networking: use --enable-sandbox if available #4038
Conversation
if slirp4netns supports sandboxing, enable it. It automatically creates a new mount namespace where slirp4netns will run and have limited access to the host resources. It needs slirp4netns 0.4.1. Signed-off-by: Giuseppe Scrivano <[email protected]>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: giuseppe The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
approved
|
@lsm5 could we get an update with slirp4netns 0.4.1 in Fedora? |
|
Any tests you could add/update? |
this is really done in slirp4netns. It should not fail on old versions too as the patch checks whether the feature is present before using it, I've restarted the test as it looks like a flake |
| } | ||
|
|
||
| func checkSlirpFlags(path string) (bool, bool, error) { | ||
| func checkSlirpFlags(path string) (bool, bool, bool, error) { |
There was a problem hiding this comment.
Nit, it would be nice if you added names for these variables from a documentation pint of view.
checkSlirpFlags(path string) (supportsDisableLoopback, supportsMTU, supportsSandbox bool, err error)
|
/lgtm |
|
I fixed the problem by making the link point to |
github-actions
bot
added
the
locked - please file new issue/PR
6 participants
if slirp4netns supports sandboxing, enable it.
It automatically creates a new mount namespace where slirp4netns will
run and have limited access to the host resources.
It needs slirp4netns 0.4.1.
Signed-off-by: Giuseppe Scrivano [email protected]