Skip to content

Commit a7af606

Browse files
xibzxibz
committed
Adding netns to jailer
This adds netns specification per create vm request. In the event that no netns was found in the runc config, we will then make sure of what was passed into the create vm request Signed-off-by: xibz <[email protected]>
1 parent eaa0b20 commit a7af606

File tree

6 files changed

+44
-34
lines changed

6 files changed

+44
-34
lines changed

‎runtime/firecracker-runc-config.json.example

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -96,9 +96,6 @@
9696
{
9797
"type": "pid"
9898
},
99-
{
100-
"type": "network"
101-
},
10299
{
103100
"type": "ipc"
104101
},

‎runtime/jailer.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,5 +72,5 @@ func newJailer(
7272
}
7373

7474
l := logger.WithField("jailer", "runc")
75-
return newRuncJailer(ctx, l, ociBundlePath, service.config.JailerConfig.RuncBinaryPath, jailerUID, jailerGID)
75+
return newRuncJailer(ctx, l, ociBundlePath, service.config.JailerConfig.RuncBinaryPath, request)
7676
}

‎runtime/runc_jailer.go

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232

3333
"github.com/firecracker-microvm/firecracker-containerd/internal"
3434
"github.com/firecracker-microvm/firecracker-containerd/internal/vm"
35+
"github.com/firecracker-microvm/firecracker-containerd/proto"
3536
)
3637

3738
// runcJailer uses runc to set up a jailed environment for the Firecracker VM.
@@ -45,19 +46,24 @@ type runcJailer struct {
4546
runcBinaryPath string
4647
uid uint32
4748
gid uint32
49+
netns string
4850
}
4951

50-
func newRuncJailer(ctx context.Context, logger *logrus.Entry, ociBundlePath, runcBinPath string, uid, gid uint32) (*runcJailer, error) {
52+
func newRuncJailer(ctx context.Context, logger *logrus.Entry, ociBundlePath, runcBinPath string, req *proto.CreateVMRequest) (*runcJailer, error) {
5153
l := logger.WithField("ociBundlePath", ociBundlePath).
5254
WithField("runcBinaryPath", runcBinPath)
55+
if req.JailerConfig == nil {
56+
return nil, fmt.Errorf("no jailer configuration specified")
57+
}
5358

5459
j := &runcJailer{
5560
ctx: ctx,
5661
logger: l,
5762
ociBundlePath: ociBundlePath,
5863
runcBinaryPath: runcBinPath,
59-
uid: uid,
60-
gid: gid,
64+
uid: jailerUID,
65+
gid: jailerGID,
66+
netns: req.JailerConfig.NetworkNamespace,
6167
}
6268

6369
rootPath := j.RootPath()
@@ -330,8 +336,6 @@ func (j runcJailer) jailerCommand(containerName string) *exec.Cmd {
330336
}
331337

332338
// overwriteConfig will set the proper default values if a field had not been set.
333-
//
334-
// TODO: Add netns
335339
func (j runcJailer) overwriteConfig(cfg *Config, socketPath, configPath string) error {
336340
spec := specs.Spec{}
337341
configBytes, err := ioutil.ReadFile(configPath)
@@ -359,6 +363,13 @@ func (j runcJailer) overwriteConfig(cfg *Config, socketPath, configPath string)
359363
spec.Process.User.UID = j.uid
360364
spec.Process.User.GID = j.gid
361365

366+
if len(j.netns) > 0 && !hasNetworkNamespace(spec.Linux.Namespaces) {
367+
spec.Linux.Namespaces = append(spec.Linux.Namespaces, specs.LinuxNamespace{
368+
Type: "network",
369+
Path: j.netns,
370+
})
371+
}
372+
362373
configBytes, err = json.Marshal(&spec)
363374
if err != nil {
364375
return err
@@ -403,3 +414,13 @@ func mkdirAndChown(path string, mode os.FileMode, uid, gid uint32) error {
403414

404415
return nil
405416
}
417+
418+
func hasNetworkNamespace(namespaces []specs.LinuxNamespace) bool {
419+
for _, namespace := range namespaces {
420+
if namespace.Type == specs.LinuxNamespaceType("network") {
421+
return true
422+
}
423+
}
424+
425+
return false
426+
}

‎runtime/runc_jailer_test.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727
"github.com/stretchr/testify/require"
2828

2929
"github.com/firecracker-microvm/firecracker-containerd/internal"
30+
"github.com/firecracker-microvm/firecracker-containerd/proto"
3031
)
3132

3233
func TestBuildJailedRootHandler_Isolated(t *testing.T) {
@@ -52,7 +53,9 @@ func TestBuildJailedRootHandler_Isolated(t *testing.T) {
5253
defer firecrackerFd.Close()
5354

5455
l := logrus.NewEntry(logrus.New())
55-
jailer, err := newRuncJailer(context.Background(), l, dir, "bin-path", 123, 456)
56+
jailer, err := newRuncJailer(context.Background(), l, dir, "bin-path", &proto.CreateVMRequest{
57+
JailerConfig: &proto.JailerConfig{},
58+
})
5659
require.NoError(t, err, "failed to create runc jailer")
5760

5861
cfg := Config{

‎runtime/service_integ_test.go

Lines changed: 13 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ import (
3737
"github.com/containerd/containerd/pkg/ttrpcutil"
3838
"github.com/containerd/containerd/runtime"
3939
"github.com/containerd/typeurl"
40+
"github.com/containernetworking/plugins/pkg/ns"
4041
"github.com/opencontainers/runtime-spec/specs-go"
4142
"github.com/pkg/errors"
4243
"github.com/shirou/gopsutil/process"
@@ -225,6 +226,8 @@ func TestMultipleVMs_Isolated(t *testing.T) {
225226
cfg.JailerConfig.RuncBinaryPath = "/usr/local/bin/runc"
226227
})
227228

229+
netns, err := ns.GetCurrentNS()
230+
228231
cases := []struct {
229232
MaxContainers int32
230233
JailerConfig *proto.JailerConfig
@@ -240,11 +243,15 @@ func TestMultipleVMs_Isolated(t *testing.T) {
240243
},
241244
{
242245
MaxContainers: 3,
243-
JailerConfig: &proto.JailerConfig{},
246+
JailerConfig: &proto.JailerConfig{
247+
NetworkNamespace: netns.Path(),
248+
},
244249
},
245250
{
246251
MaxContainers: 3,
247-
JailerConfig: &proto.JailerConfig{},
252+
JailerConfig: &proto.JailerConfig{
253+
NetworkNamespace: netns.Path(),
254+
},
248255
},
249256
}
250257

@@ -273,6 +280,7 @@ func TestMultipleVMs_Isolated(t *testing.T) {
273280

274281
tapName := fmt.Sprintf("tap%d", vmID)
275282
err = createTapDevice(ctx, tapName)
283+
276284
require.NoError(t, err, "failed to create tap device for vm %d", vmID)
277285

278286
rootfsPath := defaultVMRootfsPath
@@ -300,10 +308,6 @@ func TestMultipleVMs_Isolated(t *testing.T) {
300308
JailerConfig: jailerConfig,
301309
}
302310

303-
if jailerConfig != nil {
304-
req.NetworkInterfaces = nil
305-
}
306-
307311
_, err = fcClient.CreateVM(ctx, req)
308312
require.NoError(t, err, "failed to create vm")
309313

@@ -320,13 +324,6 @@ func TestMultipleVMs_Isolated(t *testing.T) {
320324
fmt.Sprintf("/bin/sleep %d", testTimeout/time.Second),
321325
}, " && "))
322326

323-
if jailerConfig != nil {
324-
// TODO: this if statement block can go away once we add netns
325-
processArgs = oci.WithProcessArgs("/bin/sh", "-c", strings.Join([]string{
326-
fmt.Sprintf("/bin/sleep %d", testTimeout/time.Second),
327-
}, " && "))
328-
}
329-
330327
// spawn a container that just prints the VM's eth0 mac address (which we have set uniquely per VM)
331328
newContainer, err := client.NewContainer(ctx,
332329
containerName,
@@ -455,20 +452,13 @@ func TestMultipleVMs_Isolated(t *testing.T) {
455452

456453
stdoutLines := strings.Split(strings.TrimSpace(taskStdout.String()), "\n")
457454
lines := 2
458-
if jailerConfig != nil {
459-
lines = 1
460-
}
461455
require.Len(t, stdoutLines, lines)
462456

463457
printedVMID := strings.TrimSpace(stdoutLines[0])
464-
// TODO: Remove this if statement once we can add a netns which
465-
// will allow firecracker to have visibility of the tap devices.
466-
if jailerConfig == nil {
467-
require.Equal(t, vmIDtoMacAddr(uint(vmID)), printedVMID, "unexpected VMID output from container %q", containerName)
458+
require.Equal(t, vmIDtoMacAddr(uint(vmID)), printedVMID, "unexpected VMID output from container %q", containerName)
468459

469-
taskMntNS := strings.TrimSpace(stdoutLines[1])
470-
require.Equal(t, execMntNS, taskMntNS, "unexpected mnt NS output from container %q", containerName)
471-
}
460+
taskMntNS := strings.TrimSpace(stdoutLines[1])
461+
require.Equal(t, execMntNS, taskMntNS, "unexpected mnt NS output from container %q", containerName)
472462

473463
case <-ctx.Done():
474464
require.Fail(t, "context cancelled",

‎tools/docker/Dockerfile

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,6 @@ RUN containerd 2>/dev/null & \
160160
ctr content fetch docker.io/library/alpine:3.10.1 >/dev/null && \
161161
ctr content fetch docker.io/mlabbe/iperf3:3.6-r0 >/dev/null
162162

163-
COPY tools/docker/naive-snapshotter/entrypoint.sh /entrypoint
164163
RUN chmod 0444 /var/lib/firecracker-containerd/runtime/default-rootfs.img \
165164
&& mkdir -p /var/lib/firecracker-containerd/naive
166165
RUN make -C /firecracker-containerd demo-network

0 commit comments

Comments
 (0)