netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity
9,879 Commits 1 Branch 0 Tags
master
Commit Graph
8 Commits
Author SHA1 Message Date
Nayana BidariandgVisor bot 740dc367db Mark netstack as save and use it only in tests 
- Adds a new flag which will enable netstack s/r. When the flag is not enabled,
there is no change in the existing behavior. The flag will be enabled only in
tests to verify the s/r functionality of netstack.
- Some additional fields in netstack were causing panic when netstack is
save/restored. Such fields are marked as 'save'/'nosave' accordingly to resolve
the panic.

PiperOrigin-RevId: 668566657
 2024-08-28 12:49:43 -07:00
Fabricio VoznikaandgVisor bot c087777e37 Plumb restore context to afterLoad() 
This allows for external information to be passed to restore code, like
host FDs to be remapped.

Updates #1956

PiperOrigin-RevId: 612540749
 2024-03-04 12:21:50 -08:00
Nayana BidariandgVisor bot b07b6076cb Fix the ref leaks with S/R. 
With S/R enabled, the kernel is replaced during the container creation
before attempting to restore in a new sandbox. The old kernel which was
being replaced did not release the resources resulting in ref leaks. This CL
releases the resources before replacing the kernel in restore.

PiperOrigin-RevId: 603822183
 2024-02-02 16:56:28 -08:00
Andrei VaginandgVisor bot f3b0a527c2 inet: allow to create abstract unix sockets in non-root namespaces 
PiperOrigin-RevId: 573253619
 2023-10-13 10:20:56 -07:00
Andrei VaginandgVisor bot 46115504ec Implement the setns syscall 
This change introduces the nsfs file system. Each new namespace allocates
a new nsfs inode.

Here are reasons why we need these inodes:
* each namespace has to have an unique id.
* proc/pid/ns/ contains one entry for each namespace. Bind mounting one of
  the files in this directory to somewhere else in the filesystem keeps the
  corresponding namespace alive even if all processes currently in
  the namespace terminate.
* setns() allows the calling process to join an existing namespace specified
  by a file descriptor.

PiperOrigin-RevId: 550694515
 2023-07-24 15:45:08 -07:00
Andrei VaginandgVisor bot 5ffcc1f799 Don't leak network namespaces 
PiperOrigin-RevId: 454707336
 2022-06-13 15:05:21 -07:00
Ting-Yu WangandgVisor bot 9b64b658c1 Fix S/R on inet.Namespace. 
PiperOrigin-RevId: 299238067
 2020-03-05 17:40:18 -08:00
gVisor botandCopybara-Service 4a73bae269 Initial network namespace support. 
TCP/IP will work with netstack networking. hostinet doesn't work, and sockets
will have the same behavior as it is now.

Before the userspace is able to create device, the default loopback device can
be used to test.

/proc/net and /sys/net will still be connected to the root network stack; this
is the same behavior now.

Issue #1833

PiperOrigin-RevId: 296309389
 2020-02-20 15:20:40 -08:00