does nerdctl support host networking ??

[jeffgtxjava]

We are trying to move away from docker cli to nerdctl as part of docker-shim deprecation.

However when I run nerdctl network inspect host I get below error. Am I doing any thing wrong.

sh-4.2# nerdctl network inspect host
FATA[0000] pseudo network "host" cannot be inspected    
-sh-4.2# 

container inspect tells null n/w settings

-sh-4.2# nerdctl inspect haproxy_apiserverlb_nerd
WARN[0000] failed to inspect NetNS                       error="failed to Statfs \"/proc/12386/ns/net\": no such file or directory" id=a68c7bd86684fc059162cd269444cd5535e776391426b3cfead5df9afb763f63
[
    {
        "Id": "a68c7bd86684fc059162cd269444cd5535e776391426b3cfead5df9afb763f63",
        "Created": "2022-06-21T18:07:20.04566676Z",
        "Path": "/docker-entrypoint.sh",
        "Args": [
            "/bin/sh",
            "-c",
            "cat  /config/haproxy.cfg"
        ],
        "State": {
            "Status": "exited",
            "Running": false,
            "Paused": false,
            "Restarting": false,
            "Pid": 12386,
            "ExitCode": 1,
            "FinishedAt": "2022-06-21T18:07:20.308019906Z"
        },
        "Image": "docker.io/library/haproxy:1.6-alpine",
        "ResolvConfPath": "",
        "HostnamePath": "/cowdata/nerd-bootstrap/924351d7/containers/moby-nerd/a68c7bd86684fc059162cd269444cd5535e776391426b3cfead5df9afb763f63/hostname",
        "LogPath": "",
        "Name": "haproxy_apiserverlb_nerd",
        "RestartCount": 0,
        "Driver": "overlayfs",
        "Platform": "linux",
        "AppArmorProfile": "",
        "Mounts": [
            {
                "Type": "bind",
                "Source": "/etc/kubernetes/haproxy-nerd.cfg",
                "Destination": "/config/haproxy.cfg",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            },
            {
                "Type": "bind",
                "Source": "/etc/pki_service/",
                "Destination": "/etc/pki_service/",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            }
        ],
        "NetworkSettings": null
    }
]

ENV :

-sh-4.2# nerdctl system info
Client:
 Namespace:     moby-nerd
 Debug Mode:    false

Server:
 Server Version: 1.6.4
 Storage Driver: overlayfs
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 1
 Plugins:
  Log: fluentd journald json-file
  Storage: native overlayfs
 Security Options:
  seccomp
   Profile: default
 Kernel Version: 3.10.0-1160.66.1.el7.x86_64
 Operating System: CentOS Linux 7 (Core)
 OSType: linux
 Architecture: x86_64
 CPUs: 48
 Total Memory: 125.6GiB
 Name: test.local.com
 ID: c323e657-f5ec-47ac-a1d6-3c2e156a0bf2

-sh-4.2# nerdctl version
Client:
 Version:       v0.21.0
 OS/Arch:       linux/amd64
 Git commit:    9ddf5226eabcbb7b4b43987f3b0f8d53d86d3bca

Server:
 containerd:
  Version:      1.6.4
  GitCommit:    212e8b6fa2f44b9c21b2798135fc6fb7c53efc16
-sh-4.2# 

[junnplus]

pseudo network "host" cannot be inspected

This is expected.

You can use the host network via nerdctl run --net host.

[jeffgtxjava]

@junnplus Yes I did use --net=host and full command is as below. However it doesn't show anything in the networking section of container inspect as show in the above post

Full command : nerdctl run --name=haproxy_apiserverlb_nerd --user=7002:7337 --net=host -v /etc/kubernetes/haproxy-nerd.cfg:/config/haproxy.cfg \ haproxy:1.6-alpine \ /bin/sh -c "/sbin/syslogd -O /dev/stdout && exec haproxy -f /config/haproxy.cfg"

[junnplus]

Is your container running when you inspect it?

WARN[0000] failed to inspect NetNS error="failed to Statfs "/proc/12386/ns/net":
...
"State": {
"Status": "exited",
"Running": false,
"Paused": false,
"Restarting": false,
"Pid": 12386,
"ExitCode": 1,
"FinishedAt": "2022-06-21T18:07:20.308019906Z"
},

It looks like the container is not working.

[junnplus]

If your container is working, you should see the host network interface via inspect.

$ sudo nerdctl run -d --name nginx --net host nginx
$ sudo nerdctl inspect nginx
[
    {
        "Id": "3be35df321d85581e2ae7f55c4bcfb9bbe2641ad836eddde0ba68c007365a125",
        "Created": "2022-06-22T10:12:16.090795295Z",
        "Path": "/docker-entrypoint.sh",
        "Args": [
            "nginx",
            "-g",
            "daemon off;"
        ],
        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "Pid": 89247,
            "ExitCode": 0,
            "FinishedAt": "0001-01-01T00:00:00Z"
        },
        "Image": "docker.io/library/nginx:latest",
        "ResolvConfPath": "",
        "HostnamePath": "/var/lib/nerdctl/1935db59/containers/default/3be35df321d85581e2ae7f55c4bcfb9bbe2641ad836eddde0ba68c007365a125/hostname",
        "LogPath": "/var/lib/nerdctl/1935db59/containers/default/3be35df321d85581e2ae7f55c4bcfb9bbe2641ad836eddde0ba68c007365a125/3be35df321d85581e2ae7f55c4bcfb9bbe2641ad836eddde0ba68c007365a125-json.log",
        "Name": "nginx",
        "RestartCount": 0,
        "Driver": "overlayfs",
        "Platform": "linux",
        "AppArmorProfile": "nerdctl-default",
        "Mounts": null,
        "NetworkSettings": {
            "GlobalIPv6Address": "fec0::5055:55ff:fe30:3d11",
            "GlobalIPv6PrefixLen": 64,
            "IPAddress": "192.168.5.15",
            "IPPrefixLen": 24,
            "MacAddress": "52:55:55:30:3d:11",
            "Networks": {
                "unknown-docker0": {
                    "IPAddress": "172.20.0.1",
                    "IPPrefixLen": 16,
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:92:27:94:06"
                },
                "unknown-eth0": {
                    "IPAddress": "192.168.5.15",
                    "IPPrefixLen": 24,
                    "GlobalIPv6Address": "fec0::5055:55ff:fe30:3d11",
                    "GlobalIPv6PrefixLen": 64,
                    "MacAddress": "52:55:55:30:3d:11"
                },
...

[jeffgtxjava]

@junnplus Yes you were right the container command I tried was exiting. Thanks that helps.

[fahedouch]

We can only inspect networks created through the CNI interface

[jeffgtxjava]

@fahedouch We are using plugins from https://www.cni.dev/plugins/ and I don't find anything equivalent for host networking.

Any suggestions on which plugin can be used or can we deepened on these plugins or not as part of our CNI.

[fahedouch]

may be the host-device (https://www.cni.dev/plugins/current/main/host-device/) but we dont support this plugin yet in nerdctl.

[junnplus]

We are using plugins from https://www.cni.dev/plugins/ and I don't find anything equivalent for host networking.

host network is not implemented through cni, see https://github.com/containerd/nerdctl/blob/master/cmd/nerdctl/run_network.go#L137