Skip to content

[docker_image_ctl.j2] Share UTS namespace with host OS (#4169) #4219

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
qiluo-msft wants to merge 1 commit into from
Closed

[docker_image_ctl.j2] Share UTS namespace with host OS (#4169) #4219

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions files/build_templates/docker_image_ctl.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,7 @@ start() {
# TODO: Mellanox will remove the --tmpfs exception after SDK socket path changed in new SDK version
{%- endif %}
docker create {{docker_image_run_opt}} \
--uts=host \{# W/A: this should be set per-docker, for those dockers which really need host's UTS namespace #}
Copy link
Contributor

@jleveque jleveque Mar 4, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you think of an instance where we would not want to share the host's UTS namespace?

Copy link
Collaborator Author

@qiluo-msft qiluo-msft Mar 4, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cannot 😄
This is a modified cherry-pick following master branch.

In reply to: 387377484 [](ancestors = 387377484)

Copy link
Contributor

@jleveque jleveque Mar 4, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😄 Then maybe add a "maybe" to the beginning of the comment?

Copy link
Collaborator

@stepanblyschak stepanblyschak Mar 4, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jleveque @qiluo-msft I think swss, syncd, pmon don't need to care about the hostname, if they do IMO it looks like a design mistake. The idea behind docker containers is isolation, why do we need docker containers at all if we want to share and map inside container almost everything?
Besides, --priviledge + --uts=host will give container priviledges to change host OS hostname.
The only containers I know which need host's hostname inside container are snmp and dhcp_relay but it doesn't look like they need --priviledge option or do they?
I would like to keep this comment and revise containers isolation in sonic in general in the future.

{%- if install_debug_image == "y" %}
-v /src:/src:ro -v /debug:/debug:rw \
{%- endif %}
Expand Down