Set network namespace in the container

[jprendes]

From all the namespaces specified in the container spec, youki only sets the user and pid namespaces.
Other namespace, like the nerwork namespace, are ignored.

See containerd/runwasi#364 and this slack thread for context.

[utam0k]

Thanks for creating the issue. Why did they think that? I think youki apply the rest of the namespace here:
https://github.com/containers/youki/blob/a6735b1c7e055d68f263624de767e952279fb5bc/crates/libcontainer/src/process/container_init_process.rs#L299

[jprendes]

You are 100% correct.
Youki is setting the network namespace, but for some reason it's not taking effect.
It might be related to what point in the container lifecycle the call is done, maybe the runwasi shim needs to create the container earlier.
I need to dig dipper into this.

[utam0k]

Pods share a network namespace among the containers, right? If it is right, perhaps runwasi is responsible for creating a network namespace for a pod. But I'm not sure...

[yihuaf]

Pods share a network namespace among the containers, right? If it is right, perhaps runwasi is responsible for creating a network namespace for a pod. But I'm not sure...

This is how containerd-shim works. The network namespace is created upfront and the OCI runtime (runc in this case) will join the network namespace. youki implements all namespaces, both create and join existing. I did not dig into the containerd/runwasi codebase, but the idea would be for the containerd level to create the network namespace upfront, and pass the path of the network ns to youki as part of the runtime spec. youki should then join the network namespace correctly. Let me know if there is any issue.

With that being said, I think it is possible to use youki to create all the namespaces for the first container in the pod, and then ask the sidecars to join the same namespaces (pid and network ns).

[yihuaf]

Close this issue since youki does correctly setup the network namespace. Feel free to re-open if there are any issues observed.