Thanks, Eric. I will look into your patch.
-HB
________________________________
From: Eric W. Biederman <ebiederm@xxxxxxxxxxxx>
To: Hongbing Wang <hongbingwang@xxxxxxxxxxxxx>
Cc: Serge Hallyn <serge.hallyn@xxxxxxxxxx>; "containers@xxxxxxxxxxxxxxxxxxxxxxxxxx" <containers@xxxxxxxxxxxxxxxxxxxxxxxxxx>; Zhu Yanhai <zhu.yanhai@xxxxxxxxx>
Sent: Friday, November 8, 2013 5:41 PM
Subject: Re: allocate specific port range for container?
Hongbing Wang <hongbingwang@xxxxxxxxxxxxx> writes:
Eric W. Biederman <ebiederm@xxxxxxxxxxxx> writes:
> > I have been working on this recently.
> >
> > I have recently made ip_local_port range per netns to help support
> > this.
>
> [HB] That is exactly what I am looking for! Do u have any plan to
> open-source your work?
Baring typos this is it. In due course the code should will also appear
in Mesos.
Before you run this make certain to look and discover the environment
variables you need to set.
linkaddr=$(ip -o link show dev eth0 | sed -e 's|^.*link/ether \(..:..:..:..:..:..\).*$|\1|' )
ip netns add container
ip link add veth0 type veth peer name eth0 netns container address $linkaddr
tc qdisc add dev eth0 ingress
tc filter add dev eth0 ffff: protocol u32 \
match ether dst $linkaddr \
match ip dst $ip \
match ip dport $port_start $port_mask \
action mirred egress redirect dev $netns-device
tc filter add dev eth0 parent ffff: protocol ip u32 \
match ip dst $ip \
match ip protocol 1 0xff \
action mirred egress mirror dev veth0
tc filter add dev eth0 parent ffff: protocol arp basic \
action mirred egress mirror dev veth0
tc filter add dev lo parent ffff: protocol u32 \
match ip dst $ip \
match ip dport $port_start $port_mask \
action mirred egress redirect dev veth0
tc qdisc add dev veth0 ingress
tc filter add veth0 parent ffff: protocol arp basic
action mirred egress redirect dev eth0
tc filter add dev veth0 parent ffff: protocol ip u32 \
match ip protocol 1 0xff \
action mirred egress redirect dev eth0
tc filter add dev veth0 parent ffff: protocol ip u32 \
match ip sport $port_start $port_mask \
action mirred egress redirect dev eth0
tc filter add dev veth0 parent ffff: protocol ip u32 \
match ip dst $ip \
match ip sport $port_start $port_mask \
action mirred egress redirect dev lo
ip netns exec container ip link set lo up
ip netns exec container tc qdisc add dev lo ingress
ip netns exec container ip link set eth0 up
ip netns exec container ip addr add ${ip}/24 dev eth0
ip netns exec container sysctl net.ipv4.ip_local_port_range="$port_start $port_end"
ip netns exec container tc filter add dev lo parent ffff: protocol ip u32 \
match ip dst $ip
action mirred egress redirect dev eth0
ip netns exec container tc filter add dev lo parent ffff: protocol ip u32 \
match ip dst $ip
match ip dport $port_start $port_mask
Eric
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/containers
