From a4da384b559796ecbf49746e655876138d494864 Mon Sep 17 00:00:00 2001
From: Matthew Heon <mheon@redhat.com>
Date: Tue, 3 Nov 2020 10:01:21 -0500
Subject: Ensure that --net=host/pod/container/none warn with -p

Setting port mappings only works when CNI is configuring our
network (or slirp4netns, in the rootless case). This is not the
case with `--net=host`, `--net=container:`, and joining the
network namespace of the pod we are part of. Instead of allowing
users to do these things and then be confused why they do
nothing, let's match Docker and return a warning that your port
mappings will do nothing.

Signed-off-by: Matthew Heon <mheon@redhat.com>
---
 pkg/specgen/generate/container.go | 14 +++++++++++++-
 pkg/specgen/namespaces.go         | 16 +++++++++++-----
 2 files changed, 24 insertions(+), 6 deletions(-)

(limited to 'pkg/specgen')

diff --git a/pkg/specgen/generate/container.go b/pkg/specgen/generate/container.go
index 2ee8f2441..c7e62d185 100644
--- a/pkg/specgen/generate/container.go
+++ b/pkg/specgen/generate/container.go
@@ -257,7 +257,19 @@ func CompleteSpec(ctx context.Context, r *libpod.Runtime, s *specgen.SpecGenerat
 		}
 	}
 
-	return verifyContainerResources(s)
+	warnings, err := verifyContainerResources(s)
+	if err != nil {
+		return warnings, err
+	}
+
+	// Warn on net=host/container/pod/none and port mappings.
+	if (s.NetNS.NSMode == specgen.Host || s.NetNS.NSMode == specgen.FromContainer ||
+		s.NetNS.NSMode == specgen.FromPod || s.NetNS.NSMode == specgen.NoNetwork) &&
+		len(s.PortMappings) > 0 {
+		warnings = append(warnings, "Port mappings have been discarded as one of the Host, Container, Pod, and None network modes are in use")
+	}
+
+	return warnings, nil
 }
 
 // finishThrottleDevices takes the temporary representation of the throttle
diff --git a/pkg/specgen/namespaces.go b/pkg/specgen/namespaces.go
index 90c56d366..d15745fa0 100644
--- a/pkg/specgen/namespaces.go
+++ b/pkg/specgen/namespaces.go
@@ -27,19 +27,25 @@ const (
 	// Private indicates the namespace is private
 	Private NamespaceMode = "private"
 	// NoNetwork indicates no network namespace should
-	// be joined.  loopback should still exists
+	// be joined.  loopback should still exists.
+	// Only used with the network namespace, invalid otherwise.
 	NoNetwork NamespaceMode = "none"
 	// Bridge indicates that a CNI network stack
-	// should be used
+	// should be used.
+	// Only used with the network namespace, invalid otherwise.
 	Bridge NamespaceMode = "bridge"
 	// Slirp indicates that a slirp4netns network stack should
-	// be used
+	// be used.
+	// Only used with the network namespace, invalid otherwise.
 	Slirp NamespaceMode = "slirp4netns"
 	// KeepId indicates a user namespace to keep the owner uid inside
-	// of the namespace itself
+	// of the namespace itself.
+	// Only used with the user namespace, invalid otherwise.
 	KeepID NamespaceMode = "keep-id"
-	// KeepId indicates to automatically create a user namespace
+	// Auto indicates to automatically create a user namespace.
+	// Only used with the user namespace, invalid otherwise.
 	Auto NamespaceMode = "auto"
+
 	// DefaultKernelNamespaces is a comma-separated list of default kernel
 	// namespaces.
 	DefaultKernelNamespaces = "cgroup,ipc,net,uts"
-- 
cgit v1.2.3-54-g00ecf