Fix cleaning up network namespaces on detached ctrs

The containernetworking/plugins ns package does not support
unmounting and removing namespaces that were opened by another
process. Work around this by doing it ourself.

Closes: #858

Signed-off-by: Matthew Heon <matthew.heon@gmail.com>

Closes: #949
Approved by: rhatdan

1 files changed, 15 insertions, 0 deletions

diff --git a/libpod/networking.go b/libpod/networking.go
index 54a1c78de..092ce2a3f 100644
--- a/libpod/networking.go
+++ b/libpod/networking.go
@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"syscall"
 
 	cnitypes "github.com/containernetworking/cni/pkg/types/current"
 	"github.com/containernetworking/plugins/pkg/ns"
@@ -184,10 +185,24 @@ func (r *Runtime) teardownNetNS(ctr *Container) error {
 		logrus.Errorf("Failed to tear down network namespace for container %s: %v", ctr.ID(), err)
 	}
 
+	nsPath := ctr.state.NetNS.Path()
+
 	if err := ctr.state.NetNS.Close(); err != nil {
 		return errors.Wrapf(err, "error closing network namespace for container %s", ctr.ID())
 	}
 
+	// We need to unconditionally try to unmount/remove the namespace
+	// because we may be in a separate process from the one that created the
+	// namespace, and Close() will only do that if it is the same process.
+	if err := unix.Unmount(nsPath, unix.MNT_DETACH); err != nil {
+		if err != syscall.EINVAL && err != syscall.ENOENT {
+			return errors.Wrapf(err, "error unmounting network namespace %s for container %s", nsPath, ctr.ID())
+		}
+	}
+	if err := os.RemoveAll(nsPath); err != nil && !os.IsNotExist(err) {
+		return errors.Wrapf(err, "error removing network namespace %s for container %s", nsPath, ctr.ID())
+	}
+
 	ctr.state.NetNS = nil
 
 	return nil