Now `dockerd-rootless.sh` launches RootlessKit with `--detach-netns`
so as to run the daemon in the host network namespace.
The libnetwork namespaces are allocated inside the "detached" netns
(`$ROOTLESSKIT_STATE_DIR/netns`) that is associated with slirp4netns,
vpnkit, pasta, etc., as the rootless daemon has no `CAP_NET_ADMIN` for
the host network namespace.
This will enable:
- Accelerated (and deflaked) `docker pull`, `docker push`, `docker build`, etc
- Proper support for `docker pull 127.0.0.1:.../...`
- Proper support for `dockern run --net=host`
See also:
- rootless-containers/rootlesskit PR 379
- containerd/nerdctl PR 2723
NOTE: libnetwork contains code generated by Claude Code
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This avoids depending on global state in the package, and "forces"
consumers to go through the initHandles() func to get the handles.
A slight change in behavior is that `ResetHandles()` may now initialize
a new namespace only to reset it, but this is likely an "OK" trade-off.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This reverts commit 40b6ebfe75 ([libnetwork@d82ceca]),
which added it to make compile work on Windows, but this package contains
no Windows code, so shouldn't be imported in any file compiled on Windows.
[libnetwork@d82ceca]: d82ceca3f6
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
SetupTestOSContextEx calls 'ns.Init' (which, outside tests, is protected
by a sync.Once), and it's called again by the returned OSContext.Cleanup
method. That overwrites the ns package's namespace and netlink handles
(initNs and initNl) without closing them.
Because SetupTestOSContextEx changes that shared state, it should not
be used in parallel tests. So, rather than trying to close the handles
in ns.Init if already open - un-export Init so it's always called via
its sync.Once, and add a reset function for tests to use. Have
SetupTestOSContextEx claim a mutex to avoid crashy surprises or
hard to catch issues where the ns package isn't using the expected
namespace if it is used in parallel tests.
Signed-off-by: Rob Murray <rob.murray@docker.com>
