On Wed, 2019-12-04 at 17:36 +0000, Montes, Julio wrote: Stefano,
Do you think could be an easy change in the Kata runtime?
I need to look better, but if you already know the answer you'll save me some time :)
ok, this means all kata components must be in the same network namespace. fortunately, kata-shim and qemu run in the same network namespace, so the change should be easy, just move kata-proxy and kata-runtime into the same net namespace Well in case of vsock, we don't need kata-proxy, the shim being directly connected to the VM through vsock. And the kata-shim runs in the same netns as the VMM, so we're good from this perspective. In case of containerd-shimv2, we don't have kata-shim anymore, the shim being a simple thread part of the kata-runtime process, which means kata-runtime needs to enter the netns, and that's where it might be pretty complex. IIRC, Julio did some experiments to run the kata-runtime in a set of namespaces, but I don't think we merged it, did we? Sebastien ________________________________ From: Stefano Garzarella <sgarzare@redhat.com> Sent: Wednesday, December 4, 2019 11:05 AM To: Montes, Julio <julio.montes@intel.com> Cc: kata-dev@lists.katacontainers.io <kata-dev@lists.katacontainers.io> Subject: Re: [kata-dev] vsock & network namespaces in Kata On Wed, Dec 04, 2019 at 03:54:06PM +0000, Montes, Julio wrote:
Hi Stefano
Hi Julio
- Host: assign the same CID of VMs running in different network namespaces
this means two VMs running in different namespace can use the same CID?
Exactly.
currently we use VHOST_VSOCK_SET_GUEST_CID to get a unique context ID, is this going to change?
The only change is that the CID is unique in the network namespace domain.
1. Is the VMM (e.g. QEMU) running in a network namespace?
yes, see https://github.com/kata-containers/runtime/blob/62cd08044d78912228d9dc800cb1...
2. Is the host application, that use vsock to communicate with the guest, running in the same network namespace?
afaik, no
This could be a problem with the RFC that I sent, because we allow only the processes in the same netns of the VMM, to communicate with the guest. Do you think could be an easy change in the Kata runtime? I need to look better, but if you already know the answer you'll save me some time :)
3. Is the agent in the guest running outside a netns (default init_netns)?
yes
This is nice. Thank you very much, Stefano _______________________________________________ kata-dev mailing list <mailto:kata-dev@lists.katacontainers.io> kata-dev@lists.katacontainers.io <http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev> http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev --------------------------------------------------------------------- Intel Corporation SAS (French simplified joint stock company) Registered headquarters: "Les Montalets"- 2, rue de Paris, 92196 Meudon Cedex, France Registration Number: 302 456 199 R.C.S. NANTERRE Capital: 4,572,000 Euros This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.