Skip to content

Commit 4fef102

Browse files
utam0kroboquat
utam0k
authored and
roboquat
committed
ws-daemon: Use a pair of veths instead of slirp4netns
 Pod Network Namespace(ring1) +------------------------------------------------+ | | | Workspace Network Namesapce(ring2) | | +--------------------------------------------+ | | | | | | | default via veth0 | | | | | | | | | | | | +------+ +--------------+ | | | | | lo | | ceth0 | 10.0.2.2/24 | | | | +------+ +--^--------+--+ | | | | | | | | | +------------------+--------+----------------+ | | | | | | +--+--------v--+ | | +-----------> | veth0 | 10.0.2.1/24 | | | +-----------+--+ | | | | | | | +--------------v-----+ | | | | | | | | | nftables | | | | | (ip masquerade) | | | | +--------------+-----+ | | | | | | | +------+ +-----------v--+ | | | | lo | | eth0 | | | | +------+ +--^--------+--+ | | | | | | | | +-----+--------v-----+ | | | | | | | +----------+ nftables | | | if with port | (port redirecter) | | | +-----^--------+-----+ | | | | | +--------------------+--------+------------------+ | | | | | v o u t s i d e
1 parent a960121 commit 4fef102

File tree

9 files changed

+85
-220
lines changed

9 files changed

+85
-220
lines changed

‎components/ee/agent-smith/pkg/detector/proc_test.go

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,15 +88,13 @@ func TestFindWorkspaces(t *testing.T) {
8888
Env: []string{"GITPOD_WORKSPACE_ID=foobar", "GITPOD_INSTANCE_ID=baz"},
8989
}
9090
res[3] = memoryProcEntry{P: &process{PID: 3, Parent: res[2].P, Cmdline: []string{"supervisor", "init"}}}
91-
res[4] = memoryProcEntry{P: &process{PID: 4, Parent: res[2].P, Cmdline: []string{"slirp4netns"}}}
9291
res[1].P.Children = []*process{res[2].P}
93-
res[2].P.Children = []*process{res[3].P, res[4].P}
92+
res[2].P.Children = []*process{res[3].P}
9493
return res
9594
})(),
9695
Expectation: []WorkspaceAndDepth{
9796
{PID: 2, D: 1, K: ProcessSandbox, C: "/proc/self/exe", W: ws},
9897
{PID: 3, D: 2, K: ProcessSupervisor, C: "supervisor", W: ws},
99-
{PID: 4, D: 2, K: ProcessUserWorkload, C: "slirp4netns", W: ws},
10098
},
10199
},
102100
{

‎components/supervisor/pkg/ports/ports.go

Lines changed: 9 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -33,28 +33,18 @@ func init() {
3333
}
3434

3535
// NewManager creates a new port manager
36-
func NewManager(exposed ExposedPortsInterface, served ServedPortsObserver, config ConfigInterace, tunneled TunneledPortsInterface, slirp SlirpClient, internalPorts ...uint32) *Manager {
36+
func NewManager(exposed ExposedPortsInterface, served ServedPortsObserver, config ConfigInterace, tunneled TunneledPortsInterface, internalPorts ...uint32) *Manager {
3737
state := make(map[uint32]*managedPort)
3838
internal := make(map[uint32]struct{})
3939
for _, p := range internalPorts {
4040
internal[p] = struct{}{}
4141
}
4242

43-
if slirp != nil {
44-
for _, p := range internalPorts {
45-
err := slirp.Expose(p)
46-
if err != nil {
47-
log.WithError(err).WithField("port", p).Error("cannot expose port")
48-
}
49-
}
50-
}
51-
5243
return &Manager{
53-
E: exposed,
54-
S: served,
55-
C: config,
56-
T: tunneled,
57-
Slirp: slirp,
44+
E: exposed,
45+
S: served,
46+
C: config,
47+
T: tunneled,
5848

5949
forceUpdates: make(chan struct{}, 1),
6050

@@ -85,11 +75,10 @@ type autoExposure struct {
8575
// Manager brings together served and exposed ports. It keeps track of which port is exposed, which one is served,
8676
// auto-exposes ports and proxies ports served on localhost only.
8777
type Manager struct {
88-
E ExposedPortsInterface
89-
S ServedPortsObserver
90-
C ConfigInterace
91-
T TunneledPortsInterface
92-
Slirp SlirpClient
78+
E ExposedPortsInterface
79+
S ServedPortsObserver
80+
C ConfigInterace
81+
T TunneledPortsInterface
9382

9483
forceUpdates chan struct{}
9584

@@ -288,7 +277,6 @@ func (pm *Manager) updateState(ctx context.Context, exposed []ExposedPort, serve
288277
log.WithField("served", newServed).Debug("updating served ports")
289278
pm.served = newServed
290279
pm.updateProxies()
291-
pm.updateSlirp()
292280
pm.autoTunnel(ctx)
293281
}
294282
}
@@ -537,19 +525,6 @@ func (pm *Manager) autoTunnel(ctx context.Context) {
537525
}
538526
}
539527

540-
func (pm *Manager) updateSlirp() {
541-
if pm.Slirp == nil {
542-
return
543-
}
544-
545-
for _, served := range pm.served {
546-
err := pm.Slirp.Expose(served.Port)
547-
if err != nil {
548-
log.WithError(err).Debug("cannot expose port for slirp")
549-
}
550-
}
551-
}
552-
553528
func (pm *Manager) updateProxies() {
554529
servedPortMap := map[uint32]bool{}
555530
for _, s := range pm.served {

‎components/supervisor/pkg/ports/ports_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -517,7 +517,7 @@ func TestPortsUpdateState(t *testing.T) {
517517
Error: make(chan error, 1),
518518
}
519519

520-
pm = NewManager(exposed, served, config, tunneled, nil, test.InternalPorts...)
520+
pm = NewManager(exposed, served, config, tunneled, test.InternalPorts...)
521521
updts [][]*api.PortsStatus
522522
)
523523
pm.proxyStarter = func(port uint32) (io.Closer, error) {
@@ -683,7 +683,7 @@ func TestPortsConcurrentSubscribe(t *testing.T) {
683683
Changes: make(chan []PortTunnelState),
684684
Error: make(chan error, 1),
685685
}
686-
pm = NewManager(exposed, served, config, tunneled, nil)
686+
pm = NewManager(exposed, served, config, tunneled)
687687
)
688688
pm.proxyStarter = func(local uint32) (io.Closer, error) {
689689
return io.NopCloser(nil), nil

‎components/supervisor/pkg/ports/slirp4netns.go

Lines changed: 0 additions & 83 deletions
This file was deleted.

‎components/supervisor/pkg/supervisor/supervisor.go

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -193,11 +193,6 @@ func Run(options ...RunOption) {
193193
log.WithError(err).Warn("cannot tunnel internal ports")
194194
}
195195

196-
var slirp ports.SlirpClient
197-
if _, err := os.Stat("/.supervisor/slirp4netns.sock/slirp4netns.sock"); err == nil {
198-
slirp = ports.Slirp4Netns("/.supervisor/slirp4netns.sock/slirp4netns.sock")
199-
}
200-
201196
ctx, cancel := context.WithCancel(context.Background())
202197

203198
internalPorts := []uint32{uint32(cfg.IDEPort), uint32(cfg.APIEndpointPort), uint32(cfg.SSHPort)}
@@ -219,7 +214,6 @@ func Run(options ...RunOption) {
219214
},
220215
ports.NewConfigService(cfg.WorkspaceID, gitpodConfigService, gitpodService),
221216
tunneledPortsService,
222-
slirp,
223217
internalPorts...,
224218
)
225219
termMux = terminal.NewMux()

‎components/workspacekit/cmd/rings.go

Lines changed: 0 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -249,10 +249,6 @@ var ring1Cmd = &cobra.Command{
249249
fsshift = api.FSShiftMethod(v)
250250
}
251251

252-
var (
253-
slirp4netnsSocket string
254-
)
255-
256252
type mnte struct {
257253
Target string
258254
Source string
@@ -313,15 +309,6 @@ var ring1Cmd = &cobra.Command{
313309
)
314310
}
315311

316-
f, err := ioutil.TempDir("", "wskit-slirp4netns")
317-
if err != nil {
318-
log.WithError(err).Error("cannot create slirp4netns socket tempdir")
319-
return
320-
}
321-
322-
slirp4netnsSocket = filepath.Join(f, "slirp4netns.sock")
323-
mnts = append(mnts, mnte{Target: "/.supervisor/slirp4netns.sock", Source: f, Flags: unix.MS_BIND | unix.MS_REC})
324-
325312
for _, m := range mnts {
326313
dst := filepath.Join(ring2Root, m.Target)
327314
_ = os.MkdirAll(dst, 0644)
@@ -475,26 +462,6 @@ var ring1Cmd = &cobra.Command{
475462
return
476463
}
477464

478-
slirpCmd := exec.Command(filepath.Join(filepath.Dir(ring2Opts.SupervisorPath), "slirp4netns"),
479-
"--configure",
480-
"--mtu=65520",
481-
"--disable-host-loopback",
482-
"--api-socket", slirp4netnsSocket,
483-
strconv.Itoa(cmd.Process.Pid),
484-
"tap0",
485-
)
486-
slirpCmd.SysProcAttr = &syscall.SysProcAttr{
487-
Pdeathsig: syscall.SIGKILL,
488-
}
489-
490-
err = slirpCmd.Start()
491-
if err != nil {
492-
log.WithError(err).Error("cannot start slirp4netns")
493-
return
494-
}
495-
//nolint:errcheck
496-
defer slirpCmd.Process.Kill()
497-
498465
client, err = connectToInWorkspaceDaemonService(ctx)
499466
if err != nil {
500467
log.WithError(err).Error("cannot connect to daemon")

‎components/workspacekit/leeway.Dockerfile

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,11 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License-AGPL.txt in the project root for license information.
44

5-
FROM alpine:3.15 as download
6-
ENV SLIRP4NETNS_VERSION=v1.1.12
7-
WORKDIR /download
8-
RUN wget https://github.com/rootless-containers/slirp4netns/releases/download/${SLIRP4NETNS_VERSION}/slirp4netns-x86_64 -O slirp4netns && chmod 755 slirp4netns
9-
105
FROM scratch
116

127
COPY components-workspacekit--app/workspacekit \
138
components-workspacekit--fuse-overlayfs/fuse-overlayfs \
149
/.supervisor/
15-
COPY --from=download /download/slirp4netns /.supervisor/
1610

1711
ARG __GIT_COMMIT
1812
ARG VERSION

0 commit comments

Comments
 (0)