<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr" style="text-align:left; direction:ltr;">
<div>On Wed, 2019-12-04 at 17:36 +0000, Montes, Julio wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<div id="divtagdefaultwrapper" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;" dir="ltr">
<p style="margin-top:0;margin-bottom:0"><font size="2"><span style="font-size:11pt;">Stefano,<br>
</span></font></p>
<p style="margin-top:0;margin-bottom:0"><font size="2"><span style="font-size:11pt;"><br>
</span></font></p>
<p style="margin-top:0;margin-bottom:0"><font size="2"><span style="font-size:11pt;">> Do you think could be an easy change in the Kata runtime?<font size="2"><span style="font-size:11pt;"><br>
</span></font></span></font></p>
<p style="margin-top:0;margin-bottom:0"><font size="2"><span style="font-size:11pt;"><font size="2"><span style="font-size:11pt;">> I need to look better, but if you already know the answer you'll<br>
> save me some time :)</span></font></span></font></p>
<p style="margin-top:0;margin-bottom:0"><font size="2"><span style="font-size:11pt;"><font size="2"><span style="font-size:11pt;"><br>
</span></font></span></font></p>
<p style="margin-top:0;margin-bottom:0"><font size="2"><span style="font-size:11pt;"><font size="2"><span style="font-size:11pt;">ok, this means all kata components must be in the same network namespace.<br>
</span></font></span></font></p>
<font size="2"><span style="font-size:11pt;"><font size="2"><span style="font-size:11pt;">fortunately, kata-shim and qemu run in the same network namespace, so the change should be easy, just move kata-proxy and kata-runtime into the same net namespace<br>
</span></font></span></font></div>
</div>
</blockquote>
<div><br>
</div>
<div>Well in case of vsock, we don't need kata-proxy, the shim being directly connected to the VM through vsock. And the kata-shim runs in the same netns as the VMM, so we're good from this perspective.</div>
<div><br>
</div>
<div>In case of containerd-shimv2, we don't have kata-shim anymore, the shim being a simple thread part of the kata-runtime process, which means kata-runtime needs to enter the netns, and that's where it might be pretty complex. IIRC, Julio did some experiments
to run the kata-runtime in a set of namespaces, but I don't think we merged it, did we?</div>
<div><br>
</div>
<div>Sebastien</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<div id="divtagdefaultwrapper" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;" dir="ltr">
<font size="2"><span style="font-size:11pt;"><font size="2"><span style="font-size:11pt;"></span></font></span></font>
<p style="margin-top:0;margin-bottom:0"><font size="2"><span style="font-size:11pt;"><font size="2"><span style="font-size:11pt;"><br>
</span></font></span></font></p>
</div>
<div style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;" dir="ltr">
<br>
<div style="color: rgb(0, 0, 0);">
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Stefano Garzarella <sgarzare@redhat.com><br>
<b>Sent:</b> Wednesday, December 4, 2019 11:05 AM<br>
<b>To:</b> Montes, Julio <julio.montes@intel.com><br>
<b>Cc:</b> kata-dev@lists.katacontainers.io <kata-dev@lists.katacontainers.io><br>
<b>Subject:</b> Re: [kata-dev] vsock & network namespaces in Kata</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On Wed, Dec 04, 2019 at 03:54:06PM +0000, Montes, Julio wrote:<br>
> Hi Stefano<br>
<br>
Hi Julio<br>
<br>
> <br>
> > - Host: assign the same CID of VMs running in different network<br>
> > namespaces<br>
> <br>
> this means two VMs running in different namespace can use the same CID?<br>
<br>
Exactly.<br>
<br>
> currently we use VHOST_VSOCK_SET_GUEST_CID to get a unique context ID, is this going to change?<br>
<br>
The only change is that the CID is unique in the network namespace<br>
domain.<br>
<br>
> <br>
> > 1. Is the VMM (e.g. QEMU) running in a network namespace?<br>
> <br>
> yes, see <a href="https://github.com/kata-containers/runtime/blob/62cd08044d78912228d9dc800cb1b8bd3de3b971/virtcontainers/sandbox.go#L1024-L1041" id="LPlnk931054" class="OWAAutoLink" previewremoved="true">
https://github.com/kata-containers/runtime/blob/62cd08044d78912228d9dc800cb1b8bd3de3b971/virtcontainers/sandbox.go#L1024-L1041</a><br>
> <br>
> > 2. Is the host application, that use vsock to communicate with the<br>
> > guest, running in the same network namespace?<br>
> <br>
> afaik, no<br>
<br>
This could be a problem with the RFC that I sent, because we allow only<br>
the processes in the same netns of the VMM, to communicate with the<br>
guest.<br>
<br>
Do you think could be an easy change in the Kata runtime?<br>
I need to look better, but if you already know the answer you'll<br>
save me some time :)<br>
<br>
> <br>
> > 3. Is the agent in the guest running outside a netns (default init_netns)?<br>
> <br>
> yes<br>
<br>
This is nice.<br>
<br>
Thank you very much,<br>
Stefano<br>
<br>
</div>
</span></font></div>
</div>
</div>
</div>
<pre>_______________________________________________</pre>
<pre>kata-dev mailing list</pre>
<a href="mailto:kata-dev@lists.katacontainers.io">
<pre>kata-dev@lists.katacontainers.io</pre>
</a>
<pre><br></pre>
<a href="http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev">
<pre>http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev</pre>
</a>
<pre><br></pre>
</blockquote>
<p>---------------------------------------------------------------------<br>
Intel Corporation SAS (French simplified joint stock company)<br>
Registered headquarters: "Les Montalets"- 2, rue de Paris, <br>
92196 Meudon Cedex, France<br>
Registration Number: 302 456 199 R.C.S. NANTERRE<br>
Capital: 4,572,000 Euros</p>
<p>This e-mail and any attachments may contain confidential material for<br>
the sole use of the intended recipient(s). Any review or distribution<br>
by others is strictly prohibited. If you are not the intended<br>
recipient, please contact the sender and delete all copies.</p></body>
</html>