This commit adds the possiblity of passing a comma separated list of network
names to the '-private-net' argument. Only networks with their names specified
are loaded in the pods network stack.
The network documentation has been updated accordingly.
rktRoot is misleading as the directory is really the root of a specific
pod. Also add a TODO note that this is currently only ever set to cwd
(i.e. "."), and hence necessitates relative paths.
Ports that were defined in app manifest can be
exposed via --port=name:host-port option on cmd line.
For example, given app manifest with ports entry:
{
"name": "http",
"port": 80,
"protocol": "tcp"
}
rkt run --private-net --port=http:8888 myapp.aci
will forward traffic from host's tcp port 8888 to
container's port 80.
Fixes#624
Since the spec requires AC_METADATA_URL env var,
well known IP is no longer needed. This removes
the iptables manipulation. Instead the IP address of the
host is passed in the AC_METADATA_URL. This host IP
is the address of the host end of the default veth.
Before this patch, when withNetNS() returns with an error, the current
net namespace is undefined. In order to make the API more readable,
withNetNS() should always at least attempt to return in a defined
namespace used before being called, even in case of errors.
In practice, the only caller of withNetNS will handle the error case
correctly by calling Teardown() so there should be no functional changes
with this patch.
The user might modify or delete the net config
files while the container is running. This will
mess up the plugins on the teardown path. Copying
them into a the container directory and using them
from there should guard against that. It also lays
the foundation for GC to process unremoved files.
Take two at getting the spec vendored into Rocket with Godep.
Since actool is used during the construction of the stage1.aci, it
really needs to be vendored too to prevent any unexpected divergence
between whatever version the user happens to have in their PATH. Thus,
we introduce a silly dummy package (stage1/dummy.go) to coerce Godep
into vendoring actool. This also requires a slight rearrangement of the
appc repo, moving some functionality from actool itself into the aci
package.
- Convert ipamanager into IPAM plugin (static) that uses env
variables instead of cmd line args
- Make bridge and veth plugins call out to IPAM plugin
- Refacor code around the new IPAM plugins
- Move metadatasvc into rkt as a subcommand
- Add option to spawn metadatasvc from rkt run
- Register container with metadatasvc
- Removes anti-spoofing logic -- this belongs in the network plugin
Fixes#33
Simplifying the plugin interface. No more HTTP interface and plugin
configs. Plugin type maps to executable name in stage1 rootfs or
on host in a well known dir. Env vars are used for parameter passing
to the plugin. Also, default net conf is kept in stage1 rootfs to make
private networking work "out of the box".
The scheme of having a host veth not have an IP
and not be plugged into bridge does not work in
practice. This creates a true point-to-point link
between the container and the host.
Eugene Yakubovich