Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add bridge networking #28

Open
tonistiigi opened this issue Jun 23, 2017 · 7 comments
Open

add bridge networking #28

tonistiigi opened this issue Jun 23, 2017 · 7 comments

Comments

@tonistiigi
Copy link
Member

The worker currently uses host networking. Move this to use a bridge. Example in https://gist.github.com/42a6ca6b8f21af1bead05095aa97681c

buildd can reuse docker0 if it exists, or one can be passed in with a flag.

@kunalkushwaha
Copy link
Collaborator

Is this still required or it need to be fixed in context of distributed Buildkit #62 ?

/cc @tonistiigi @AkihiroSuda

@tonistiigi
Copy link
Member Author

Yes, I don't think this is related to #62. We will not expect the workers to create processes that can reach each other. This is more a security feature, to make sure all processes are properly sandboxed.

@tonistiigi
Copy link
Member Author

@AkihiroSuda I saw you were working on slirp go bindings? What's your take on using slirp as a default for buildkit?

@AkihiroSuda
Copy link
Member

https://twitter.com/_AkihiroSuda_/status/970665536492158976

I'd use slirp for enabling NAT in unprivileged netns+tap.
Processes within this netns (such as BuildKit) would be unaware of slirp.

I think we should only use slirp for rootless mode, because it is slow.
Even for rootless mode, I'd suggest using lxc-user-net SUID binary for network-intensive workload.

rough benchmark: When I downloaded Ubuntu ISO from the internet using VDE slirp (https://github.com/AkihiroSuda/runrootless/tree/b4dc7bfd80ea05aedd4e92fffbb1d2562572ba47/misc/vde), it tooked 55s while it tooked 47s on the native networking. (Although there is a big space for performance optimization.)

@AkihiroSuda
Copy link
Member

Processes within this netns (such as BuildKit) would be unaware of slirp.

p.s. I think BuildKit would use CNI (bridge) plugin by default, for both rootful mode and rootless mode.

@ciaranmcnulty
Copy link

This would be useful for us; we build a few wiremock-based images together in a bake, and as part of their builds they run unit tests that bind Java services to local ports and test some requests+responses. Without CNI these can contend; we've ended up moving them out of the default group and explicitly building in series

@sipsma
Copy link
Collaborator

sipsma commented May 17, 2022

Just a note, @tonistiigi mentioned in slack that the blocker on enabling bridge mode in the moby/buildkit images is the performance cost of initializing network namespaces w/ CNI. This could be alleviated by adding support for a pool of pre-initialized, re-usable namespaces.

goller added a commit to goller/buildkit that referenced this issue Jul 14, 2023
fix: check snapshot labels to avoid panic
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
5 participants