Now `dockerd-rootless.sh` launches RootlessKit with `--detach-netns`
so as to run the daemon in the host network namespace.
The libnetwork namespaces are allocated inside the "detached" netns
(`$ROOTLESSKIT_STATE_DIR/netns`) that is associated with slirp4netns,
vpnkit, pasta, etc., as the rootless daemon has no `CAP_NET_ADMIN` for
the host network namespace.
This will enable:
- Accelerated (and deflaked) `docker pull`, `docker push`, `docker build`, etc
- Proper support for `docker pull 127.0.0.1:.../...`
- Proper support for `dockern run --net=host`
See also:
- rootless-containers/rootlesskit PR 379
- containerd/nerdctl PR 2723
NOTE: libnetwork contains code generated by Claude Code
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
The only viable way to allocate a port is to bind and listen to it. So,
the windows PortMapper was really a PortAllocator in disguise.
Rename it to OSAllocator and move it to the portallocator package.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The windows port mapper is needlessly complex while its job is pretty
straightforward: reserve a port through the port allocator, and start a
dummy proxy to allocate it from the OS.
The biggest source of complexity is the use of the `net.Addr` interface
to pass the host IP, port and proto. `MapRange` now has a proto arg, and
returns the allocated port.
`MapRange` is also instantiating a `mapping` struct whose fields are
all unused, except for its `stopUserlandProxy`. Instead, store
`stopProxy` callbacks directly into the `PortMapper`.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
This function is only called by New, and it takes the singleton
PortAllocator exposed by the portallocator package.
Remove this function and instantiate the PortMapper directly from New
constructor.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
The portmapper struct provided by libnet/portmapper is only available
on Windows. Merge both files to reflect that.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Prior to commit 4f09af626, DeleteForwardingTableEntry had a Linux
implementation. That's not the case anymore, and it's a no-op on
Windows. Remove it.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
Prior to commit 4f09af626, AppendForwardingTableEntry had a Linux
implementation. That's not the case anymore, and it's a no-op on
Windows. Remove it.
Signed-off-by: Albin Kerouanton <albinker@gmail.com>
