Skip to content

For --net=host do not create a new UTS namespace#12185

Closed
ibuildthecloud wants to merge 1 commit intomoby:masterfrom
ibuildthecloud:no-uts
Closed

For --net=host do not create a new UTS namespace#12185
ibuildthecloud wants to merge 1 commit intomoby:masterfrom
ibuildthecloud:no-uts

Conversation

@ibuildthecloud
Copy link
Copy Markdown
Contributor

Currently Docker create a UTS namespace when --net=host is used. I honestly don't know why and this change scares me a bit because of that. But... this change is quite simple in that we don't set the hostname or create UTS namespace if the network mode is host.

For --net=host we should share the UTS namespace of the host.  This
requires not sending the hostname to libcontainer, so we blank it out.

Signed-off-by: Darren Shepherd <darren@rancher.com>
@thefallentree
Copy link
Copy Markdown

I'm a bit of confused, how would this CL address the need to set hostname while running in --net="host" mode?

@ibuildthecloud
Copy link
Copy Markdown
Contributor Author

To give a bit of background on why this is needed... In RancherOS we run everything in a container (go containers!). So network configuration happens in the a container using --net=host. This is all fine and dandy except the hostname. When we set the hostname it doesn't take effect on the host. Now we can obviously do some nsenter tricks and work around that but then we hit a more fundamental issue. If we use the nsenter tricks it will set the hostname on the host, but it won't propagate to other containers with --net=host because those containers have effectively copied the hostname at start time. We really need --net=host to not create a new UTS namespace.

@ibuildthecloud
Copy link
Copy Markdown
Contributor Author

@sunyc, oops. I totally read your issue wrong. Sorry, it doesn't address it. I'll delete that comment.

@icecrime
Copy link
Copy Markdown
Contributor

icecrime commented Apr 8, 2015

I'm not the expert here, but I think your patch makes total sense: +1.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is validation in libcontainer about missing NEWUTS and non-empty hostname. So I think it is better to remove emptying Hostname. Also docker itself forbids --net=host with --hostname.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@LK4D4 I don't follow. I had to set Hostname="" because libcontainer itself would blow up saying I can't specify a hostname if UTS isn't private. So I set Hostname to ""

@LK4D4
Copy link
Copy Markdown
Contributor

LK4D4 commented Apr 8, 2015

I wonder if we should have some check in libcontainer too.
ping @mrunalp @crosbymichael

@mrunalp
Copy link
Copy Markdown
Contributor

mrunalp commented Apr 8, 2015

Yes, I think it makes to have a check in lib container.

Sent from my iPhone

On Apr 8, 2015, at 10:21 AM, Alexander Morozov notifications@github.com wrote:

I wonder if we should have some check in libcontainer too.
ping @mrunalp @crosbymichael


Reply to this email directly or view it on GitHub.

@crosbymichael
Copy link
Copy Markdown
Contributor

@ibuildthecloud I would rather go ahead and expand to a new --uts flag with the same settings like --uts host for this. What do you think about that? It gives you more control without this hiding behind something because it still makes sense to not do this for --net host.

@LK4D4
Copy link
Copy Markdown
Contributor

LK4D4 commented Apr 8, 2015

@crosbymichael Is non-host UTS makes sense for host NET?

@ibuildthecloud
Copy link
Copy Markdown
Contributor Author

@crosbymichael I'm fine with the uts flag. I'll implement that if you think its a better approach. I guess at least that way we won't break something by changing the behavior of --net=host.

@crosbymichael
Copy link
Copy Markdown
Contributor

@LK4D4 I think it makes sense, hostname does not necessarily have anything related to networking, that is why they are in two different namespaces. I know it's kinda weird but we talked about this in the past because I asked the same question to others if we should drop UTS when we drop NET

@LK4D4
Copy link
Copy Markdown
Contributor

LK4D4 commented Apr 8, 2015

@crosbymichael Cool, thanks!

@thefallentree
Copy link
Copy Markdown

Can we simply reuse the --hostname=XXX flag? smt like --hostname=host would make t use host's hostname , This also have the potential to make it possible to change hostname with --net="host" --hostname=XXXX ,

@ibuildthecloud
Copy link
Copy Markdown
Contributor Author

If prefer to not have magic value of hostname. If we add the uts flag, I think it would make sense to change Docker to support hostname with net host.

@crosbymichael
Copy link
Copy Markdown
Contributor

erk, I don't your use case for change the actual hostname but I don't that is the expected output for most other people

@ibuildthecloud
Copy link
Copy Markdown
Contributor Author

@crosbymichael I think @sunyc wants to be able to run with net=host but still have a different hostname for the container.

@LK4D4
Copy link
Copy Markdown
Contributor

LK4D4 commented Apr 14, 2015

I though we decided for separate flag for UTS. As @crosbymichael said UTS namespace actually not directly related for networking.

@thefallentree
Copy link
Copy Markdown

  1. add a --uts flag, when --uts=host ,drop UTS namespace.
  2. allow --hostname only when --uts="container", regardless of --net=host

I think this seems to be the consensus here?

On Wed, Apr 15, 2015 at 12:06 AM, Alexander Morozov <
notifications@github.com> wrote:

I though we decided for separate flag for UTS. As @crosbymichael
https://github.com/crosbymichael said UTS namespace actually not
directly related for networking.


Reply to this email directly or view it on GitHub
#12185 (comment).

@ibuildthecloud
Copy link
Copy Markdown
Contributor Author

@sunyc I agree with your summary. I'm going to put in a PR for #1 only though. I agree #2 should be done but don't quite know the scope of that work.

@icecrime
Copy link
Copy Markdown
Contributor

If I understand correctly, a new PR will follow: I'm closing this one!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants