Repository navigation
Merge External PR: Merge main-pr1135 into main - #1165
Merged
Merged
Conversation
urunc gives every guest its network through a tap device: it creates one in the network namespace of the container and redirects the traffic of the container's interface to it. That fits a monitor that emulates a network device, but not one whose guest reaches the network through sockets that the monitor itself opens in the namespace. For such a monitor the redirect would take the traffic away from those sockets. Add UsesHostNet to the VMM interface, false on every monitor so far. When a monitor reports it, both the libcontainer and the plain paths skip SetupNet, so no tap is created and the interface of the container is left as it is, and mark the network parameters with HostNet so the monitor knows to open the network to its guest. Such a monitor needs neither /dev/net/tun in its rootfs nor the CAP_NET_ADMIN that urunc adds to the monitor's capabilities for the tap, so leave both out. PR: #1135 Signed-off-by: danbugs <danilochiarlone@gmail.com> Reviewed-by: Charalampos Mainas <cmainas@nubificus.co.uk> Approved-by: Charalampos Mainas <cmainas@nubificus.co.uk>
hluk has no network device to offer a guest. It forwards each socket call of the guest to a real socket that it opens itself, so a guest reaches exactly the network of the namespace hluk runs in: the address of the pod, its routes and any NetworkPolicy that applies to it. Report that through UsesHostNet, so urunc leaves the interface of the container alone instead of redirecting its traffic to a tap that nothing reads. hluk gives a guest no network unless told to, and since v0.18.0 --port on its own only lets the guest serve: it can then connect nowhere, not even to a DNS server. A container expects the whole network of its namespace, outbound and inbound, so start hluk with both, --net and --port=all, for a booted and a resumed guest alike. No hluk policy is layered on top: the namespace, and the NetworkPolicy that applies to it, stay the boundary, as they are for every other container. PR: #1135 Signed-off-by: danbugs <danilochiarlone@gmail.com> Reviewed-by: Charalampos Mainas <cmainas@nubificus.co.uk> Approved-by: Charalampos Mainas <cmainas@nubificus.co.uk>
A hyperlight-unikraft guest resolves names itself, over the sockets hluk opens for it, with the /etc/resolv.conf of its own filesystem. A booted guest gets that file from the rootfs CPIO, and a resumed one from the snapshot, which was saved wherever the image was built. Neither knows the nameserver or the search domains of the container, so cluster names do not resolve in the guest. hluk installs a resolver configuration in the guest, at boot and on every restore, with --resolv-conf. For a monitor on host networking only, bind-mount the resolv.conf that the engine mounts in the container read-only into the monitor rootfs, at /etc/resolv.conf, along with the other mounts the monitor gets, and point hluk at it. The guest follows the engine's file as a container does. A container without a resolv.conf leaves the guest with its own, and the nameserver that the tap-based guests take from the file is not extracted for one that gets the whole file. PR: #1135 Signed-off-by: danbugs <danilochiarlone@gmail.com> Reviewed-by: Charalampos Mainas <cmainas@nubificus.co.uk> Approved-by: Charalampos Mainas <cmainas@nubificus.co.uk>
Explain that hluk forwards the sockets of the guest to the network namespace of the container, so urunc creates no tap for this monitor and starts hluk with both outbound and inbound networking, and that the resolv.conf of the container is installed in the guest, whether it boots or resumes from a snapshot. PR: #1135 Signed-off-by: danbugs <danilochiarlone@gmail.com> Reviewed-by: Charalampos Mainas <cmainas@nubificus.co.uk> Approved-by: Charalampos Mainas <cmainas@nubificus.co.uk>
The Hyperlight case only prints a greeting, so the networking of the guest is verified by nothing but the arguments urunc builds for hluk. Add a docker and a nerdctl case that run the hello image with Python's http.server, which the Python driver runs like any script from the initrd, and fetch its root from the host at the address of the container: the guest binds in the network namespace of the container and answers through the sockets hluk opens for it. A hluk release that changed the meaning of --net or --port would fail it. ctr gets no case, since it gives a container no address to reach. PR: #1135 Signed-off-by: danbugs <danilochiarlone@gmail.com> Reviewed-by: Charalampos Mainas <cmainas@nubificus.co.uk> Approved-by: Charalampos Mainas <cmainas@nubificus.co.uk>
A container serves on whatever port its workload binds, and so does a hyperlight-unikraft guest, since urunc starts hluk with --port=all. hluk can also restrict the ports a guest binds, so let a deployment ask for that with the com.urunc.unikernel.hyperlightPorts annotation: a comma-separated list of ports and LOW-HIGH ranges, passed to hluk as one --port each. An image configured through urunc.json takes it too, as a run-time annotation that replaces what the image says. urunc rejects the annotation on any other monitor, since no other can enforce it, and checks its format before it reaches the hluk command line. This is a second boundary inside the network namespace, opt-in, so that the default stays what a container gets. PR: #1135 Signed-off-by: danbugs <danilochiarlone@gmail.com> Reviewed-by: Charalampos Mainas <cmainas@nubificus.co.uk> Approved-by: Charalampos Mainas <cmainas@nubificus.co.uk>
✅ Deploy Preview for urunc canceled.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR was automatically created by GitHub Actions to merge changes from main-pr1135 into main.