github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-08-11 04:42:16 +00:00
Code Issues Projects Releases Wiki Activity

runtime-rs: set network namespace for qemu process and netdev.

Browse Source 
We need ensure the add_network_device happens in netns and
move qemu process into netns which keeps the qemu process
running in this net namespace.

Fixes: #8865

Signed-off-by: Alex Lyn <alex.lyn@antgroup.com>
This commit is contained in:
Alex Lyn 2024-03-12 22:21:43 +08:00
parent 69a5e5b955
commit 63786934f4
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/runtime-rs/crates/hypervisor/src/qemu/inner.rs
View File

@ -62,6 +62,7 @@ impl QemuInner {
pub(crate) async fn start_vm(&mut self, _timeout: i32) -> Result<()> { pub(crate) async fn start_vm(&mut self, _timeout: i32) -> Result<()> {
info!(sl!(), "Starting QEMU VM"); info!(sl!(), "Starting QEMU VM");
let netns = self.netns.clone().unwrap_or_default();
let mut cmdline = QemuCmdLine::new(&self.id, &self.config)?; let mut cmdline = QemuCmdLine::new(&self.id, &self.config)?;
@ -110,6 +111,9 @@ impl QemuInner {
DeviceType::Network(network) => { DeviceType::Network(network) => {
let network_info = &self.config.network_info; let network_info = &self.config.network_info;
// we need ensure add_network_device happens in netns.
let _netns_guard = NetnsGuard::new(&netns).context("new netns guard")?;
_fds_for_qemu = cmdline.add_network_device(&network.config, network_info)?; _fds_for_qemu = cmdline.add_network_device(&network.config, network_info)?;
} }
_ => info!(sl!(), "qemu cmdline: unsupported device: {:?}", device), _ => info!(sl!(), "qemu cmdline: unsupported device: {:?}", device),
@ -125,6 +129,16 @@ impl QemuInner {
command.args(cmdline.build().await?); command.args(cmdline.build().await?);
info!(sl!(), "qemu cmd: {:?}", command); info!(sl!(), "qemu cmd: {:?}", command);
// we need move the qemu process into Network Namespace.
unsafe {
let _pre_exec = command.pre_exec(move || {
let _ = enter_netns(&netns);
Ok(())
});
}
self.qemu_process = Some(command.stderr(Stdio::piped()).spawn()?); self.qemu_process = Some(command.stderr(Stdio::piped()).spawn()?);
info!(sl!(), "qemu process started"); info!(sl!(), "qemu process started");