containers / podman

Podman: A tool for managing OCI containers and pods.
https://podman.io
Apache License 2.0
23.26k stars 2.37k forks source link

Do not create network interfaces if requested not to do so #23870

Closed RushingAlien closed 3 weeks ago

RushingAlien commented 3 weeks ago

Issue Description

Quoting https://github.com/GNS3/gns3-server/issues/1811#issuecomment-1373383960:

But at the moment podman will always create network interfaces in the container, even when requested not to do so. This prevents ubridge from moving interfaces to the container's namespace & renaming them, since they already exist with the same name inside the container. This is a podman issue, not a GNS3 issue.

Steps to reproduce the issue

Steps to reproduce the issue

  1. Use GNS3
  2. create a symlink of /var/run/docker.sock that symlinks to /run/podman/podman.sock
  3. Use a docker template in GNS3
  4. Add the docker template to the network topology (creates container)
  5. Start the container via GNS3

Describe the results you received

gambar

Describe the results you expected

For the container to start

podman info output

host:
  arch: amd64
  buildahVersion: 1.37.2
  cgroupControllers:
  - cpuset
  - cpu
  - io
  - memory
  - hugetlb
  - pids
  - rdma
  - misc
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-1:2.1.12-1.1
    path: /usr/bin/conmon
    version: 'conmon version 2.1.12, commit: e8896631295ccb0bfdda4284f1751be19b483264'
  cpuUtilization:
    idlePercent: 89.95
    systemPercent: 2.02
    userPercent: 8.03
  cpus: 16
  databaseBackend: boltdb
  distribution:
    distribution: arch
    version: unknown
  eventLogger: journald
  freeLocks: 2048
  hostname: workplus-raambm
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 6.9.10-arch1-1
  linkmode: dynamic
  logDriver: journald
  memFree: 1229545472
  memTotal: 14374707200
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.12.1-1.1
      path: /usr/lib/podman/aardvark-dns
      version: aardvark-dns 1.12.1
    package: netavark-1.12.2-1.1
    path: /usr/lib/podman/netavark
    version: netavark 1.12.2
  ociRuntime:
    name: crun
    package: crun-1.16.1-1.1
    path: /usr/bin/crun
    version: |-
      crun version 1.16.1
      commit: afa829ca0122bd5e1d67f1f38e6cc348027e3c32
      rundir: /run/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-2024_08_21.1d6142f-1.1
    version: |
      pasta 2024_08_21.1d6142f
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: true
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /etc/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: true
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.3.1-1.1
    version: |-
      slirp4netns version 1.3.1
      commit: e5e368c4f5db6ae75c2fce786e31eef9da6bf236
      libslirp: 4.8.0
      SLIRP_CONFIG_VERSION_MAX: 5
      libseccomp: 2.5.5
  swapFree: 20651433984
  swapTotal: 22963806208
  uptime: 2h 55m 14.00s (Approximately 0.08 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - docker.io
  - quay.io
  - registry.fedoraproject.org
  - mcr.microsoft.com
  - registry.access.redhat.com
store:
  configFile: /etc/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev
  graphRoot: /var/lib/containers/storage
  graphRootAllocated: 498496176128
  graphRootUsed: 373790470144
  graphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Supports shifting: "true"
    Supports volatile: "true"
    Using metacopy: "true"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 1
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 5.2.2
  Built: 1724352649
  BuiltTime: Fri Aug 23 01:50:49 2024
  GitCommit: fcee48106a12dd531702d729d17f40f6e152027f
  GoVersion: go1.23.0
  Os: linux
  OsArch: linux/amd64
  Version: 5.2.2

Podman in a container

No

Privileged Or Rootless

Privileged

Upstream Latest Release

Yes

Additional environment details

Additional environment details

Additional information

Additional information like issue happens only occasionally or issue happens with a particular architecture or on a particular setting

Luap99 commented 3 weeks ago
But at the moment podman will always create network interfaces in the container, even when requested not to do so. This prevents ubridge from moving interfaces to the container's namespace & renaming them, since they already exist with the same name inside the container. This is a podman issue, not a GNS3 issue.

This wording doesn't make any sense to me. It is not clear what they are doing. Looking at the issue it links to https://github.com/containers/podman/issues/16716 which has been fixed already.

Looking at the /etc/hosts error message this is to be expected, podman creates its own host entries in /etc/hosts and bind mounts this file into the container. So any mv/replace will not work on the file as it is a mount point. It must change the inode directly if it wants to edit the file. Alternatively if the podman host entries are not wanted you can use --no-hosts to disable this behavior then it wil just be the file from the image.