mirror of
https://github.com/moby/moby.git
synced 2026-08-09 17:39:58 +00:00
84aedb8055
Now `dockerd-rootless.sh` launches RootlessKit with `--detach-netns` so as to run the daemon in the host network namespace. The libnetwork namespaces are allocated inside the "detached" netns (`$ROOTLESSKIT_STATE_DIR/netns`) that is associated with slirp4netns, vpnkit, pasta, etc., as the rootless daemon has no `CAP_NET_ADMIN` for the host network namespace. This will enable: - Accelerated (and deflaked) `docker pull`, `docker push`, `docker build`, etc - Proper support for `docker pull 127.0.0.1:.../...` - Proper support for `dockern run --net=host` See also: - rootless-containers/rootlesskit PR 379 - containerd/nerdctl PR 2723 NOTE: libnetwork contains code generated by Claude Code Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
44 lines
1.2 KiB
Go
44 lines
1.2 KiB
Go
package daemon
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/moby/moby/v2/daemon/config"
|
|
"github.com/moby/moby/v2/daemon/container"
|
|
"github.com/moby/moby/v2/daemon/internal/libcontainerd/types"
|
|
"github.com/moby/moby/v2/daemon/pkg/oci"
|
|
"github.com/moby/moby/v2/errdefs"
|
|
"github.com/opencontainers/runtime-spec/specs-go"
|
|
)
|
|
|
|
// initializeCreatedTask performs any initialization that needs to be done to
|
|
// prepare a freshly-created task to be started.
|
|
func (daemon *Daemon) initializeCreatedTask(
|
|
ctx context.Context,
|
|
cfg *config.Config,
|
|
tsk types.Task,
|
|
ctr *container.Container,
|
|
spec *specs.Spec,
|
|
) error {
|
|
if ctr.Config.NetworkDisabled {
|
|
return nil
|
|
}
|
|
nspath, ok := oci.NamespacePath(spec, specs.NetworkNamespace)
|
|
if ok && nspath == "" { // the runtime has been instructed to create a new network namespace for tsk.
|
|
sb, err := daemon.netController.GetSandbox(ctr.ID)
|
|
if err != nil {
|
|
return errdefs.System(err)
|
|
}
|
|
if err := sb.SetKey(ctx, fmt.Sprintf("/proc/%d/ns/net", tsk.Pid())); err != nil {
|
|
return errdefs.System(err)
|
|
}
|
|
}
|
|
if err := daemon.runInNetNS(func() error {
|
|
return daemon.allocateNetwork(ctx, cfg, ctr)
|
|
}); err != nil {
|
|
return fmt.Errorf("%s: %w", errSetupNetworking, err)
|
|
}
|
|
return nil
|
|
}
|