mirror of
https://github.com/kernelkit/infix.git
synced 2026-08-02 05:43:02 +02:00
Joachim Wiberg
674fd6c396
Previously at least one end of a veth pair had to remain in the host namespace, because that end created and destroyed the pair. Assigning both ends to containers left no one to create it. Select a deterministic primary end so exactly one side creates the pair. When the primary is itself a container interface, create the pair in the host namespace before the container starts; CNI host-device then moves each end into its container. Teardown is deferred to the container removal script so the pair does not linger and block re-creation. Drop the now-obsolete limitation notes from the documentation and YANG, and add a regression test connecting two containers over a veth pair. Fixes: #941 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
=== VETH Pair Between Two Containers
ifdef::topdoc[:imagesdir: {topdoc}../../test/case/containers/internal_link]
==== Description
Verify that a VETH pair can connect two containers directly, with *both*
ends handed to containers and neither remaining in the host namespace.
....
.------------. .------------.
| left | | right |
| veth0a ===|========= veth ===========|=== veth0b |
'------------' 10.0.0.1 10.0.0.2 '------------'
....
The pair is created in the host namespace then each end is moved into
its container when starting up. Connectivity is verified by pinging
across the pair, from inside one container's network namespace to the
other end's address.
==== Topology
image::topology.svg[VETH Pair Between Two Containers topology, align=center, scaledwidth=75%]
==== Sequence
. Set up topology and attach to target DUT
. Create VETH pair with both ends assigned to containers
. Verify both containers have started
. Verify {LEFT} reaches {RIGHT} over the internal VETH pair