Skip to content

Commit 82fe6e2

Browse files
ratarata
authored
Merge pull request #4538 from aojea/netdevices
Linux Network Devices
2 parents 178a58d + 8d180e9 commit 82fe6e2

File tree

19 files changed

+817
-6
lines changed

19 files changed

+817
-6
lines changed

‎features.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,9 @@ var featuresCommand = cli.Command{
6363
Enabled: &t,
6464
},
6565
},
66+
NetDevices: &features.NetDevices{
67+
Enabled: &t,
68+
},
6669
},
6770
PotentiallyUnsafeConfigAnnotations: []string{
6871
"bundle",

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,13 @@ require (
1515
github.com/moby/sys/userns v0.1.0
1616
github.com/mrunalp/fileutils v0.5.1
1717
github.com/opencontainers/cgroups v0.0.2
18-
github.com/opencontainers/runtime-spec v1.2.1
18+
github.com/opencontainers/runtime-spec v1.2.2-0.20250401095657-e935f995dd67
1919
github.com/opencontainers/selinux v1.12.0
2020
github.com/seccomp/libseccomp-golang v0.11.0
2121
github.com/sirupsen/logrus v1.9.3
2222
github.com/urfave/cli v1.22.17
2323
github.com/vishvananda/netlink v1.3.1
24+
github.com/vishvananda/netns v0.0.5
2425
golang.org/x/net v0.41.0
2526
golang.org/x/sys v0.33.0
2627
google.golang.org/protobuf v1.36.6
@@ -30,5 +31,4 @@ require (
3031
github.com/cilium/ebpf v0.17.3 // indirect
3132
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
3233
github.com/russross/blackfriday/v2 v2.1.0 // indirect
33-
github.com/vishvananda/netns v0.0.5 // indirect
3434
)

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,8 @@ github.com/mrunalp/fileutils v0.5.1 h1:F+S7ZlNKnrwHfSwdlgNSkKo67ReVf8o9fel6C3dkm
4747
github.com/mrunalp/fileutils v0.5.1/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
4848
github.com/opencontainers/cgroups v0.0.2 h1:A+mAPPMfgKNCEZUUtibESFx06uvhAmvo8sSz3Abwk7o=
4949
github.com/opencontainers/cgroups v0.0.2/go.mod h1:s8lktyhlGUqM7OSRL5P7eAW6Wb+kWPNvt4qvVfzA5vs=
50-
github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
51-
github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
50+
github.com/opencontainers/runtime-spec v1.2.2-0.20250401095657-e935f995dd67 h1:Q+KewUGTMamIe6Q39xCD/T1NC1POmaTlWnhjikCrZHA=
51+
github.com/opencontainers/runtime-spec v1.2.2-0.20250401095657-e935f995dd67/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
5252
github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
5353
github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
5454
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=

‎libcontainer/configs/config.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,9 @@ type Config struct {
119119
// The device nodes that should be automatically created within the container upon container start. Note, make sure that the node is marked as allowed in the cgroup as well!
120120
Devices []*devices.Device `json:"devices"`
121121

122+
// NetDevices are key-value pairs, keyed by network device name, moved to the container's network namespace.
123+
NetDevices map[string]*LinuxNetDevice `json:"netDevices,omitempty"`
124+
122125
MountLabel string `json:"mount_label,omitempty"`
123126

124127
// Hostname optionally sets the container's hostname if provided.

‎libcontainer/configs/doc.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
// Package configs defines the structures and constants used for configuring a container
2+
package configs

‎libcontainer/configs/netdevices.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
package configs
2+
3+
// LinuxNetDevice represents a single network device to be added to the container's network namespace.
4+
type LinuxNetDevice struct {
5+
// Name of the device in the container namespace.
6+
Name string `json:"name,omitempty"`
7+
}

‎libcontainer/configs/validate/validator.go‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ func Validate(config *configs.Config) error {
2424
cgroupsCheck,
2525
rootfs,
2626
network,
27+
netdevices,
2728
uts,
2829
security,
2930
namespaces,
@@ -70,6 +71,43 @@ func rootfs(config *configs.Config) error {
7071
return nil
7172
}
7273

74+
// https://elixir.bootlin.com/linux/v6.12/source/net/core/dev.c#L1066
75+
func devValidName(name string) bool {
76+
if len(name) == 0 || len(name) > unix.IFNAMSIZ {
77+
return false
78+
}
79+
if name == "." || name == ".." {
80+
return false
81+
}
82+
if strings.ContainsAny(name, "/: ") {
83+
return false
84+
}
85+
return true
86+
}
87+
88+
func netdevices(config *configs.Config) error {
89+
if len(config.NetDevices) == 0 {
90+
return nil
91+
}
92+
if !config.Namespaces.Contains(configs.NEWNET) {
93+
return errors.New("unable to move network devices without a NET namespace")
94+
}
95+
96+
if config.RootlessEUID || config.RootlessCgroups {
97+
return errors.New("network devices are not supported for rootless containers")
98+
}
99+
100+
for name, netdev := range config.NetDevices {
101+
if !devValidName(name) {
102+
return fmt.Errorf("invalid network device name %q", name)
103+
}
104+
if netdev.Name != "" && !devValidName(netdev.Name) {
105+
return fmt.Errorf("invalid network device name %q", netdev.Name)
106+
}
107+
}
108+
return nil
109+
}
110+
73111
func network(config *configs.Config) error {
74112
if !config.Namespaces.Contains(configs.NEWNET) {
75113
if len(config.Networks) > 0 || len(config.Routes) > 0 {

‎libcontainer/configs/validate/validator_test.go‎

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package validate
33
import (
44
"os"
55
"path/filepath"
6+
"strings"
67
"testing"
78

89
"github.com/opencontainers/runc/libcontainer/configs"
@@ -877,3 +878,168 @@ func TestValidateIOPriority(t *testing.T) {
877878
}
878879
}
879880
}
881+
882+
func TestValidateNetDevices(t *testing.T) {
883+
testCases := []struct {
884+
name string
885+
isErr bool
886+
config *configs.Config
887+
}{
888+
{
889+
name: "network device with configured network namespace",
890+
config: &configs.Config{
891+
Namespaces: configs.Namespaces(
892+
[]configs.Namespace{
893+
{
894+
Type: configs.NEWNET,
895+
Path: "/var/run/netns/blue",
896+
},
897+
},
898+
),
899+
NetDevices: map[string]*configs.LinuxNetDevice{
900+
"eth0": {},
901+
},
902+
},
903+
},
904+
{
905+
name: "network device rename",
906+
config: &configs.Config{
907+
Namespaces: configs.Namespaces(
908+
[]configs.Namespace{
909+
{
910+
Type: configs.NEWNET,
911+
Path: "/var/run/netns/blue",
912+
},
913+
},
914+
),
915+
NetDevices: map[string]*configs.LinuxNetDevice{
916+
"eth0": {
917+
Name: "c0",
918+
},
919+
},
920+
},
921+
},
922+
{
923+
name: "network device network namespace created by runc",
924+
config: &configs.Config{
925+
Namespaces: configs.Namespaces(
926+
[]configs.Namespace{
927+
{
928+
Type: configs.NEWNET,
929+
},
930+
},
931+
),
932+
NetDevices: map[string]*configs.LinuxNetDevice{
933+
"eth0": {},
934+
},
935+
},
936+
},
937+
{
938+
name: "network device network namespace empty",
939+
isErr: true,
940+
config: &configs.Config{
941+
Namespaces: configs.Namespaces(
942+
[]configs.Namespace{},
943+
),
944+
NetDevices: map[string]*configs.LinuxNetDevice{
945+
"eth0": {},
946+
},
947+
},
948+
},
949+
{
950+
name: "network device rootless EUID",
951+
isErr: true,
952+
config: &configs.Config{
953+
Namespaces: configs.Namespaces(
954+
[]configs.Namespace{
955+
{
956+
Type: configs.NEWNET,
957+
Path: "/var/run/netns/blue",
958+
},
959+
},
960+
),
961+
RootlessEUID: true,
962+
NetDevices: map[string]*configs.LinuxNetDevice{
963+
"eth0": {},
964+
},
965+
},
966+
},
967+
{
968+
name: "network device rootless",
969+
isErr: true,
970+
config: &configs.Config{
971+
Namespaces: configs.Namespaces(
972+
[]configs.Namespace{
973+
{
974+
Type: configs.NEWNET,
975+
Path: "/var/run/netns/blue",
976+
},
977+
},
978+
),
979+
RootlessCgroups: true,
980+
NetDevices: map[string]*configs.LinuxNetDevice{
981+
"eth0": {},
982+
},
983+
},
984+
},
985+
{
986+
name: "network device bad name",
987+
isErr: true,
988+
config: &configs.Config{
989+
Namespaces: configs.Namespaces(
990+
[]configs.Namespace{
991+
{
992+
Type: configs.NEWNET,
993+
Path: "/var/run/netns/blue",
994+
},
995+
},
996+
),
997+
NetDevices: map[string]*configs.LinuxNetDevice{
998+
"eth0": {
999+
Name: "eth0/",
1000+
},
1001+
},
1002+
},
1003+
},
1004+
}
1005+
1006+
for _, tc := range testCases {
1007+
t.Run(tc.name, func(t *testing.T) {
1008+
config := tc.config
1009+
config.Rootfs = "/var"
1010+
1011+
err := Validate(config)
1012+
if tc.isErr && err == nil {
1013+
t.Error("expected error, got nil")
1014+
}
1015+
1016+
if !tc.isErr && err != nil {
1017+
t.Error(err)
1018+
}
1019+
})
1020+
}
1021+
}
1022+
1023+
func TestDevValidName(t *testing.T) {
1024+
testCases := []struct {
1025+
name string
1026+
valid bool
1027+
}{
1028+
{name: "", valid: false},
1029+
{name: "a", valid: true},
1030+
{name: strings.Repeat("a", unix.IFNAMSIZ), valid: true},
1031+
{name: strings.Repeat("a", unix.IFNAMSIZ+1), valid: false},
1032+
{name: ".", valid: false},
1033+
{name: "..", valid: false},
1034+
{name: "dev/null", valid: false},
1035+
{name: "valid:name", valid: false},
1036+
{name: "valid name", valid: false},
1037+
}
1038+
for _, tc := range testCases {
1039+
t.Run(tc.name, func(t *testing.T) {
1040+
if devValidName(tc.name) != tc.valid {
1041+
t.Fatalf("name %q, expected valid: %v", tc.name, tc.valid)
1042+
}
1043+
})
1044+
}
1045+
}

0 commit comments

Comments
 (0)