On Wed, 2019-12-04 at 17:36 +0000, Montes, Julio wrote:

Stefano,

> Do you think could be an easy change in the Kata runtime?

> I need to look better, but if you already know the answer you'll
> save me some time :)

ok, this means all kata components must be in the same network namespace.

fortunately, kata-shim and qemu run in the same network namespace, so the change should be easy, just move kata-proxy and kata-runtime into the same net namespace

Well in case of vsock, we don't need kata-proxy, the shim being directly connected to the VM through vsock. And the kata-shim runs in the same netns as the VMM, so we're good from this perspective.

In case of containerd-shimv2, we don't have kata-shim anymore, the shim being a simple thread part of the kata-runtime process, which means kata-runtime needs to enter the netns, and that's where it might be pretty complex. IIRC, Julio did some experiments to run the kata-runtime in a set of namespaces, but I don't think we merged it, did we?

From: Stefano Garzarella <sgarzare@redhat.com>
Sent: Wednesday, December 4, 2019 11:05 AM
To: Montes, Julio <julio.montes@intel.com>
Cc: kata-dev@lists.katacontainers.io <kata-dev@lists.katacontainers.io>
Subject: Re: [kata-dev] vsock & network namespaces in Kata

On Wed, Dec 04, 2019 at 03:54:06PM +0000, Montes, Julio wrote:
> Hi Stefano

Hi Julio

>
> > - Host: assign the same CID of VMs running in different network
> > namespaces
>
> this means two VMs running in different namespace can use the same CID?

Exactly.

> currently we use VHOST_VSOCK_SET_GUEST_CID to get a unique context ID, is this going to change?

The only change is that the CID is unique in the network namespace
domain.

>
> > 1. Is the VMM (e.g. QEMU) running in a network namespace?
>
> yes, see https://github.com/kata-containers/runtime/blob/62cd08044d78912228d9dc800cb1b8bd3de3b971/virtcontainers/sandbox.go#L1024-L1041
>
> > 2. Is the host application, that use vsock to communicate with the
> > guest, running in the same network namespace?
>
> afaik, no

This could be a problem with the RFC that I sent, because we allow only
the processes in the same netns of the VMM, to communicate with the
guest.

Do you think could be an easy change in the Kata runtime?
I need to look better, but if you already know the answer you'll
save me some time :)

>
> > 3. Is the agent in the guest running outside a netns (default init_netns)?
>
> yes

This is nice.

Thank you very much,
Stefano