ceamac
96efcf37e1
Second step of the tap+relay fallback for veth-less kernels (the real target device supports tun/tap but not veth). Reuses the existing bridge as the switching fabric -- provision_bridge()'s NAT/forwarding setup needs no changes -- and only replaces how a container's namespace gets connected to it: - a host-side tap device, created wherever the network's bridge lives and enslaved to it, playing veth's host-side role - a container-side tap device, created directly inside the container's namespace and named eth<N> from the start (no rename step needed) - a relay process holding both fds open, copying raw Ethernet frames bidirectionally between them -- reproducing a veth pair's kernel wire via one userspace hop Not wired into join_one_network() yet -- this commit only adds create_tap_relay()/stop_tap_relay() and exercises them standalone via a new self-test (throwaway bridge + throwaway namespace). A real synchronization bug turned up while writing that self-test: fork() returning to the parent doesn't mean the child has reached its own unshare(CLONE_NEWNET) yet, so using its pid immediately raced and created the container-side tap in the wrong (host) namespace. Fixed by polling namespace_isolated() first, the same guard network_join.cpp's wait_for_isolated_net_namespace() already uses for a real session. Verified twice as root via the doas rule: host-side tap gets created and attached to the bridge, container-side tap gets created with the right name inside the target namespace, and -- the biggest open assumption from the design doc addendum -- both devices disappear on their own once stop_tap_relay() stops the process, no explicit `ip link del` needed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Gv3s5jckJKzh6JkMoi2Akz
44 lines
2.0 KiB
Meson
44 lines
2.0 KiB
Meson
project('slocker-lite', 'cpp',
|
|
version : '0.0.1',
|
|
default_options : ['warning_level=3', 'cpp_std=c++20'])
|
|
|
|
fmt_dep = dependency('fmt')
|
|
catch2_dep = dependency('catch2', required : get_option('enable_tests'))
|
|
yaml_dep = dependency('yaml-0.1')
|
|
archive_dep = dependency('libarchive')
|
|
json_dep = dependency('nlohmann_json')
|
|
spdlog_dep = dependency('spdlog')
|
|
|
|
conf_data = configuration_data()
|
|
conf_data.set_quoted('PACKAGE', meson.project_name())
|
|
conf_data.set_quoted('VERSION', meson.project_version())
|
|
conf_data.set10('ENABLE_TESTS', get_option('enable_tests'))
|
|
|
|
configure_file(output : 'config.h', configuration : conf_data)
|
|
|
|
slocker_lite = executable('slocker-lite',
|
|
['src/main.cpp', 'src/cli_args.cpp', 'src/commands.cpp', 'src/self_test.cpp',
|
|
'src/process.cpp', 'src/oci_image.cpp', 'src/containers_storage.cpp',
|
|
'src/bwrap.cpp', 'src/user_spec.cpp', 'src/config_file.cpp', 'src/volume_mount.cpp',
|
|
'src/pid_file.cpp', 'src/exec_session.cpp', 'src/env_spec.cpp', 'src/daemonize.cpp',
|
|
'src/sandbox_process.cpp', 'src/session_cgroup.cpp', 'src/kill_session.cpp',
|
|
'src/network_subnet.cpp', 'src/persistent_netns.cpp', 'src/network_bridge.cpp',
|
|
'src/network_join.cpp', 'src/port_forward.cpp', 'src/network_tap_relay.cpp'],
|
|
include_directories : include_directories('.'),
|
|
dependencies : [fmt_dep, catch2_dep, yaml_dep, archive_dep, json_dep, spdlog_dep],
|
|
install : true)
|
|
|
|
# Bind-mounted into the sandbox by -r/--run's --user/--group handling (src/bwrap.cpp),
|
|
# so it must be dependency-free and statically linked to run regardless of what
|
|
# libc/libraries the container image itself has.
|
|
priv_drop_helper = executable('slocker-lite-priv-drop',
|
|
['src/priv_drop_helper.cpp'],
|
|
link_args : ['-static'],
|
|
install : true)
|
|
|
|
fixture_tar = custom_target('oci-fixture',
|
|
output : 'fixture.tar',
|
|
command : [find_program('python3'), files('tests/gen_fixture.py'), '@OUTPUT@'])
|
|
|
|
test('test', find_program('python3'), args : [files('tests/run_test.py'), slocker_lite, fixture_tar])
|