moby--moby/libnetwork
Cory Snider 1f22b15030 Lock OS threads when exec'ing with Pdeathsig
On Linux, when (os/exec.Cmd).SysProcAttr.Pdeathsig is set, the signal
will be sent to the process when the OS thread on which cmd.Start() was
executed dies. The runtime terminates an OS thread when a goroutine
exits after being wired to the thread with runtime.LockOSThread(). If
other goroutines are allowed to be scheduled onto a thread which called
cmd.Start(), an unrelated goroutine could cause the thread to be
terminated and prematurely signal the command. See
https://github.com/golang/go/issues/27505 for more information.

Prevent started subprocesses with Pdeathsig from getting signaled
prematurely by wiring the starting goroutine to the OS thread until the
subprocess has exited. No other goroutines can be scheduled onto a
locked thread so it will remain alive until unlocked or the daemon
process exits.

Signed-off-by: Cory Snider <csnider@mirantis.com>
2022-10-05 12:18:03 -04:00
..
bitseq libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
cluster
cmd fix formatting of "nolint" tags for go1.19 2022-07-13 22:31:53 +02:00
config libnetwork/config: rename ParseConfigOptions() to New() 2022-09-26 19:20:55 +02:00
datastore libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
diagnostic set ReadHeaderTimeout to address G112: Potential Slowloris Attack (gosec) 2022-09-22 12:13:28 +02:00
discoverapi
docs libnetwork: remove consul-related code and tests 2022-01-06 18:45:41 +01:00
driverapi libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
drivers libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
drvregistry libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
etchosts libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
idm libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
internal libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
ipam Merge pull request #44193 from thaJeztah/libnetwork_cleanup 2022-09-27 22:41:32 +02:00
ipamapi libnetwork/ipamapi: godoc fixes 2021-08-27 16:52:46 +02:00
ipams libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
ipamutils panic() instead of logrus.Fatal() in init funcs 2022-04-21 12:15:20 +02:00
iptables libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
netlabel libnetwork: remove unused "testutils" imports 2021-08-18 14:20:37 +02:00
netutils Merge pull request #42777 from thaJeztah/update_go_1.17 2021-08-26 21:24:23 +02:00
networkdb libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
ns Revert "Adjust LockOSThread" 2019-08-15 14:44:03 -07:00
options golangci-lint: update to v1.49.0 2022-09-23 23:31:27 +02:00
osl libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
portallocator libnetwork/portallocator: un-export consts for defaults 2022-06-02 22:59:32 +02:00
portmapper Lock OS threads when exec'ing with Pdeathsig 2022-10-05 12:18:03 -04:00
resolvconf libnetwork/resolvconf: removed unused GetIfChanged() and GetLastModified() 2022-09-22 13:58:34 +02:00
support Fixup libnetwork lint errors 2021-06-01 23:48:32 +00:00
testutils gofmt GoDoc comments with go1.19 2022-07-08 19:56:23 +02:00
types libnetwork/types: remove TransportPort.FromString() as it's unused 2021-08-27 14:16:32 +02:00
.dockerignore
.gitignore
CHANGELOG.md
README.md libnetwork: remove CircleCI config and code 2021-06-09 12:31:52 +02:00
agent.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
agent.pb.go
agent.proto
controller.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
default_gateway.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
default_gateway_freebsd.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
default_gateway_linux.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
default_gateway_windows.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
drivers_freebsd.go libnetwork/config: remove "Experimental" and "Debug" options 2022-09-26 12:05:22 +02:00
drivers_ipam.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
drivers_linux.go libnetwork/config: remove "Experimental" and "Debug" options 2022-09-26 12:05:22 +02:00
drivers_windows.go libnetwork/config: remove "Experimental" and "Debug" options 2022-09-26 12:05:22 +02:00
endpoint.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
endpoint_cnt.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
endpoint_info.go fix formatting of "nolint" tags for go1.19 2022-07-13 22:31:53 +02:00
endpoint_info_unix.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
endpoint_info_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
endpoint_test.go refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
error.go
errors_test.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
firewall_linux.go fix some minor linting issues 2022-07-04 10:15:28 +02:00
firewall_linux_test.go libnetwork/config: merge DaemonCfg into Config 2022-09-26 12:05:37 +02:00
firewall_others.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
libnetwork_internal_test.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
libnetwork_linux_test.go refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00
libnetwork_test.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
libnetwork_unix_test.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
libnetwork_windows_test.go Skip libnetwork integration tests on Windows 2021-06-02 16:53:29 +00:00
network.go Merge pull request #44193 from thaJeztah/libnetwork_cleanup 2022-09-27 22:41:32 +02:00
network_unix.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
network_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
resolver.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
resolver_test.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
resolver_unix.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
resolver_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
sandbox.go Merge pull request #44193 from thaJeztah/libnetwork_cleanup 2022-09-27 22:41:32 +02:00
sandbox_dns_unix.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
sandbox_dns_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
sandbox_externalkey.go
sandbox_externalkey_unix.go libnetwork/config: merge DaemonCfg into Config 2022-09-26 12:05:37 +02:00
sandbox_externalkey_windows.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
sandbox_store.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
sandbox_test.go Skip libnetwork integration tests on Windows 2021-06-02 16:53:29 +00:00
service.go Fix libnetwork imports 2021-06-01 21:51:23 +00:00
service_common.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
service_common_test.go Skip libnetwork integration tests on Windows 2021-06-02 16:53:29 +00:00
service_linux.go Ensure performance tuning is always applied 2022-05-31 11:47:30 -04:00
service_unsupported.go Update to Go 1.17.0, and gofmt with Go 1.17 2021-08-24 23:33:27 +02:00
service_windows.go Log HNS policylist removal failures 2022-04-19 14:21:29 +00:00
store.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
store_linux_test.go libnetwork: fix empty-lines (revive) 2022-09-26 19:21:58 +02:00
store_test.go refactor: move from io/ioutil to io and os package 2021-08-27 14:56:57 +08:00

README.md

libnetwork - networking for containers

Libnetwork provides a native Go implementation for connecting containers

The goal of libnetwork is to deliver a robust Container Network Model that provides a consistent programming interface and the required network abstractions for applications.

Design

Please refer to the design for more information.

Using libnetwork

There are many networking solutions available to suit a broad range of use-cases. libnetwork uses a driver / plugin model to support all of these solutions while abstracting the complexity of the driver implementations by exposing a simple and consistent Network Model to users.

package main

import (
	"fmt"
	"log"

	"github.com/docker/docker/pkg/reexec"
	"github.com/docker/docker/libnetwork"
	"github.com/docker/docker/libnetwork/config"
	"github.com/docker/docker/libnetwork/netlabel"
	"github.com/docker/docker/libnetwork/options"
)

func main() {
	if reexec.Init() {
		return
	}

	// Select and configure the network driver
	networkType := "bridge"

	// Create a new controller instance
	driverOptions := options.Generic{}
	genericOption := make(map[string]interface{})
	genericOption[netlabel.GenericData] = driverOptions
	controller, err := libnetwork.New(config.OptionDriverConfig(networkType, genericOption))
	if err != nil {
		log.Fatalf("libnetwork.New: %s", err)
	}

	// Create a network for containers to join.
	// NewNetwork accepts Variadic optional arguments that libnetwork and Drivers can use.
	network, err := controller.NewNetwork(networkType, "network1", "")
	if err != nil {
		log.Fatalf("controller.NewNetwork: %s", err)
	}

	// For each new container: allocate IP and interfaces. The returned network
	// settings will be used for container infos (inspect and such), as well as
	// iptables rules for port publishing. This info is contained or accessible
	// from the returned endpoint.
	ep, err := network.CreateEndpoint("Endpoint1")
	if err != nil {
		log.Fatalf("network.CreateEndpoint: %s", err)
	}

	// Create the sandbox for the container.
	// NewSandbox accepts Variadic optional arguments which libnetwork can use.
	sbx, err := controller.NewSandbox("container1",
		libnetwork.OptionHostname("test"),
		libnetwork.OptionDomainname("docker.io"))
	if err != nil {
		log.Fatalf("controller.NewSandbox: %s", err)
	}

	// A sandbox can join the endpoint via the join api.
	err = ep.Join(sbx)
	if err != nil {
		log.Fatalf("ep.Join: %s", err)
	}

	// libnetwork client can check the endpoint's operational data via the Info() API
	epInfo, err := ep.DriverInfo()
	if err != nil {
		log.Fatalf("ep.DriverInfo: %s", err)
	}

	macAddress, ok := epInfo[netlabel.MacAddress]
	if !ok {
		log.Fatalf("failed to get mac address from endpoint info")
	}

	fmt.Printf("Joined endpoint %s (%s) to sandbox %s (%s)\n", ep.Name(), macAddress, sbx.ContainerID(), sbx.Key())
}

Contributing

Want to hack on libnetwork? Docker's contributions guidelines apply.

Code and documentation copyright 2015 Docker, inc. Code released under the Apache 2.0 license. Docs released under Creative commons.