Description
Hello all
Simple all, i wrote some magic which injects some stuff into the OCI Config that postStart hook is gonna be called.
In there i do some network magic within the container network namespace.
Until Version 28, when the Poststart got fired, every network interfaces were initalized, but beginning with 28, the network interfaces are just there after the container is started.
It seems to be wrong, because in every Spec. or Comment (also every AI) stands:
- postStart will have the initalized interfaces
https://specs.opencontainers.org/runtime-spec/config/?v=v1.0.2#poststart
https://specs.opencontainers.org/runtime-spec/runtime/?v=v1.0.2#lifecycle
I tried on my ubuntu VM the versions:
- 5:27.5.1-1 -> Working as expected
- 5:28.0.0-1 -> Not working, interfaces are missing in postStart
Regards
Benjamin
Reproduce
- Install package
jq
- Working installation of
python3
- Download the python script below somewhere (remember the path) runc-hooked.py
- Make it executable
- Modify the
daemon.json to include our custom runtime
{
"runtimes": {
"runc-hooks": {
"path": "/root/runc-hooked.py"
}
}
}
- Create a internal network
docker network create --driver bridge --internal buggy
- Run a dummy container with the network and custom runtime
docker run --rm --runtime runc-hooks --network buggy alpine:3.20 ip a s
With version above 28 the /tmp/hook.log will look like this
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
While the container executed will report
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0@if380: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP
link/ether fe:99:f3:9c:fd:89 brd ff:ff:ff:ff:ff:ff
inet 172.18.0.2/16 brd 172.18.255.255 scope global eth0
valid_lft forever preferred_lft forever
Expected behavior
When called from poststart hook, executing ip a s in the containers namespace, the added interfaces are printed.
Version below 28 (used 27) works as expected.
docker version
Client: Docker Engine - Community
Version: 28.4.0
API version: 1.47 (downgraded from 1.51)
Go version: go1.24.7
Git commit: d8eb465
Built: Wed Sep 3 20:57:32 2025
OS/Arch: linux/amd64
Context: default
Server: Docker Engine - Community
Engine:
Version: 27.5.1
API version: 1.47 (minimum version 1.24)
Go version: go1.22.11
Git commit: 4c9b3b0
Built: Wed Jan 22 13:41:48 2025
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v1.7.28
GitCommit: b98a3aace656320842a23f4a392a33f46af97866
runc:
Version: 1.3.0
GitCommit: v1.3.0-0-g4ca628d1
docker-init:
Version: 0.19.0
GitCommit: de40ad0
docker info
Client: Docker Engine - Community
Version: 28.4.0
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.28.0
Path: /usr/libexec/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v2.39.4
Path: /usr/libexec/docker/cli-plugins/docker-compose
Server:
Containers: 0
Running: 0
Paused: 0
Stopped: 0
Images: 1
Server Version: 27.5.1
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc runc-hooks
Default Runtime: runc
Init Binary: docker-init
containerd version: b98a3aace656320842a23f4a392a33f46af97866
runc version: v1.3.0-0-g4ca628d1
init version: de40ad0
Security Options:
apparmor
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.8.0-84-generic
Operating System: Ubuntu 24.04.3 LTS
OSType: linux
Architecture: x86_64
CPUs: 6
Total Memory: 7.755GiB
Name: linux
ID: 694a72ee-694c-44d0-b82c-eb28570741a5
Docker Root Dir: /var/lib/docker
Debug Mode: false
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: falseAdditional Info
When you using ubuntu like me, you can easly switch between the version like that:
Version 27 (working)
sudo apt-get install -y docker-ce=5:27.5.1-1~ubuntu.24.04~noble docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin --allow-downgrades
Version 28 (not working)
sudo apt-get install -y docker-ce=5:28.0.0-1~ubuntu.24.04~noble docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin --allow-downgrades
PRETTY_NAME="Ubuntu 24.04.3 LTS"
NAME="Ubuntu"
VERSION_ID="24.04"
VERSION="24.04.3 LTS (Noble Numbat)"
VERSION_CODENAME=noble
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=noble
LOGO=ubuntu-logo```
Description
Hello all
Simple all, i wrote some magic which injects some stuff into the OCI Config that postStart hook is gonna be called.
In there i do some network magic within the container network namespace.
Until Version 28, when the Poststart got fired, every network interfaces were initalized, but beginning with 28, the network interfaces are just there after the container is started.
It seems to be wrong, because in every Spec. or Comment (also every AI) stands:
https://specs.opencontainers.org/runtime-spec/config/?v=v1.0.2#poststart
https://specs.opencontainers.org/runtime-spec/runtime/?v=v1.0.2#lifecycle
I tried on my ubuntu VM the versions:
Regards
Benjamin
Reproduce
jqpython3daemon.jsonto include our customruntime{ "runtimes": { "runc-hooks": { "path": "/root/runc-hooked.py" } } }With version above 28 the
/tmp/hook.logwill look like thisWhile the container executed will report
Expected behavior
When called from
poststarthook, executingip a sin the containers namespace, the addedinterfacesare printed.Version below 28 (used 27) works as expected.
docker version
Client: Docker Engine - Community Version: 28.4.0 API version: 1.47 (downgraded from 1.51) Go version: go1.24.7 Git commit: d8eb465 Built: Wed Sep 3 20:57:32 2025 OS/Arch: linux/amd64 Context: default Server: Docker Engine - Community Engine: Version: 27.5.1 API version: 1.47 (minimum version 1.24) Go version: go1.22.11 Git commit: 4c9b3b0 Built: Wed Jan 22 13:41:48 2025 OS/Arch: linux/amd64 Experimental: false containerd: Version: v1.7.28 GitCommit: b98a3aace656320842a23f4a392a33f46af97866 runc: Version: 1.3.0 GitCommit: v1.3.0-0-g4ca628d1 docker-init: Version: 0.19.0 GitCommit: de40ad0docker info
Additional Info
When you using ubuntu like me, you can easly switch between the version like that:
Version 27 (working)
Version 28 (not working)