diff options
| author | Matthew Heon <mheon@redhat.com> | 2020-01-13 11:10:10 -0500 |
|---|---|---|
| committer | Matthew Heon <mheon@redhat.com> | 2020-01-13 11:19:31 -0500 |
| commit | 6e2ed9ad2efb16062b4d7984db91a239cd102ed9 (patch) | |
| tree | 70098534fabce70ad79d1350f04155f498096b89 /libpod | |
| parent | 9e2e4d7615311b38b1e553af32a5666888ef3c96 (diff) | |
| download | podman-6e2ed9ad2efb16062b4d7984db91a239cd102ed9.tar.gz podman-6e2ed9ad2efb16062b4d7984db91a239cd102ed9.tar.bz2 podman-6e2ed9ad2efb16062b4d7984db91a239cd102ed9.zip | |
Do not configure CNI when slirp4netns is requested
Our networking code bakes in a lot of assumptions about how
networking should work - that CNI is *always* used with root, and
that slirp4netns is *always* used only with rootless. These are
not safe assumptions. This fixes one particular issue, which
would cause CNI to also be run when slirp4netns was requested as
root.
Fixes: #4687
Signed-off-by: Matthew Heon <mheon@redhat.com>
Diffstat (limited to 'libpod')
| -rw-r--r-- | libpod/networking_linux.go | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go index 89dac2b5d..ce489968a 100644 --- a/libpod/networking_linux.go +++ b/libpod/networking_linux.go @@ -148,7 +148,7 @@ func (r *Runtime) createNetNS(ctr *Container) (n ns.NetNS, q []*cnitypes.Result, logrus.Debugf("Made network namespace at %s for container %s", ctrNS.Path(), ctr.ID()) networkStatus := []*cnitypes.Result{} - if !rootless.IsRootless() { + if !rootless.IsRootless() && ctr.config.NetMode != "slirp4netns" { networkStatus, err = r.configureNetNS(ctr, ctrNS) } return ctrNS, networkStatus, err @@ -462,7 +462,7 @@ func (r *Runtime) teardownNetNS(ctr *Container) error { logrus.Debugf("Tearing down network namespace at %s for container %s", ctr.state.NetNS.Path(), ctr.ID()) // rootless containers do not use the CNI plugin - if !rootless.IsRootless() { + if !rootless.IsRootless() && ctr.config.NetMode != "slirp4netns" { var requestedIP net.IP if ctr.requestedIP != nil { requestedIP = ctr.requestedIP |