Subject: Re: [vserver] vserver and network namespace support
From: Thomas Weber <l_vserver@mail2news.4t2.com>
Date: Fri, 09 May 2014 22:19:03 +0200

On Fr, 2014-05-09 at 20:54 +0200, Adrian Reyer wrote:
> On Fri, May 09, 2014 at 05:17:18PM +0200, Thomas Weber wrote:
> > Is anyone successfully using vserver with network namespaces and "stock"
> > util-vserver? The comments from Herbert and Daniel seem to imply that
> > this is possible - but I have yet to see a working configuration.
> > Kernel: 3.10.38-vs2.3.6.8
> > util-vserver: 0.30.216-pre3062
> 
> util-vserver 0.30.216-pre3054-1 and kernel 3.10.38-vs2.3.6.8+lihas1
> here on debian sid (my laptop):
> 
> VSNAME=vsnetns
> IFACE=br1
> IP=192.168.5.244
> BROADCAST=192.168.5.255
> GATEWAY=192.168.5.254
> NETMASK=255.255.255.0
> DNSSERVER=192.168.5.254
> MASKBIT=24
> CONTEXT=244
> MIRROR="http://de.archive.ubuntu.com/ubuntu"
> 
> vserver $VSNAME build -m debootstrap --context $CONTEXT --hostname $VSNAME --interface
$VSNAME=$IFACE:$IP/$MASKBIT --initstyle plain -- -m $MIRROR -d raring -- --arch i386
> echo plain > /etc/vservers/$VSNAME/apps/init/style
> cat <<EOF >>/etc/vservers/$VSNAME/fstab
> none    /run    tmpfs   size=16m,nosuid,mode=0755       0 0
> EOF
> echo $VSNAME > /etc/vservers/$VSNAME/vdir/etc/hostname
> # Network Namespace, proprietary Software after all
> VS=$VSNAME
> CONTEXT=$(cat /etc/vservers/${VS}/context)
> grep -q NET_ADMIN /etc/vservers/$VS/bcapabilities || echo NET_ADMIN >> /etc/vservers/$VS/bcapabilities
> grep -q NET_RAW /etc/vservers/$VS/bcapabilities || echo NET_RAW >> /etc/vservers/$VS/bcapabilities
> mkdir -p /etc/vservers/$VS/apps/init
> echo 'plain' > /etc/vservers/$VS/apps/init/style
> touch /etc/vservers/$VS/noncontext
> mkdir -p /etc/vservers/$VS/netns/interfaces/0
> echo v${CONTEXT} > /etc/vservers/$VS/netns/name
> echo v${CONTEXT}a > /etc/vservers/$VS/netns/interfaces/0/host
> echo v${CONTEXT}b > /etc/vservers/$VS/netns/interfaces/0/guest
> echo veth >        /etc/vservers/$VS/netns/interfaces/0/type
> rm -rf /etc/vservers/$VS/interfaces/0
> mkdir -p /etc/vservers/$VS/scripts
> cat <<EOF >/etc/vservers/$VS/scripts/pre-start
> DONT_SKIP_DEFAULTS=1
> brctl addif br1 v${CONTEXT}a
> ip link set dev v${CONTEXT}a up
> EOF
> 
> cat <<EOF >>/etc/vservers/$VSNAME/vdir/etc/network/interfaces
> auto v${CONTEXT}b
> iface v${CONTEXT}b inet static
>     address $IP
>     broadcast $BROADCAST
>     netmask     $NETMASK
>     gateway     $GATEWAY
>     dns-nameservers     $DNSSERVER
>     
> EOF
> 
> No dhcp worked for me, /proc/net won't be visible inside the vserver,
> vprocunhide seems not to work, /proc/net is a symlink into the own pid

Thanks Adrian, that's basically what I got working too - with
NET_ADMIN/RAW capabilities for the guest :(
So i guess you didn't get it working without that either.

You probably can't 'ip netns exec' configure anything in the
netnamespace of the vserver from the host either?

  Tom