The architecture doc covers some of your questions I believe [1]: https://github.com/kata-containers/documentation/blob/master/design/architec... Cheers, James [1] - although not all - we need to refresh that doc soon... Le mer. 4 déc. 2019 à 15:55, Montes, Julio <julio.montes@intel.com> a écrit :
Hi Stefano
- Host: assign the same CID of VMs running in different network namespaces
this means two VMs running in different namespace can use the same CID? currently we use VHOST_VSOCK_SET_GUEST_CID to get a unique context ID, is this going to change?
1. Is the VMM (e.g. QEMU) running in a network namespace?
yes, see https://github.com/kata-containers/runtime/blob/62cd08044d78912228d9dc800cb1...
2. Is the host application, that use vsock to communicate with the guest, running in the same network namespace?
afaik, no
3. Is the agent in the guest running outside a netns (default init_netns)?
yes
------------------------------ *From:* Stefano Garzarella <sgarzare@redhat.com> *Sent:* Wednesday, December 4, 2019 4:32 AM *To:* kata-dev@lists.katacontainers.io <kata-dev@lists.katacontainers.io> *Subject:* [kata-dev] vsock & network namespaces in Kata
Hi folks, I'm working on vsock on Linux and I'm adding the network namespace support on it[1].
The main changes are the following: - Guest: can talk with the host packets (send and receive packets) in the default init_netns (maybe we can make it configurable) - Host: can talk with the guest only in the same netns where the VMM is running (e.g. if we start qemu from ns1, all packets are received only in ns1) - Host: assign the same CID of VMs running in different network namespaces - Nested VMs (available from Linux 5.5): isolate host applications from guest applications
IIUC you have a runtime running in the host that communicates using vsock with an agent in the guest. I have few questions: 1. Is the VMM (e.g. QEMU) running in a network namespace? 2. Is the host application, that use vsock to communicate with the guest, running in the same network namespace? 3. Is the agent in the guest running outside a netns (default init_netns)?
If you have any other suggestions, I'd be happy to hear them.
Thanks, Stefano
_______________________________________________ kata-dev mailing list kata-dev@lists.katacontainers.io http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev _______________________________________________ kata-dev mailing list kata-dev@lists.katacontainers.io http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev
-- James --- https://katacontainers.io/ | https://github.com/kata-containers <https://github.com/clearcontainers> Open Source Technology Center Intel Corporation (UK) Ltd. - Co. Reg. #1134945 - Pipers Way, Swindon SN3 1RJ.