)