Documentation
¶
Overview ¶
Package netns wraps the LockOSThread + setns + restore dance for running code — most notably dials — inside a named network namespace. It exists so every consumer (the tunnel VTEP router, the workerd egress bridge) shares one carefully audited implementation of the thread-affinity rules instead of re-deriving them.
All functions degrade to an error on non-linux platforms (the underlying syscalls return vishvananda/netns.ErrNotImplemented), so callers compile everywhere and fail closed where namespaces don't exist.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DialTimeout ¶
DialTimeout dials addr with the socket created inside the network namespace bind-mounted at nsPath, then returns to the original namespace. The namespace is opened per call — deliberately uncached, since a cached handle silently black-holes if the namespace is recreated, while a per-call open (a few µs against a ms-scale connect) self-heals.
addr should be a literal IP:port: the dial runs on a locked OS thread for the duration of the connect handshake (bounded by timeout), and a name would additionally run the resolver on that thread inside the namespace. At most maxConcurrentDials run at once; a call that cannot acquire a slot within timeout fails, so total latency is bounded by 2×timeout.
func Do ¶
Do runs fn with the calling OS thread switched to ns. A closed (None) handle runs fn in place. If restoring the original namespace fails, the thread is left locked so the runtime retires it rather than scheduling other goroutines on a thread stuck in the wrong namespace.
func EnsureNamed ¶
EnsureNamed returns a handle to the named network namespace, creating and bind-mounting it if it does not exist. The bind mount lands in the library's /run/netns directory — callers that share or open namespaces by path must use /run/netns/<name>, NOT /var/run/netns, which is only equivalent on images where /var/run symlinks to /run. Requires CAP_SYS_ADMIN to create. The caller owns the returned handle.
Types ¶
This section is empty.
Source Files