socket mount robustness #146

New issue

Closed

opened 2026-10-15 12:52:21 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 12:52:21 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/LXC2Docker/pull/146
Author: @JBailes
Created: 7/20/2026
Status: ✅ Merged
Merged: 7/20/2026
Merged by: @JBailes

Base: main ← Head: fix/network-none-sandbox-start-and-isolation

📝 Commits (5)

ef2780d fix(lxc): re-resolve stale /proc//root bind sources at start
25c0edc fix(api): resolve absent-socket sibling binds to the stable host path
f2fc38f fix(api): disambiguate a shared bind destination by what exists on disk
6ac96b8 fix(lxc): skip bridge attachment for containers with no veth NIC
6abfc71 fix(api): report --network none containers as networkless in inspect

📊 Changes

6 files changed (+427 additions, -20 deletions)

View changed files

📝 internal/api/containers.go (+83 -19)
➕ internal/api/network_none_inspect_test.go (+60 -0)
📝 internal/api/sibling_mount_test.go (+81 -0)
📝 internal/lxc/manager.go (+146 -1)
📝 internal/lxc/manager_test.go (+21 -0)
➕ internal/lxc/mount_reresolve_test.go (+36 -0)

📄 Description

Follow-on to #145 (--network none isolated netns). With #145 a --network none container gets lxc.net.0.type = empty (isolated netns, loopback only), but it still could not be used as a sandbox: it failed to start and docker inspect reported it as networked. These five fixes complete the path (validated live on a SmoothNAS host driving isolated build/verify sandboxes).

fix(lxc): skip bridge attachment for containers with no veth NIC — ensureBridgeAttachment waited (5s) for a Link in lxc-info that an empty/none netns never has, then failed, so docker start errored for every --network none container. Skip attachment when the config declares no veth NIC (lxc.net.0.type != veth). Unit-tested (bridgedNICConfigured).
fix(api): report --network none containers as networkless in inspect — docker inspect reported a phantom veth0 + VMID-derived managed-bridge IP for a genuinely-isolated container, so any client/isolation probe saw false egress. Report {none:{}} with no address/gateway for none-mode (matches Docker). Unit-tested.
fix(lxc): re-resolve stale /proc//root bind sources at start — refresh /proc/<pid>/root/... bind-mount sources before lxc-start so a restarted/re-materialized container's socket binds don't point at a dead pid.
fix(api): resolve absent-socket sibling binds to the stable host path + disambiguate a shared bind destination by what exists on disk — socket-mount translation robustness (parent-dir fallback for a transiently-absent socket; leaf-exists disambiguation when two plugins share a bind root).

go build ./... clean; internal/api + internal/lxc tests pass except the pre-existing, host-disk-dependent TestCheckCreateDiskPressure.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/LXC2Docker/pull/146 **Author:** [@JBailes](https://github.com/JBailes) **Created:** 7/20/2026 **Status:** ✅ Merged **Merged:** 7/20/2026 **Merged by:** [@JBailes](https://github.com/JBailes) **Base:** `main` ← **Head:** `fix/network-none-sandbox-start-and-isolation` --- ### 📝 Commits (5) - [`ef2780d`](https://github.com/games-on-whales/LXC2Docker/commit/ef2780dc1c60fa28c07c9068f6c3206fa31933f2) fix(lxc): re-resolve stale /proc/<pid>/root bind sources at start - [`25c0edc`](https://github.com/games-on-whales/LXC2Docker/commit/25c0edcbb90ae0d127f2692a82884530097b0d07) fix(api): resolve absent-socket sibling binds to the stable host path - [`f2fc38f`](https://github.com/games-on-whales/LXC2Docker/commit/f2fc38f41cacfd243d8ba95e711875f6e62096a2) fix(api): disambiguate a shared bind destination by what exists on disk - [`6ac96b8`](https://github.com/games-on-whales/LXC2Docker/commit/6ac96b8d7b621e722022a115999f31ca920c75e1) fix(lxc): skip bridge attachment for containers with no veth NIC - [`6abfc71`](https://github.com/games-on-whales/LXC2Docker/commit/6abfc71e39209616f8a25bcde6ee207477990cfc) fix(api): report --network none containers as networkless in inspect ### 📊 Changes **6 files changed** (+427 additions, -20 deletions) <details> <summary>View changed files</summary> 📝 `internal/api/containers.go` (+83 -19) ➕ `internal/api/network_none_inspect_test.go` (+60 -0) 📝 `internal/api/sibling_mount_test.go` (+81 -0) 📝 `internal/lxc/manager.go` (+146 -1) 📝 `internal/lxc/manager_test.go` (+21 -0) ➕ `internal/lxc/mount_reresolve_test.go` (+36 -0) </details> ### 📄 Description Follow-on to #145 (--network none isolated netns). With #145 a `--network none` container gets `lxc.net.0.type = empty` (isolated netns, loopback only), but it still could not be used as a sandbox: it failed to start and `docker inspect` reported it as networked. These five fixes complete the path (validated live on a SmoothNAS host driving isolated build/verify sandboxes). - **fix(lxc): skip bridge attachment for containers with no veth NIC** — `ensureBridgeAttachment` waited (5s) for a `Link` in `lxc-info` that an `empty`/`none` netns never has, then failed, so `docker start` errored for *every* `--network none` container. Skip attachment when the config declares no veth NIC (`lxc.net.0.type != veth`). Unit-tested (`bridgedNICConfigured`). - **fix(api): report --network none containers as networkless in inspect** — `docker inspect` reported a phantom `veth0` + VMID-derived managed-bridge IP for a genuinely-isolated container, so any client/isolation probe saw false egress. Report `{none:{}}` with no address/gateway for none-mode (matches Docker). Unit-tested. - **fix(lxc): re-resolve stale /proc/<pid>/root bind sources at start** — refresh `/proc/<pid>/root/...` bind-mount sources before `lxc-start` so a restarted/re-materialized container's socket binds don't point at a dead pid. - **fix(api): resolve absent-socket sibling binds to the stable host path** + **disambiguate a shared bind destination by what exists on disk** — socket-mount translation robustness (parent-dir fallback for a transiently-absent socket; leaf-exists disambiguation when two plugins share a bind root). `go build ./...` clean; `internal/api` + `internal/lxc` tests pass except the pre-existing, host-disk-dependent `TestCheckCreateDiskPressure`. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 12:52:21 +00:00

closed this issue
added the
pull-request
label

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

games-on-whales/LXC2Docker#146

No description provided.

Rows
Columns