Merge pull request moby#3738 from tonistiigi/netns-create-lockthread

cni: simplify netns creation

Author: AkihiroSuda

util/network/cniprovider/allowempty.s

@@ -4,10 +4,11 @@
 package cniprovider
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
+	"runtime"
 	"syscall"
-	"unsafe"
 
 	"github.com/containerd/containerd/oci"
 	"github.com/moby/buildkit/util/bklog"
@@ -38,63 +39,51 @@ func cleanOldNamespaces(c *cniProvider) {
 	}()
 }
 
-func createNetNS(c *cniProvider, id string) (string, error) {
+// unshareAndMount needs to be called in a separate thread
+func unshareAndMountNetNS(target string) error {
+	if err := syscall.Unshare(syscall.CLONE_NEWNET); err != nil {
+		return err
+	}
+
+	return syscall.Mount(fmt.Sprintf("/proc/self/task/%d/ns/net", syscall.Gettid()), target, "", syscall.MS_BIND, "")
+}
+
+func createNetNS(c *cniProvider, id string) (_ string, err error) {
 	nsPath := filepath.Join(c.root, "net/cni", id)
 	if err := os.MkdirAll(filepath.Dir(nsPath), 0700); err != nil {
 		return "", err
 	}
 
 	f, err := os.Create(nsPath)
 	if err != nil {
-		deleteNetNS(nsPath)
 		return "", err
 	}
+	defer func() {
+		if err != nil {
+			deleteNetNS(nsPath)
+		}
+	}()
 	if err := f.Close(); err != nil {
-		deleteNetNS(nsPath)
-		return "", err
-	}
-	procNetNSBytes, err := syscall.BytePtrFromString("/proc/self/ns/net")
-	if err != nil {
-		deleteNetNS(nsPath)
 		return "", err
 	}
-	nsPathBytes, err := syscall.BytePtrFromString(nsPath)
-	if err != nil {
-		deleteNetNS(nsPath)
-		return "", err
-	}
-	beforeFork()
 
-	pid, _, errno := syscall.RawSyscall6(syscall.SYS_CLONE, uintptr(syscall.SIGCHLD)|unix.CLONE_NEWNET, 0, 0, 0, 0, 0)
-	if errno != 0 {
-		afterFork()
-		deleteNetNS(nsPath)
-		return "", errno
-	}
+	errCh := make(chan error)
 
-	if pid != 0 {
-		afterFork()
-		var ws unix.WaitStatus
-		_, err = unix.Wait4(int(pid), &ws, 0, nil)
-		for err == syscall.EINTR {
-			_, err = unix.Wait4(int(pid), &ws, 0, nil)
-		}
+	go func() {
+		defer close(errCh)
+		runtime.LockOSThread()
 
-		if err != nil {
-			deleteNetNS(nsPath)
-			return "", errors.Wrapf(err, "failed to find pid=%d process", pid)
+		if err := unshareAndMountNetNS(nsPath); err != nil {
+			errCh <- err
 		}
-		errno = syscall.Errno(ws.ExitStatus())
-		if errno != 0 {
-			deleteNetNS(nsPath)
-			return "", errors.Wrapf(errno, "failed to mount %s (pid=%d)", nsPath, pid)
-		}
-		return nsPath, nil
+
+		// we leave the thread locked so go runtime terminates the thread
+	}()
+
+	if err := <-errCh; err != nil {
+		return "", err
 	}
-	afterForkInChild()
-	_, _, errno = syscall.RawSyscall6(syscall.SYS_MOUNT, uintptr(unsafe.Pointer(procNetNSBytes)), uintptr(unsafe.Pointer(nsPathBytes)), 0, uintptr(unix.MS_BIND), 0, 0)
-	syscall.RawSyscall(syscall.SYS_EXIT, uintptr(errno), 0, 0)
-	panic("unreachable")
+	return nsPath, nil
 }
 
 func setNetNS(s *specs.Spec, nsPath string) error {