ClearContainer 网络部分源码分析

// cc-oci-runtime/src/oci.c

/*!

* Create the state file, apply mounts and run hooks, but do not start the VM

*/

gboolean cc_oci_create(struct cc_oci_config *config)

（1）、依次调用cc_oci_config_file_parse(config)，cc_oci_config_check(config)，cc_oci_runtime_dir_setup(config)和cc_oci_handle_mounts(config)

（2）、当cc_pod_is_vm(config)为true时，调用cc_oci_vm_launch(config)，否则调用cc_pod_container_create(config)

// cc-oci-runtime/src/process.c

/*!

* Start the hypervisor as a child process.

* Due to the way networking is handled in Docker, the logic here is unfortunately rather complex.

* \param config \ref cc_oci_config.

* \return \c true on success, else \c false.

*/

gboolean cc_oci_vm_launch(struct cc_oci_config *config)

（1）、调用setup_networking = cc_oci_enable_networking();   --->仅仅只是确定是否是root，因为要创建interface

...

（2）、调用config->state.status = OCI_STATUS_CREATED;

/* The namespace setup occurs in the parent to ensure the hooks run successfully. The child will

* automatically inherit the namespaces.

*/

（3）、调用cc_oci_ns_setup(config)

/* Connect to the proxy before launching the shim so that the proxy socket fd can be passed to the shim*/

（4）、调用cc_proxy_connect(config->proxy)

/* Set up comms channels to the child:

* - one to pass the full list of expanded hypervisor arguments.

* - one to allow detection of successful child setup: if the child closes the pipe,

* it was successful, but if it writes data to the pipe, setup failed.

*/

（5）、调用pipe2(child_err_pipe, O_CLOEXEC)和pipe2(hypervisor_args_pipe, O_CLOEXEC)

（6）、fork（）一个子进程，在子进程中最终运行cc_oci_setup_child(config)以及execvp(args[0], args)

....

/* Run the pre-start hooks.

* Note that one of these hooks will configure the networking in the network namespace.

* If a hook returns a non-zero exit code, then an error including the exit code and the stderr is

* returned to the caller and the container is torn down.

*/

（7）、hook_status = cc_run_hooks(config->oci.hooks.prestart, config->state.state_file_path, true)

// add network config bits to following functions:

// - cc_oci_container_state()

// - oci_state()

// - cc_oci_update_options()

（8）、如果setup_networking为true，则依次调用hndl = netlink_init()，cc_oci_vm_netcfg_get(config, hndl)和cc_oci_network_create(config, hndl)

.......

// cc-oci-runtime/src/netlink.c

/*!

* Setup the netlink socket to use with netlink transactions.This handle should be used for all netlink

* transactions for a given thread.

*/

struct netlink_handle *netlink_init(void)

初始化一个netlink_handle实例

// cc-oci-runtime/src/process.c

/*!

* Obtain the network configuration by quering the network namespace.

* \param[in, out] config \ref cc_oci_config.

* \param hndl handle returned from a call to \ref netlink_init().

*/

private gboolean cc_oci_vm_netcfg_get(struct cc_oci_config *config, struct netlink_handle *hndl)

仅仅调用cc_oci_network_discover(config, hndl)

// cc-oci-runtime/src/networking.c

/*!

* Obtain the networking configuration of the container

* Currently done by scanned the namespace

* Ideally the OCI spec should be modified such that

* these parameters are sent to the runtime

*/

gboolean cc_oci_network_discover(struct cc_oci_config *const config, struct netlink_handle *hndl)

...

（1）、调用getifaddrs(&ifaddrs)  --> discover container interfaces

....

/*!

* Request to create the networking framework that will be used to

* connect the specified container network(veth) to the VM

*

* The container may be associated with multiple networks and function has to be invoked

* for each of those networks

* Once the OCI spec supports the creation of VM compatible tap interfaces in the network plugin

* this setup will not be required

*/

gboolean cc_oci_network_create(const struct cc_oci_config *const config, struct netlink_handle *const hndl)

/* Each container has its own namespace. Hence we use the same mac address prefix

* for tap interfaces on the host side. This method scales to support upto 2^16 networks

*/

遍历config->net.interfaces，

// cc-oci-runtime/src/namespace.c

/**

* Setup namespace.

* This should not strictly be required (since the runtime does not implement a "traditional linux" container).

* Howerver, namespace are used to pass network configuration to the runtime so the network namespace

* must be supported.

* \param config \ref cc_oci_config.

* \return \c true on success, else \c false.

* \todo Show the namespace path. For unshare, the strategy should be to call cc_oci_resolve_path (),

* passing it the value of ."/proc/self/ns/%s". The complication is that %s does *NOT* match the

* namespace names chosen by OCI, hence oci_ns_map will need to be extended to add a "gchar *proc_name" element

* \note in the case of error, check the value of errno immediately after this call to determine the reason.

*/

gooblean cc_oci_ns_setup(struct cc_oci_config *config)

从config中解析出network space的ns->path，并调用fd = open(ns->path, O_RDONLY)，最后调用setns(fd, ns->type)加入该network namespace