Documentation
¶
Overview ¶
Package netns contains Linux network namespace-related functionality.
Package netns creates Linux network namespaces and runs code, opens sockets and dials inside them. Entering a namespace is a property of the OS thread, so everything here locks a thread for as long as it is in one and restores the caller's namespace before returning.
Index ¶
- func AllowUnprivilegedPorts() error
- func Dialer(ns Handle) func(context.Context, string, string) (net.Conn, error)
- func Do(ctx context.Context, targetNS Handle, do func(context.Context) error) error
- func Listen(ctx context.Context, ns Handle, ports []uint16) (_ []net.Listener, retErr error)
- func RemoveNamed(name string) error
- type Handle
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AllowUnprivilegedPorts ¶
func AllowUnprivilegedPorts() error
AllowUnprivilegedPorts lets this namespace bind ports below 1024 without CAP_NET_BIND_SERVICE, which is how atunnel answers a sandbox's DNS on 53. The sysctl is per-namespace and grants nothing outside it.
func Dialer ¶
Dialer dials TCP or UDP IP literals in ns, pinning a thread only until the socket is created.
func Listen ¶
Listen opens wildcard TCP listeners inside ns. Sockets retain their namespace and can be served from another namespace.
func RemoveNamed ¶
RemoveNamed unmounts and unlinks a name under /run/netns, without following it if it is a symlink. A name that is already gone is not an error, and the namespace itself survives for as long as something holds it open.
Types ¶
type Handle ¶
Handle is a descriptor for a network namespace. Callers name it through this package so that nothing else has to import the one underneath.
func CreateNamed ¶
CreateNamed creates a named netns and returns its handle, restoring the caller's current netns before returning.
The caller owns the name exclusively, so a name still present when this runs was left behind by an earlier incarnation and is removed first. The kernel creates the name with O_EXCL, so without that removal a single failed teardown would wedge the name for good: nothing could ever create it again. Removal only unmounts and unlinks the name. Anything still holding the namespace keeps it alive, and existing handles stay usable.
func GetFromName ¶
GetFromName opens the namespace of that name under /run/netns.
Source Files