erabo/spiegel_podman
1
0
Fork 0
mirror of https://github.com/podman-container-tools/podman.git synced 2026-10-27 00:07:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8
spiegel_podman/libpod
History
Paul Holzinger 54b588c07d rootless cni without infra container 
Instead of creating an extra container create a network and mount
namespace inside the podman user namespace. This ns is used to
for rootless cni operations.
This helps to align the rootless and rootful network code path.
If we run as rootless we just have to set up a extra net ns and
initialize slirp4netns in it. The ocicni lib will be called in
that net ns.

This design allows allows easier maintenance, no extra container
with pause processes, support for rootless cni with --uidmap
and possibly more.

The biggest problem is backwards compatibility. I don't think
live migration can be possible. If the user reboots or restart
all cni containers everything should work as expected again.
The user is left with the rootless-cni-infa container and image
but this can safely be removed.

To make the existing cni configs work we need execute the cni plugins
in a extra mount namespace. This ensures that we can safely mount over
/run and /var which have to be writeable for the cni plugins without
removing access to these files by the main podman process. One caveat
is that we need to keep the netns files at `XDG_RUNTIME_DIR/netns`
accessible.

`XDG_RUNTIME_DIR/rootless-cni/{run,var}` will be mounted to `/{run,var}`.
To ensure that we keep the netns directory we bind mount this relative
to the new root location, e.g. XDG_RUNTIME_DIR/rootless-cni/run/user/1000/netns
before we mount the run directory. The run directory is mounted recursive,
this makes the netns directory at the same path accessible as before.

This also allows iptables-legacy to work because /run/xtables.lock is
now writeable.

Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
2021-04-01 17:27:03 +02:00
..
common Set blob cache directory based on GraphDriver 2019-03-29 08:27:33 -04:00
define Do not leak libpod package into the remote client 2021-03-15 14:02:04 +01:00
driver bump go module to v3 2021-02-22 09:03:51 +01:00
events [NO TESTS NEEDED] Shrink the size of podman-remote 2021-03-29 09:49:45 -04:00
image Use TMPDIR when commiting images 2021-03-26 09:37:07 -04:00
layers Initial checkin from CRI-O repo 2017-11-01 11:24:59 -04:00
linkmode Add podman static build 2020-05-11 13:11:07 +02:00
lock bump go module to v3 2021-02-22 09:03:51 +01:00
logs bump go module to v3 2021-02-22 09:03:51 +01:00
network rootless cni without infra container 2021-04-01 17:27:03 +02:00
plugin bump go module to v3 2021-02-22 09:03:51 +01:00
shutdown Ensure shutdown handler access is syncronized 2021-01-25 15:44:42 -05:00
boltdb_state.go Removing a non existing container API should return 404 2021-03-10 04:08:29 -05:00
boltdb_state_internal.go Removing a non existing container API should return 404 2021-03-10 04:08:29 -05:00
boltdb_state_linux.go bump go module to v3 2021-02-22 09:03:51 +01:00
boltdb_state_unsupported.go podman-remote inspect 2019-01-18 15:43:11 -06:00
common_test.go bump go module to v3 2021-02-22 09:03:51 +01:00
container.go Do not leak libpod package into the remote client 2021-03-15 14:02:04 +01:00
container_api.go turn hidden --trace into a NOP 2021-03-08 09:22:42 +01:00
container_commit.go bump go module to v3 2021-02-22 09:03:51 +01:00
container_config.go bump go module to v3 2021-02-22 09:03:51 +01:00
container_copy_linux.go podman cp: fix ownership 2021-03-09 09:02:14 +01:00
container_copy_unsupported.go podman cp: support copying on tmpfs mounts 2021-03-04 15:43:12 +01:00
container_exec.go prune remotecommand dependency 2021-02-25 10:02:41 -06:00
container_graph.go bump go module to v3 2021-02-22 09:03:51 +01:00
container_graph_test.go bump go module to v3 2021-02-22 09:03:51 +01:00
container_inspect.go Sort CapDrop in inspect to guarantee order 2021-02-23 14:05:18 -05:00
container_internal.go Do not leak libpod package into the remote client 2021-03-15 14:02:04 +01:00
container_internal_linux.go rootless cni without infra container 2021-04-01 17:27:03 +02:00
container_internal_linux_test.go Make an entry in /etc/group when we modify /etc/passwd 2020-09-10 13:02:31 -04:00
container_internal_test.go Refactor container config 2020-07-23 10:18:14 -04:00
container_internal_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
container_linux.go Do not fetch pod and ctr State on retrieval in Bolt 2018-07-31 14:19:50 +00:00
container_log.go Tidy duplicate log tests 2021-03-02 14:28:16 -05:00
container_log_linux.go Tidy duplicate log tests 2021-03-02 14:28:16 -05:00
container_log_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
container_path_resolution.go podman cp: support copying on tmpfs mounts 2021-03-04 15:43:12 +01:00
container_stat_linux.go podman cp: evaluate symlink correctly when copying from container 2021-03-09 10:45:15 +01:00
container_stat_unsupported.go podman cp: support copying on tmpfs mounts 2021-03-04 15:43:12 +01:00
container_top_linux.go bump go module to v3 2021-02-22 09:03:51 +01:00
container_top_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
container_unsupported.go Do not fetch pod and ctr State on retrieval in Bolt 2018-07-31 14:19:50 +00:00
container_validate.go bump go module to v3 2021-02-22 09:03:51 +01:00
diff.go bump go module to v3 2021-02-22 09:03:51 +01:00
events.go bump go module to v3 2021-02-22 09:03:51 +01:00
healthcheck.go bump go module to v3 2021-02-22 09:03:51 +01:00
healthcheck_linux.go bump go module to v3 2021-02-22 09:03:51 +01:00
healthcheck_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
in_memory_state.go Rewrite Rename backend in a more atomic fashion 2021-03-02 13:30:28 -05:00
info.go bump go module to v3 2021-02-22 09:03:51 +01:00
kube.go Generate Kubernetes PersistentVolumeClaims from named volumes 2021-03-19 13:52:35 -05:00
mounts_linux.go set root propagation based on volume properties 2018-11-26 13:55:02 +01:00
networking_linux.go rootless cni without infra container 2021-04-01 17:27:03 +02:00
networking_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
oci.go prune remotecommand dependency 2021-02-25 10:02:41 -06:00
oci_attach_linux.go prune remotecommand dependency 2021-02-25 10:02:41 -06:00
oci_attach_unsupported.go prune remotecommand dependency 2021-02-25 10:02:41 -06:00
oci_conmon.go podman: add new cgroup mode split 2020-06-25 17:16:12 +02:00
oci_conmon_exec_linux.go prune remotecommand dependency 2021-02-25 10:02:41 -06:00
oci_conmon_linux.go security: use the bounding caps with --privileged 2021-03-19 15:17:11 +01:00
oci_conmon_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
oci_missing.go prune remotecommand dependency 2021-02-25 10:02:41 -06:00
oci_util.go bump go module to v3 2021-02-22 09:03:51 +01:00
options.go Merge pull request #9768 from mheon/fix_9608 2021-03-25 03:09:25 -07:00
pod.go bump go module to v3 2021-02-22 09:03:51 +01:00
pod_api.go bump go module to v3 2021-02-22 09:03:51 +01:00
pod_internal.go bump go module to v3 2021-02-22 09:03:51 +01:00
pod_status.go bump go module to v3 2021-02-22 09:03:51 +01:00
pod_top_linux.go bump go module to v3 2021-02-22 09:03:51 +01:00
pod_top_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
reset.go bump go module to v3 2021-02-22 09:03:51 +01:00
rootless_cni_linux.go Correct compat images/create?fromImage response 2021-02-26 03:08:10 +01:00
runtime.go rootless cni without infra container 2021-04-01 17:27:03 +02:00
runtime_cstorage.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_ctr.go Ensure manually-created volumes have correct ownership 2021-03-24 14:24:47 -04:00
runtime_img.go Should send the OCI runtime path not just the name to buildah 2021-03-31 09:46:42 -04:00
runtime_img_test.go Document CONTAINERS_CONF/CONTAINERS_STORAGE_CONF Env variables 2021-03-10 06:34:47 -05:00
runtime_migrate.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_migrate_unsupported.go Use Libpod tmpdir for pause path 2020-12-02 14:18:37 -05:00
runtime_pod.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_pod_infra_linux.go Correct compat images/create?fromImage response 2021-02-26 03:08:10 +01:00
runtime_pod_linux.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_pod_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_renumber.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_volume.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_volume_linux.go bump go module to v3 2021-02-22 09:03:51 +01:00
runtime_volume_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
state.go Rewrite Rename backend in a more atomic fashion 2021-03-02 13:30:28 -05:00
state_test.go bump go module to v3 2021-02-22 09:03:51 +01:00
stats.go bump go module to v3 2021-02-22 09:03:51 +01:00
stats_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
storage.go turn hidden --trace into a NOP 2021-03-08 09:22:42 +01:00
util.go bump go module to v3 2021-02-22 09:03:51 +01:00
util_linux.go bump go module to v3 2021-02-22 09:03:51 +01:00
util_linux_test.go Fix mismatch between log messages and behavior of libpod.LabelVolumePath. 2020-09-13 23:24:15 -04:00
util_test.go bump go module to v3 2021-02-22 09:03:51 +01:00
util_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00
volume.go bump go module to v3 2021-02-22 09:03:51 +01:00
volume_inspect.go bump go module to v3 2021-02-22 09:03:51 +01:00
volume_internal.go Ensure manually-created volumes have correct ownership 2021-03-24 14:24:47 -04:00
volume_internal_linux.go [NO TESTS NEEDED] Fix rootless volume plugins 2021-03-24 22:53:53 +03:00
volume_internal_unsupported.go bump go module to v3 2021-02-22 09:03:51 +01:00