netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Enable network for multi-container

Browse Source 
PiperOrigin-RevId: 211834411
Change-Id: I52311a6c5407f984e5069359d9444027084e4d2a
This commit is contained in:
Fabricio Voznika
2018-09-06 11:00:08 -07:00
committed by Shentubot
parent d95663a6b9
commit efac28976c
1 changed files with 27 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/sandbox/network.go
+27 -25
View File
@@ -57,31 +57,33 @@ const (
func setupNetwork(conn *urpc.Client, pid int, spec *specs.Spec, conf *boot.Config) error {
log.Infof("Setting up network")
// HACK!
//
// When kubernetes starts a pod, it first creates a sandbox with an
// application that just pauses forever. Later, when a container is
// added to the pod, kubernetes will create another sandbox with a
// config that corresponds to the containerized application, and add it
// to the same namespaces as the pause sandbox.
//
// Running a second sandbox currently breaks because the two sandboxes
// have the same network namespace and configuration, and try to create
// a tap device on the same host device which fails.
//
// Runsc will eventually need to detect that this container is meant to
// be run in the same sandbox as the pausing application, and somehow
// make that happen.
//
// For now the following HACK disables networking for the "pause"
// sandbox, allowing the second sandbox to start up successfully.
//
// TODO: Remove this once multiple containers per sandbox
// is properly supported.
if spec.Annotations[crioContainerTypeAnnotation] == "sandbox" ||
spec.Annotations[containerdContainerTypeAnnotation] == "sandbox" {
log.Warningf("HACK: Disabling network")
conf.Network = boot.NetworkNone
if !conf.MultiContainer {
// HACK!
//
// When kubernetes starts a pod, it first creates a sandbox with an
// application that just pauses forever. Later, when a container is
// added to the pod, kubernetes will create another sandbox with a
// config that corresponds to the containerized application, and add it
// to the same namespaces as the pause sandbox.
//
// Running a second sandbox currently breaks because the two sandboxes
// have the same network namespace and configuration, and try to create
// a tap device on the same host device which fails.
//
// Runsc will eventually need to detect that this container is meant to
// be run in the same sandbox as the pausing application, and somehow
// make that happen.
//
// For now the following HACK disables networking for the "pause"
// sandbox, allowing the second sandbox to start up successfully.
//
// TODO: Remove this once multiple containers per sandbox
// is properly supported.
if spec.Annotations[crioContainerTypeAnnotation] == "sandbox" ||
spec.Annotations[containerdContainerTypeAnnotation] == "sandbox" {
log.Warningf("HACK: Disabling network")
conf.Network = boot.NetworkNone
}
}
switch conf.Network {