> On Sept. 13, 2016, 6:35 p.m., Joseph Wu wrote:
> > src/slave/containerizer/mesos/isolators/network/cni/cni.cpp, line 818
> > <https://reviews.apache.org/r/51871/diff/1/?file=1498102#file1498102line818>
> >
> > Will these symlinks resolve correctly if the child has a different
> > rootfs than the parent container?
>
> Avinash sridharan wrote:
> The symlinks are created in the hostfs, and they are then bind mounted to
> /etc/hosts, /etc/hostname, and /etc/resolv.conf in the container's rootfs
> here:
>
> https://github.com/apache/mesos/blob/3e52a107c4073778de9c14bf5fcdeb6e342821aa/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp#L1583
>
> So yeah the symlinks should always resolve correctly, as long as the
> 'root' parent container is alive.
The isolator will create a directory structure like:
```
/var/run/mesos/isolators/network/cni
|-- parent-container-id/
|-- hosts
|-- hostname
|-- resolv.conf
|-- child-container-id/
|-- hosts -->
/var/run/mesos/isolators/network/cni/parent-container-id/hosts
|-- hostname -->
/var/run/mesos/isolators/network/cni/parent-container-id/hostname
|-- resolv.conf -->
/var/run/mesos/isolators/network/cni/parent-container-id/resolve.conf
```
Each file in the `child-container-id` folder is then mounted into the child
container's rootfs.
After reading this ( http://www.proftpd.org/docs/howto/Chroot.html ), I'm not
so sure this will work.
The symlink after chroot-ing will point to an absolute location within the
child's rootfs; whereas it was originally pointing to the host's rootfs. A
relative symlink won't work either, as you're not mounting the entire
`/var/run/mesos/isolators/network/cni` directory.
The child will simply have a bunch of dangling symlinks:
```
/etc
|-- hosts --> /var/run/mesos/isolators/network/cni/parent-container-id/hosts
|-- hostname -->
/var/run/mesos/isolators/network/cni/parent-container-id/hostname
|-- resolv.conf -->
/var/run/mesos/isolators/network/cni/parent-container-id/resolve.conf
```
Based on that, you may need to either hard-link the files or mount the parent's
files directly.
- Joseph
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/51871/#review148839
-----------------------------------------------------------
On Sept. 14, 2016, 9:25 a.m., Avinash sridharan wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/51871/
> -----------------------------------------------------------
>
> (Updated Sept. 14, 2016, 9:25 a.m.)
>
>
> Review request for mesos, Gilbert Song, Jie Yu, Joseph Wu, and Qian Zhang.
>
>
> Bugs: MESOS-6156
> https://issues.apache.org/jira/browse/MESOS-6156
>
>
> Repository: mesos
>
>
> Description
> -------
>
> The network file setup in the `network/cni` isolator is now nesting
> aware. Since the children share the network and UTS namespace with the
> parent, the network files need to be created only for the parent
> container. For the child containers, the network files will be simply
> a symlink to a parents network files.
>
>
> Diffs
> -----
>
> src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
> 822f11eab5b00c014563322a8c3b2c14cb440e0b
>
> Diff: https://reviews.apache.org/r/51871/diff/
>
>
> Testing
> -------
>
> make
> make check
> sudo ./bin/mesos-tests.sh
>
>
> Thanks,
>
> Avinash sridharan
>
>
