diff options
| author | Gabi Beyer <gabrielle.n.beyer@intel.com> | 2019-06-12 17:31:18 +0000 |
|---|---|---|
| committer | Marco Vedovati <mvedovati@suse.com> | 2019-09-24 11:01:28 +0200 |
| commit | 5813c8246eb32205cc3e68a293c6cf3eb2ba291d (patch) | |
| tree | 1e497c09fbe9cb762fd1f0c8ee0554f2fd060e9e /libpod/oci_internal_linux.go | |
| parent | 6ce8d05a5b06d97a2897411fcbd4da6a3abb4d65 (diff) | |
| download | podman-5813c8246eb32205cc3e68a293c6cf3eb2ba291d.tar.gz podman-5813c8246eb32205cc3e68a293c6cf3eb2ba291d.tar.bz2 podman-5813c8246eb32205cc3e68a293c6cf3eb2ba291d.zip | |
rootless: Rearrange setup of rootless containers
In order to run Podman with VM-based runtimes unprivileged, the
network must be set up prior to the container creation. Therefore
this commit modifies Podman to run rootless containers by:
1. create a network namespace
2. pass the netns persistent mount path to the slirp4netns
to create the tap inferface
3. pass the netns path to the OCI spec, so the runtime can
enter the netns
Closes #2897
Signed-off-by: Gabi Beyer <gabrielle.n.beyer@intel.com>
Diffstat (limited to 'libpod/oci_internal_linux.go')
| -rw-r--r-- | libpod/oci_internal_linux.go | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/libpod/oci_internal_linux.go b/libpod/oci_internal_linux.go index a90af32ed..a5cce795b 100644 --- a/libpod/oci_internal_linux.go +++ b/libpod/oci_internal_linux.go @@ -131,9 +131,14 @@ func (r *OCIRuntime) createOCIContainer(ctr *Container, restoreOptions *Containe } if ctr.config.NetMode.IsSlirp4netns() { - ctr.rootlessSlirpSyncR, ctr.rootlessSlirpSyncW, err = os.Pipe() - if err != nil { - return errors.Wrapf(err, "failed to create rootless network sync pipe") + if ctr.config.PostConfigureNetNS { + ctr.rootlessSlirpSyncR, ctr.rootlessSlirpSyncW, err = os.Pipe() + if err != nil { + return errors.Wrapf(err, "failed to create rootless network sync pipe") + } + } else { + defer errorhandling.CloseQuiet(ctr.rootlessSlirpSyncR) + defer errorhandling.CloseQuiet(ctr.rootlessSlirpSyncW) } // Leak one end in conmon, the other one will be leaked into slirp4netns cmd.ExtraFiles = append(cmd.ExtraFiles, ctr.rootlessSlirpSyncW) |