network: disallow CNI networks with user namespaces #8960
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: giuseppe The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
the
approved
test/e2e/run_networking_test.go
Outdated
| @@ -639,6 +639,22 @@ var _ = Describe("Podman run networking", func() { | |||
| Expect(create.ExitCode()).To(BeZero()) | |||
| }) | |||
|
|
|||
| It("podman run in custom CNI network with --uidmap", func() { | |||
| netName := "podmantestnetwork2" | |||
There was a problem hiding this comment.
Please use stringid.GenerateNonCryptoID() for the network name. The static network names are causing a lot of flakes.
giuseppe
force-pushed
the
bridge-no-post-config
branch
from
3978eaf to
9585fbe
Compare
|
LGTM but make @Luap99 change. |
giuseppe
force-pushed
the
bridge-no-post-config
branch
from
9585fbe to
d7d2ba9
Compare
|
@containers/podman-maintainers PTAL |
|
LGTM, but your test is failing on rootless. |
giuseppe
force-pushed
the
bridge-no-post-config
branch
from
d7d2ba9 to
5e8f08e
Compare
giuseppe
changed the title
|
it was passing locally as I had a modified containers.conf file :/ I don't think we can (easily) support this use case, the user namespace doesn't own the CNI namespace, so the netns configuration should be performed through the infra container after the container is created. @AkihiroSuda do you have better ideas on how it can be performed? |
it solves a segfault when running as rootless a command like: $ podman run --uidmap 0:0:1 --net foo --rm fedora true panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x30 pc=0x5629bccc407c] goroutine 1 [running]: panic(0x5629bd3d39e0, 0x5629be0ab8e0) /usr/lib/golang/src/runtime/panic.go:1064 +0x545 fp=0xc0004592c0 sp=0xc0004591f8 pc=0x5629bbd35d85 runtime.panicmem(...) /usr/lib/golang/src/runtime/panic.go:212 runtime.sigpanic() /usr/lib/golang/src/runtime/signal_unix.go:742 +0x413 fp=0xc0004592f0 sp=0xc0004592c0 pc=0x5629bbd4cd33 github.com/containers/podman/libpod.(*Runtime).setupRootlessNetNS(0xc0003fe9c0, 0xc0003d74a0, 0x0, 0x0) /builddir/build/BUILD/podman-2.2.1/_build/src/github.com/containers/podman/libpod/networking_linux.go:238 +0xdc fp=0xc000459338 sp=0xc0004592f0 pc=0x5629bccc407c github.com/containers/podman/libpod.(*Container).completeNetworkSetup(0xc0003d74a0, 0x0, 0x0) /builddir/build/BUILD/podman-2.2.1/_build/src/github.com/containers/podman/libpod/container_internal.go:965 +0xb72 fp=0xc0004594d8 sp=0xc000459338 pc=0x5629bcc81732 [.....] Signed-off-by: Giuseppe Scrivano <[email protected]>
Signed-off-by: Giuseppe Scrivano <[email protected]>
giuseppe
force-pushed
the
bridge-no-post-config
branch
from
5e8f08e to
ee68466
Compare
|
LGTM, tests seem to be mainly green |
|
/lgtm |
|
/hold |
openshift-ci-robot
added
the
do-not-merge/hold
|
Looks like a flake, already restarted. Remove hold when all green. |
|
/hold cancel |
openshift-ci-robot
removed
the
do-not-merge/hold
|
LGTM |
|
All happy green test buttons. |
github-actions
bot
added
the
locked - please file new issue/PR
it solves a segfault when running as rootless a command like:
$ podman run --uidmap 0:0:1 --net foo --rm fedora true
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x30 pc=0x5629bccc407c]
goroutine 1 [running]:
panic(0x5629bd3d39e0, 0x5629be0ab8e0)
/usr/lib/golang/src/runtime/panic.go:1064 +0x545 fp=0xc0004592c0 sp=0xc0004591f8 pc=0x5629bbd35d85
runtime.panicmem(...)
/usr/lib/golang/src/runtime/panic.go:212
runtime.sigpanic()
/usr/lib/golang/src/runtime/signal_unix.go:742 +0x413 fp=0xc0004592f0 sp=0xc0004592c0 pc=0x5629bbd4cd33
github.com/containers/podman/libpod.(*Runtime).setupRootlessNetNS(0xc0003fe9c0, 0xc0003d74a0, 0x0, 0x0)
/builddir/build/BUILD/podman-2.2.1/_build/src/github.com/containers/podman/libpod/networking_linux.go:238 +0xdc fp=0xc000459338 sp=0xc0004592f0 pc=0x5629bccc407c
github.com/containers/podman/libpod.(*Container).completeNetworkSetup(0xc0003d74a0, 0x0, 0x0)
/builddir/build/BUILD/podman-2.2.1/_build/src/github.com/containers/podman/libpod/container_internal.go:965 +0xb72 fp=0xc0004594d8 sp=0xc000459338 pc=0x5629bcc81732
[.....]
Signed-off-by: Giuseppe Scrivano [email protected]