fde80fe2e7
Partially reverts 0046b16 "daemon: set libnetwork sandbox key w/o OCI hook"
Running SetKey to store the OCI Sandbox key after task creation, rather
than from the OCI prestart hook, meant it happened after sysctl settings
were applied by the runtime - which was the intention, we wanted to
complete Sandbox configuration after IPv6 had been disabled by a sysctl
if that was going to happen.
But, it meant '--sysctl' options for a specfic network interface caused
container task creation to fail, because the interface is only moved into
the network namespace during SetKey.
This change restores the SetKey prestart hook, and regenerates config
files that depend on the container's support for IPv6 after the task has
been created. It also adds a regression test that makes sure it's possible
to set an interface-specfic sysctl.
Signed-off-by: Rob Murray <rob.murray@docker.com>
27 lines
933 B
Go
27 lines
933 B
Go
package daemon // import "github.com/docker/docker/daemon"
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/docker/docker/container"
|
|
"github.com/docker/docker/errdefs"
|
|
"github.com/docker/docker/libcontainerd/types"
|
|
"github.com/docker/docker/oci"
|
|
specs "github.com/opencontainers/runtime-spec/specs-go"
|
|
)
|
|
|
|
// initializeCreatedTask performs any initialization that needs to be done to
|
|
// prepare a freshly-created task to be started.
|
|
func (daemon *Daemon) initializeCreatedTask(ctx context.Context, tsk types.Task, container *container.Container, spec *specs.Spec) error {
|
|
if !container.Config.NetworkDisabled {
|
|
nspath, ok := oci.NamespacePath(spec, specs.NetworkNamespace)
|
|
if ok && nspath == "" { // the runtime has been instructed to create a new network namespace for tsk.
|
|
sb, err := daemon.netController.GetSandbox(container.ID)
|
|
if err != nil {
|
|
return errdefs.System(err)
|
|
}
|
|
return sb.FinishConfig()
|
|
}
|
|
}
|
|
return nil
|
|
}
|