Start dockerd with the default bridge network in gVisor.

PiperOrigin-RevId: 653309522

Makefile

@@ -331,6 +331,7 @@ INTEGRATION_TARGETS := //test/image:image_test //test/e2e:integration_test
 
 docker-tests: load-basic $(RUNTIME_BIN)
 	@$(call install_runtime,$(RUNTIME),) # Clear flags.
+	@$(call install_runtime,$(RUNTIME)-docker,--net-raw) # Used by TestDocker*.
 	@$(call install_runtime,$(RUNTIME)-fdlimit,--fdlimit=2000) # Used by TestRlimitNoFile.
 	@$(call install_runtime,$(RUNTIME)-dcache,--fdlimit=2000 --dcache=100) # Used by TestDentryCacheLimit.
 	@$(call install_runtime,$(RUNTIME)-host-uds,--host-uds=all) # Used by TestHostSocketConnect.
@@ -340,11 +341,13 @@ docker-tests: load-basic $(RUNTIME_BIN)
 
 overlay-tests: load-basic $(RUNTIME_BIN)
 	@$(call install_runtime,$(RUNTIME),--overlay2=all:dir=/tmp)
+	@$(call install_runtime,$(RUNTIME)-docker,--net-raw --overlay2=all:dir=/tmp)
 	@$(call test_runtime,$(RUNTIME),--test_env=TEST_OVERLAY=true $(INTEGRATION_TARGETS))
 .PHONY: overlay-tests
 
 swgso-tests: load-basic $(RUNTIME_BIN)
 	@$(call install_runtime,$(RUNTIME),--software-gso=true --gso=false)
+	@$(call install_runtime,$(RUNTIME)-docker,--net-raw --software-gso=true --gso=false)
 	@$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS))
 .PHONY: swgso-tests
 
@@ -358,11 +361,13 @@ kvm-tests: load-basic $(RUNTIME_BIN)
 	@if ! test -w /dev/kvm; then sudo chmod a+rw /dev/kvm; fi
 	@$(call test,//pkg/sentry/platform/kvm:kvm_test)
 	@$(call install_runtime,$(RUNTIME),--platform=kvm)
+	@$(call install_runtime,$(RUNTIME)-docker,--net-raw --platform=kvm)
 	@$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS))
 .PHONY: kvm-tests
 
 systrap-tests: load-basic $(RUNTIME_BIN)
 	@$(call install_runtime,$(RUNTIME),--platform=systrap)
+	@$(call install_runtime,$(RUNTIME)-docker,--net-raw --platform=systrap)
 	@$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS))
 .PHONY: systrap-tests
 

images/basic/docker/Dockerfile

@@ -3,4 +3,5 @@ FROM ubuntu:22.04
 ENV DEBIAN_FRONTEND="noninteractive"
 RUN apt-get update && apt-get install -y docker.io
 
-CMD exec /usr/bin/dockerd --bridge=none --iptables=false --ip6tables=false -D
+COPY start-dockerd.sh .
+CMD /start-dockerd.sh

images/basic/docker/start-dockerd.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+# Copyright 2024 The gVisor Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -xe -o pipefail
+
+dev=$(ip route show default | sed 's/.*\sdev\s\(\S*\)\s.*$/\1/')
+addr=$(ip addr show dev "$dev"  | grep inet | sed 's/^\s*inet\s\(\S*\)\/.*$/\1/')
+
+echo 1 > /proc/sys/net/ipv4/ip_forward
+iptables-legacy -t nat -A POSTROUTING -o "$dev" -j SNAT --to-source "$addr" -p tcp
+iptables-legacy -t nat -A POSTROUTING -o "$dev" -j SNAT --to-source "$addr" -p udp
+
+exec /usr/bin/dockerd --iptables=false --ip6tables=false -D

test/image/image_test.go

@@ -339,22 +339,30 @@ func TestStdio(t *testing.T) {
 	}
 }
 
+func TestDockerOverlayWithHostNetwork(t *testing.T) {
+	testDocker(t, true, true)
+}
+
 func TestDockerOverlay(t *testing.T) {
-	testDocker(t, true)
+	testDocker(t, true, false)
+}
+
+func TestDockerWithHostNetwork(t *testing.T) {
+	testDocker(t, false, true)
 }
 
 func TestDocker(t *testing.T) {
 	// Overlayfs can't be built on top of another overlayfs, so docket has
 	// to fall back to the vfs driver.
-	testDocker(t, false)
+	testDocker(t, false, false)
 }
 
-func testDocker(t *testing.T, overlay bool) {
+func testDocker(t *testing.T, overlay, hostNetwork bool) {
 	if testutil.IsRunningWithHostNet() {
 		t.Skip("docker doesn't work with hostinet")
 	}
 	ctx := context.Background()
-	d := dockerutil.MakeContainer(ctx, t)
+	d := dockerutil.MakeContainerWithRuntime(ctx, t, "-docker")
 	defer d.CleanUp(ctx)
 
 	// Start the container.
@@ -395,19 +403,14 @@ func testDocker(t *testing.T, overlay bool) {
 		}
 		break
 	}
-	p, err := d.ExecProcess(ctx, dockerutil.ExecOpts{},
-		"docker", "run", "--network", "host", "--rm", "alpine", "echo", "Hello World")
+	cmd := []string{"docker", "run", "--rm", "alpine", "sh", "-c", "apk add curl && curl -h"}
+	if hostNetwork {
+		cmd = []string{"docker", "run", "--network", "host", "--rm", "alpine", "sh", "-c", "apk add curl && curl -h"}
+	}
+	_, err := d.ExecProcess(ctx, dockerutil.ExecOpts{}, cmd...)
 	if err != nil {
 		t.Fatalf("docker exec failed: %v", err)
 	}
-	stdout, stderr, err := p.Read()
-	t.Logf("Container output: == stdout ==\n%s\n== stderr ==\n%s", stdout, stderr)
-	if err != nil {
-		t.Errorf("failed to read process output: %s", err)
-	}
-	if stdout != "Hello World\n" {
-		t.Errorf("Unexpected output: %#v", stdout)
-	}
 }
 
 func TestMain(m *testing.M) {