From 6a506950b3df0b495949651cabad9c869a925e4a Mon Sep 17 00:00:00 2001 From: Jing Chen Date: Wed, 17 Jul 2024 11:45:17 -0700 Subject: [PATCH] Start dockerd with the default bridge network in gVisor. PiperOrigin-RevId: 653309522 --- Makefile | 5 +++++ images/basic/docker/Dockerfile | 3 ++- images/basic/docker/start-dockerd.sh | 26 +++++++++++++++++++++++ test/image/image_test.go | 31 +++++++++++++++------------- 4 files changed, 50 insertions(+), 15 deletions(-) create mode 100755 images/basic/docker/start-dockerd.sh diff --git a/Makefile b/Makefile index 5f10a412e..5556ef9fa 100644 --- a/Makefile +++ b/Makefile @@ -331,6 +331,7 @@ INTEGRATION_TARGETS := //test/image:image_test //test/e2e:integration_test docker-tests: load-basic $(RUNTIME_BIN) @$(call install_runtime,$(RUNTIME),) # Clear flags. + @$(call install_runtime,$(RUNTIME)-docker,--net-raw) # Used by TestDocker*. @$(call install_runtime,$(RUNTIME)-fdlimit,--fdlimit=2000) # Used by TestRlimitNoFile. @$(call install_runtime,$(RUNTIME)-dcache,--fdlimit=2000 --dcache=100) # Used by TestDentryCacheLimit. @$(call install_runtime,$(RUNTIME)-host-uds,--host-uds=all) # Used by TestHostSocketConnect. @@ -340,11 +341,13 @@ docker-tests: load-basic $(RUNTIME_BIN) overlay-tests: load-basic $(RUNTIME_BIN) @$(call install_runtime,$(RUNTIME),--overlay2=all:dir=/tmp) + @$(call install_runtime,$(RUNTIME)-docker,--net-raw --overlay2=all:dir=/tmp) @$(call test_runtime,$(RUNTIME),--test_env=TEST_OVERLAY=true $(INTEGRATION_TARGETS)) .PHONY: overlay-tests swgso-tests: load-basic $(RUNTIME_BIN) @$(call install_runtime,$(RUNTIME),--software-gso=true --gso=false) + @$(call install_runtime,$(RUNTIME)-docker,--net-raw --software-gso=true --gso=false) @$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS)) .PHONY: swgso-tests @@ -358,11 +361,13 @@ kvm-tests: load-basic $(RUNTIME_BIN) @if ! test -w /dev/kvm; then sudo chmod a+rw /dev/kvm; fi @$(call test,//pkg/sentry/platform/kvm:kvm_test) @$(call install_runtime,$(RUNTIME),--platform=kvm) + @$(call install_runtime,$(RUNTIME)-docker,--net-raw --platform=kvm) @$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS)) .PHONY: kvm-tests systrap-tests: load-basic $(RUNTIME_BIN) @$(call install_runtime,$(RUNTIME),--platform=systrap) + @$(call install_runtime,$(RUNTIME)-docker,--net-raw --platform=systrap) @$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS)) .PHONY: systrap-tests diff --git a/images/basic/docker/Dockerfile b/images/basic/docker/Dockerfile index b33b14ef8..af3355653 100644 --- a/images/basic/docker/Dockerfile +++ b/images/basic/docker/Dockerfile @@ -3,4 +3,5 @@ FROM ubuntu:22.04 ENV DEBIAN_FRONTEND="noninteractive" RUN apt-get update && apt-get install -y docker.io -CMD exec /usr/bin/dockerd --bridge=none --iptables=false --ip6tables=false -D +COPY start-dockerd.sh . +CMD /start-dockerd.sh \ No newline at end of file diff --git a/images/basic/docker/start-dockerd.sh b/images/basic/docker/start-dockerd.sh new file mode 100755 index 000000000..07d97b425 --- /dev/null +++ b/images/basic/docker/start-dockerd.sh @@ -0,0 +1,26 @@ +#!/bin/bash + +# Copyright 2024 The gVisor Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -xe -o pipefail + +dev=$(ip route show default | sed 's/.*\sdev\s\(\S*\)\s.*$/\1/') +addr=$(ip addr show dev "$dev" | grep inet | sed 's/^\s*inet\s\(\S*\)\/.*$/\1/') + +echo 1 > /proc/sys/net/ipv4/ip_forward +iptables-legacy -t nat -A POSTROUTING -o "$dev" -j SNAT --to-source "$addr" -p tcp +iptables-legacy -t nat -A POSTROUTING -o "$dev" -j SNAT --to-source "$addr" -p udp + +exec /usr/bin/dockerd --iptables=false --ip6tables=false -D diff --git a/test/image/image_test.go b/test/image/image_test.go index 1d5d61f42..fa1437a6a 100644 --- a/test/image/image_test.go +++ b/test/image/image_test.go @@ -339,22 +339,30 @@ func TestStdio(t *testing.T) { } } +func TestDockerOverlayWithHostNetwork(t *testing.T) { + testDocker(t, true, true) +} + func TestDockerOverlay(t *testing.T) { - testDocker(t, true) + testDocker(t, true, false) +} + +func TestDockerWithHostNetwork(t *testing.T) { + testDocker(t, false, true) } func TestDocker(t *testing.T) { // Overlayfs can't be built on top of another overlayfs, so docket has // to fall back to the vfs driver. - testDocker(t, false) + testDocker(t, false, false) } -func testDocker(t *testing.T, overlay bool) { +func testDocker(t *testing.T, overlay, hostNetwork bool) { if testutil.IsRunningWithHostNet() { t.Skip("docker doesn't work with hostinet") } ctx := context.Background() - d := dockerutil.MakeContainer(ctx, t) + d := dockerutil.MakeContainerWithRuntime(ctx, t, "-docker") defer d.CleanUp(ctx) // Start the container. @@ -395,19 +403,14 @@ func testDocker(t *testing.T, overlay bool) { } break } - p, err := d.ExecProcess(ctx, dockerutil.ExecOpts{}, - "docker", "run", "--network", "host", "--rm", "alpine", "echo", "Hello World") + cmd := []string{"docker", "run", "--rm", "alpine", "sh", "-c", "apk add curl && curl -h"} + if hostNetwork { + cmd = []string{"docker", "run", "--network", "host", "--rm", "alpine", "sh", "-c", "apk add curl && curl -h"} + } + _, err := d.ExecProcess(ctx, dockerutil.ExecOpts{}, cmd...) if err != nil { t.Fatalf("docker exec failed: %v", err) } - stdout, stderr, err := p.Read() - t.Logf("Container output: == stdout ==\n%s\n== stderr ==\n%s", stdout, stderr) - if err != nil { - t.Errorf("failed to read process output: %s", err) - } - if stdout != "Hello World\n" { - t.Errorf("Unexpected output: %#v", stdout) - } } func TestMain(m *testing.M) {