Skip to content

Commit 2fe34e8

Browse files
xibzxibz
committed
fixup! Add support for netns
Signed-off-by: xibz <[email protected]>
1 parent e66c08f commit 2fe34e8

File tree

6 files changed

+36
-152
lines changed

6 files changed

+36
-152
lines changed

‎go.sum

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,6 @@ github.com/docker/go-metrics v0.0.0-20181218153428-b84716841b82 h1:X0fj836zx99zF
5959
github.com/docker/go-metrics v0.0.0-20181218153428-b84716841b82/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
6060
github.com/docker/go-units v0.3.3 h1:Xk8S3Xj5sLGlG5g67hJmYMmUgXv5N4PhkjJHHqrwnTk=
6161
github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
62-
github.com/firecracker-microvm/firecracker-go-sdk v0.17.1-0.20191029213755-dbf9a1e05f09 h1:JDfRpK+V2J1Es+Xm6aMJjCqvA4xv1kuWnJfeSopyDwo=
63-
github.com/firecracker-microvm/firecracker-go-sdk v0.17.1-0.20191029213755-dbf9a1e05f09/go.mod h1:tVXziw7GjioCKVjI5/agymYxUaqJM6q7cp9e6kwjo8Q=
6462
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191108195453-43d336c3dcbf h1:HlqW7e7IwSIHBHJg4gBN6Kz9afSnEmB3+9e4/iTbBTw=
6563
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191108195453-43d336c3dcbf/go.mod h1:kW0gxvPpPvMukUxxTO9DrpSlScrtrTDGY3VgjAj/Qwc=
6664
github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb h1:D4uzjWwKYQ5XnAvUbuvHW93esHg7F8N/OYeBBcJoTr0=

‎runtime/cni_integ_test.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,7 @@ import (
3939
)
4040

4141
func TestCNISupport_Isolated(t *testing.T) {
42-
prepareIntegTest(t)
43-
42+
prepareIntegTest(t, withJailer())
4443
testTimeout := 120 * time.Second
4544
ctx, cancel := context.WithTimeout(namespaces.WithNamespace(context.Background(), defaultNamespace), testTimeout)
4645
defer cancel()

‎runtime/runc_jailer.go

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ import (
3636
"github.com/firecracker-microvm/firecracker-containerd/internal/vm"
3737
)
3838

39+
const (
40+
networkNamespaceRuncName = "network"
41+
)
42+
3943
// runcJailer uses runc to set up a jailed environment for the Firecracker VM.
4044
type runcJailer struct {
4145
ctx context.Context
@@ -99,7 +103,7 @@ func (j *runcJailer) JailPath() vm.Dir {
99103
// instance. In addition, some configuration values will be overwritten to the
100104
// jailed values, like SocketPath in the machineConfig.
101105
func (j *runcJailer) BuildJailedMachine(cfg *Config, machineConfig *firecracker.Config, vmID string) ([]firecracker.Opt, error) {
102-
handler := j.BuildJailedRootHandler(cfg, &machineConfig.SocketPath, vmID)
106+
handler := j.BuildJailedRootHandler(cfg, machineConfig, vmID)
103107
fifoHandler := j.BuildLinkFifoHandler()
104108
// Build a new client since BuildJailedRootHandler modifies the socket path value.
105109
client := firecracker.NewClient(machineConfig.SocketPath, j.logger, machineConfig.Debug)
@@ -130,10 +134,10 @@ func (j *runcJailer) BuildJailedMachine(cfg *Config, machineConfig *firecracker.
130134

131135
// BuildJailedRootHandler will populate the jail with the necessary files, which may be
132136
// device nodes, hard links, and/or bind-mount targets
133-
func (j *runcJailer) BuildJailedRootHandler(cfg *Config, socketPath *string, vmID string) firecracker.Handler {
137+
func (j *runcJailer) BuildJailedRootHandler(cfg *Config, machineConfig *firecracker.Config, vmID string) firecracker.Handler {
134138
ociBundlePath := j.OCIBundlePath()
135139
rootPath := j.RootPath()
136-
*socketPath = filepath.Join(rootPath, "api.socket")
140+
machineConfig.SocketPath = filepath.Join(rootPath, "api.socket")
137141

138142
return firecracker.Handler{
139143
Name: jailerHandlerName,
@@ -146,7 +150,7 @@ func (j *runcJailer) BuildJailedRootHandler(cfg *Config, socketPath *string, vmI
146150
}
147151

148152
j.logger.Debug("Overwritting process args of config")
149-
if err := j.overwriteConfig(cfg, filepath.Base(m.Cfg.SocketPath), rootPathToConfig); err != nil {
153+
if err := j.overwriteConfig(cfg, machineConfig, filepath.Base(m.Cfg.SocketPath), rootPathToConfig); err != nil {
150154
return errors.Wrap(err, "failed to overwrite config.json")
151155
}
152156

@@ -302,7 +306,7 @@ func (j *runcJailer) ExposeFileToJail(srcPath string) error {
302306
}
303307

304308
// copyFileToJail will copy a file from src to dst, and chown the new file to the jail user.
305-
func (j runcJailer) copyFileToJail(src, dst string, mode os.FileMode) error {
309+
func (j *runcJailer) copyFileToJail(src, dst string, mode os.FileMode) error {
306310
if err := copyFile(src, dst, mode); err != nil {
307311
return err
308312
}
@@ -363,7 +367,7 @@ func (j *runcJailer) jailerCommand(containerName string, isDebug bool) *exec.Cmd
363367
}
364368

365369
// overwriteConfig will set the proper default values if a field had not been set.
366-
func (j *runcJailer) overwriteConfig(cfg *Config, socketPath, configPath string) error {
370+
func (j *runcJailer) overwriteConfig(cfg *Config, machineConfig *firecracker.Config, socketPath, configPath string) error {
367371
var err error
368372
j.once.Do(func() {
369373
if configSpec == nil {
@@ -404,6 +408,16 @@ func (j *runcJailer) overwriteConfig(cfg *Config, socketPath, configPath string)
404408
spec.Process.User.UID = j.uid
405409
spec.Process.User.GID = j.gid
406410

411+
if machineConfig.NetNS != "" {
412+
for i, ns := range spec.Linux.Namespaces {
413+
if ns.Type == networkNamespaceRuncName {
414+
ns.Path = machineConfig.NetNS
415+
spec.Linux.Namespaces[i] = ns
416+
break
417+
}
418+
}
419+
}
420+
407421
configBytes, err := json.Marshal(&spec)
408422
if err != nil {
409423
return err
@@ -477,7 +491,7 @@ func getNetNS(spec *specs.Spec) string {
477491
}
478492

479493
for _, ns := range spec.Linux.Namespaces {
480-
if ns.Type == "network" {
494+
if ns.Type == networkNamespaceRuncName {
481495
return ns.Path
482496
}
483497
}

‎runtime/runc_jailer_test.go

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -61,22 +61,22 @@ func TestBuildJailedRootHandler_Isolated(t *testing.T) {
6161
KernelImagePath: kernelImagePath,
6262
RootDrive: rootDrivePath,
6363
}
64-
socketPath := "/path/to/api.socket"
64+
machineConfig := firecracker.Config{
65+
SocketPath: "/path/to/api.socket",
66+
KernelImagePath: kernelImagePath,
67+
Drives: []models.Drive{
68+
{
69+
PathOnHost: firecracker.String(rootDrivePath),
70+
IsRootDevice: firecracker.Bool(true),
71+
IsReadOnly: firecracker.Bool(true),
72+
},
73+
},
74+
}
6575
vmID := "foo"
66-
handler := jailer.BuildJailedRootHandler(&cfg, &socketPath, vmID)
76+
handler := jailer.BuildJailedRootHandler(&cfg, &machineConfig, vmID)
6777

6878
machine := firecracker.Machine{
69-
Cfg: firecracker.Config{
70-
SocketPath: socketPath,
71-
KernelImagePath: kernelImagePath,
72-
Drives: []models.Drive{
73-
{
74-
PathOnHost: firecracker.String(rootDrivePath),
75-
IsRootDevice: firecracker.Bool(true),
76-
IsReadOnly: firecracker.Bool(true),
77-
},
78-
},
79-
},
79+
Cfg: machineConfig,
8080
}
8181
err = handler.Fn(context.Background(), &machine)
8282
assert.NoError(t, err, "jailed handler failed to run")

‎tools/docker/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ COPY _submodules/firecracker/target/$FIRECRACKER_TARGET/release/firecracker /usr
152152
COPY _submodules/firecracker/target/$FIRECRACKER_TARGET/release/jailer /usr/local/bin/
153153
COPY _submodules/runc/runc /usr/local/bin
154154
COPY tools/image-builder/rootfs.img /var/lib/firecracker-containerd/runtime/default-rootfs.img
155-
COPY tools/docker//firecracker-runc-config.json /etc/containerd/firecracker-runc-config.json
155+
COPY runtime/firecracker-runc-config.json.example /etc/containerd/firecracker-runc-config.json
156156

157157
# pull the images the tests need into the content store so we don't need internet
158158
# access during the tests themselves

‎tools/docker/firecracker-runc-config.json

Lines changed: 0 additions & 127 deletions
This file was deleted.

0 commit comments

Comments
 (0)