Previously at least one end of a veth pair had to remain in the host
namespace, because that end created and destroyed the pair. Assigning
both ends to containers left no one to create it.
Select a deterministic primary end so exactly one side creates the pair.
When the primary is itself a container interface, create the pair in the
host namespace before the container starts; CNI host-device then moves
each end into its container. Teardown is deferred to the container
removal script so the pair does not linger and block re-creation.
Drop the now-obsolete limitation notes from the documentation and YANG,
and add a regression test connecting two containers over a veth pair.
Fixes: #941
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add documentation noting that at least one side of a VETH pair must
remain in the host namespace. Both ends cannot be assigned to different
containers.
Updates:
- container.md: Added IMPORTANT note in Container Host Interface section
- infix-if-veth.yang: Added note in module description
- infix-if-container.yang: Added note in host identity description
Fixes: #947
Related: #941
Co-authored-by: troglobit <183517+troglobit@users.noreply.github.com>
Much of the content was made obsolete by recent changes, we now optimize
the experience for users, avoiding recreate at boot unless checksums for
configuration or base image have changed.
This was also a good time to explain the difference between mutable and
immutable tags, which sometimes is a cause for great confusion.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since there is no safe way (unique hash/id) to identify unused named
volumes, we cannot automate removal of them. Since volume data, when
compared to a container image, is quite small, it was decided that we
document this instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- No more default writable layer
- Don't mention read-only (deprecated, and always on now)
- Use ghfm note highlights
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch makes it possible to use format specifiers to "uniqiefy" a
container's hostname in the same way as with ietf-system hostname.
The following specifiers are currently supported:
- %h default hostname from /etc/os-release
- %i value of ID from /etc/os-release
- %m last three octets of base MAC, e.g., c0-ff-ee
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unlock setting a custom interface name inside the container. This aids
se-cases where this is needed and provide a better user experience, for
example when upgrading containers. Not having to reboot the host just
to activate an upgrated container.
Fixes#708
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The container host interface text was a bit hard to understand. This
patch splits it up in two parts, basic routed setup and an advanced
with two interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds limited support for container capabilities. It allows
a more fine-grained control than priviliged mode does.
Fixes#365
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
OCI archives are a bit special. Mention how to load, reference, and
upgrade system using such images.
Fixes#368
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Must run in privileged mode
- Fix copy-paste container name: system -> nftables
- Point out the important settings
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Drop all mention of "CNI" and update text to not use, e.g., `cni-bridge`
when this was changed in the model before the merge to main.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sending SIGTERM to conmon is not a safe shutdown of a podman container.
To handle gracefully handle shutdown, restarting and provide an orderly
start of dependencies, we use the Finit sysv trick via container script
wrapper to call 'podman stop foo'.
However, since podman does not support syslog as output for containers
we employ an old FIFO trick with another program, k8s-logger, to allow
logs to reach syslog. Please note that k8s-logger must have properly
started before we call `podman start` -- this makes us fully dependent
on the 'container' wrapper script. Hence the documentation update.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to the deprecation of CNI i Podman[1], and its upcoming removal in
Podman v5.0, we decided to cut our losses and modify all documentation
and models to become backend neutral. We will continue to use CNI as
long as possible -- it gives us host interfaces, for instance, that is
not part of netawark yet, it seems.
Also, sync mount and volume documentation with YANG model changes.
[1]: https://blog.podman.io/2023/11/cni-deprecation-and-removal-from-podman-5-0/
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After discussions in the development team, and an external demo, we
decided to rename file mounts to just mounts and adopt established
nomenclature.
With this change we now allow mounting any type of file or directory
from the host to the container, for regular files/directories a bind
mount is used. We also introduce 'source' and 'type', to support
mounting of host files and directories, the destination path has been
renamed to 'target'. The mount cousin, 'volume', which basically is a
specialized mount, has also been updated to use 'target'.
The 'source' and 'content' are now hidden behind a YANG choice to ensure
users can only use them the intended way (either/or not both).
Initial models had 'destination' (path) as mandatory, with this change
we can reintroduce that to ensure this proper configurations.
The documentation in both YANG model and markdown has been updated,
significantly, to provide lots of examples.
Please note, glob style mounts have not been tested, at all.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Brief overview of configuration support. Need to add admin-exec level
commands, but since operational and actions still are missing, we keep
it out until after the code review.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a real example where we create a writable layer for container based
on a simple image.
To be able to properly start/stop and monitor containers using Finit, we
need to add the options `--systemd=false` and `--conmon-pidfile=...`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg