Skip to content

Commit a91432a

Browse files
fahedouchfahedouch
committed
network/port driver build tags support
Signed-off-by: fahed dorgaa <[email protected]>
1 parent 236f31e commit a91432a

File tree

18 files changed

+434
-2
lines changed

18 files changed

+434
-2
lines changed

‎.github/workflows/main.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -281,3 +281,18 @@ jobs:
281281
docker exec test docker info
282282
docker exec test ./integration-docker.sh
283283
docker rm -f test
284+
285+
build-tags:
286+
name: "Build with disabled drivers tags"
287+
runs-on: ubuntu-24.04
288+
steps:
289+
- name: "Check out"
290+
uses: actions/checkout@v5
291+
- name: "Set up Go"
292+
uses: actions/setup-go@v5
293+
with:
294+
go-version-file: go.mod
295+
- name: "Build with -tags no_gvisortapvsock"
296+
run: go build -v -tags no_gvisortapvsock ./cmd/rootlesskit
297+
- name: "Build with -tags 'no_slirp4netns no_lxcusernic no_gvisortapvsock'"
298+
run: go build -v -tags "no_slirp4netns no_lxcusernic no_gvisortapvsock" ./cmd/rootlesskit

‎cmd/rootlesskit/main.go‎

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,33 @@ Examples:
8383
Note: RootlessKit requires /etc/subuid and /etc/subgid to be configured by the real root user.
8484
See https://rootlesscontaine.rs/getting-started/common/ .
8585
`
86+
// Build the list of available network drivers for help text
87+
// Only compiled-in drivers will be shown here, so omitted drivers don't appear in --help.
88+
drivers := []string{"host", "none", "pasta(experimental)"}
89+
if slirp4netns.Available {
90+
drivers = append(drivers, "slirp4netns")
91+
}
92+
if vpnkit.Available {
93+
drivers = append(drivers, "vpnkit")
94+
}
95+
if lxcusernic.Available {
96+
drivers = append(drivers, "lxc-user-nic(experimental)")
97+
}
98+
if gvisortapvsock.Available {
99+
drivers = append(drivers, "gvisor-tap-vsock(experimental)")
100+
}
101+
netDriversHelp := strings.Join(drivers, ", ")
102+
103+
// Build the list of available port drivers for help text
104+
portDrivers := []string{"none", "implicit (for pasta)", "builtin"}
105+
if slirp4netns_port.Available {
106+
portDrivers = append(portDrivers, "slirp4netns")
107+
}
108+
if gvisortapvsock_port.Available {
109+
portDrivers = append(portDrivers, "gvisor-tap-vsock(experimental)")
110+
}
111+
portDriversHelp := strings.Join(portDrivers, ", ")
112+
86113
app.Flags = []cli.Flag{
87114
Categorize(&cli.BoolFlag{
88115
Name: "debug",
@@ -99,7 +126,7 @@ See https://rootlesscontaine.rs/getting-started/common/ .
99126
}, CategoryState),
100127
Categorize(&cli.StringFlag{
101128
Name: "net",
102-
Usage: "network driver [host, none, pasta(experimental), slirp4netns, vpnkit, lxc-user-nic(experimental), gvisor-tap-vsock(experimental)]",
129+
Usage: fmt.Sprintf("network driver [%s]", netDriversHelp),
103130
Value: "host",
104131
}, CategoryNetwork),
105132
Categorize(&cli.StringFlag{
@@ -169,7 +196,7 @@ See https://rootlesscontaine.rs/getting-started/common/ .
169196
}, CategoryMount),
170197
Categorize(&cli.StringFlag{
171198
Name: "port-driver",
172-
Usage: "port driver for non-host network. [none, implicit (for pasta), builtin, slirp4netns, gvisor-tap-vsock]",
199+
Usage: fmt.Sprintf("port driver for non-host network. [%s]", portDriversHelp),
173200
Value: "none",
174201
}, CategoryPort),
175202
Categorize(&cli.StringSliceFlag{

‎docs/BUILDING.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Building RootlessKit
2+
3+
This document describes build-time options, including Go build tags for omitting certain network and port drivers.
4+
5+
## Build tags to omit drivers
6+
7+
To exclude specific drivers at compilation time, use Go build tags:
8+
9+
- Tag `no_vpnkit`: omits the VPNKit network driver implementation.
10+
- Tag `no_gvisortapvsock`: omits the gvisor-tap-vsock network driver implementation and its port driver.
11+
- Tag `no_slirp4netns`: omits the slirp4netns network driver implementation and its port driver.
12+
- Tag `no_lxcusernic`: omits the lxc-user-nic network driver implementation.
13+
14+
Example:
15+
16+
- Build without VPNKit support:
17+
go build -tags no_vpnkit ./cmd/rootlesskit
18+
19+
Notes:
20+
- If a disabled driver is selected at runtime (e.g., `--net=vpnkit` when built with `-tags no_vpnkit`), RootlessKit returns an error indicating that the driver was disabled at build time.

‎docs/network.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -267,3 +267,8 @@ The `--detach-netns` flag (since v2.0.0) detaches network namespaces into `$ROOT
267267
and executes the child command in the host's network namespace.
268268

269269
The child command can enter `$ROOTLESSKIT_STATE_DIR/netns` by itself to create nested network namespaces.
270+
271+
272+
## Build tags to omit drivers
273+
274+
Build-time driver selection is documented in [BUILDING.md](BUILDING.md).

‎docs/port.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,3 +59,7 @@ To specify IPv6 explicitly, use `tcp6`, e.g., `[::]:8080:80/tcp6`.
5959

6060
The `tcp4` and `tcp6` forms were introduced in RootlessKit v0.14.0.
6161
The `tcp6` is currently supported only for `builtin` port driver.
62+
63+
## Build tags to omit port drivers
64+
65+
Build-time driver selection is documented in [BUILDING.md](BUILDING.md).

‎pkg/network/gvisortapvsock/gvisortapvsock.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
//go:build !no_gvisortapvsock
2+
// +build !no_gvisortapvsock
3+
14
package gvisortapvsock
25

36
import (
@@ -32,6 +35,8 @@ const (
3235
DriverName = "gvisor-tap-vsock"
3336
// Default buffer size for packet reading/writing
3437
defaultBufferSize = 65536
38+
// Available indicates whether this driver is compiled in (used for generating help text)
39+
Available = true
3540
)
3641

3742
// NewParentDriver instantiates a new parent driver

‎pkg/network/gvisortapvsock/gvisortapvsock_disabled.go‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
//go:build no_gvisortapvsock
2+
// +build no_gvisortapvsock
3+
4+
package gvisortapvsock
5+
6+
import (
7+
"context"
8+
"errors"
9+
"io"
10+
"net"
11+
12+
"github.com/rootless-containers/rootlesskit/v3/pkg/api"
13+
"github.com/rootless-containers/rootlesskit/v3/pkg/messages"
14+
"github.com/rootless-containers/rootlesskit/v3/pkg/network"
15+
)
16+
17+
// NewParentDriver returns a stub when built with the no_gvisortapvsock tag.
18+
func NewParentDriver(logWriter io.Writer, mtu int, ipnet *net.IPNet, ifname string, disableHostLoopback bool, enableIPv6 bool) (network.ParentDriver, error) {
19+
return &disabledParent{}, errors.New("gvisor-tap-vsock network driver disabled by build tag no_gvisortapvsock")
20+
}
21+
22+
type disabledParent struct{}
23+
24+
func (d *disabledParent) Info(ctx context.Context) (*api.NetworkDriverInfo, error) {
25+
return nil, errors.New("gvisor-tap-vsock network driver disabled by build tag no_gvisortapvsock")
26+
}
27+
28+
func (d *disabledParent) MTU() int { return 0 }
29+
30+
func (d *disabledParent) ConfigureNetwork(childPID int, stateDir string, detachedNetNSPath string) (*messages.ParentInitNetworkDriverCompleted, func() error, error) {
31+
return nil, func() error { return nil }, errors.New("gvisor-tap-vsock network driver disabled by build tag no_gvisortapvsock")
32+
}
33+
34+
// NewChildDriver returns a stub when built with the no_gvisortapvsock tag.
35+
func NewChildDriver() network.ChildDriver { return &disabledChild{} }
36+
37+
type disabledChild struct{}
38+
39+
func (d *disabledChild) ChildDriverInfo() (*network.ChildDriverInfo, error) {
40+
return &network.ChildDriverInfo{ConfiguresInterface: false}, nil
41+
}
42+
43+
func (d *disabledChild) ConfigureNetworkChild(netmsg *messages.ParentInitNetworkDriverCompleted, detachedNetNSPath string) (string, error) {
44+
return "", errors.New("gvisor-tap-vsock network driver disabled by build tag no_gvisortapvsock")
45+
}
46+
47+
// Available indicates whether this driver is compiled in (used for generating help text)
48+
const Available = false

‎pkg/network/lxcusernic/lxcusernic.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
//go:build !no_lxcusernic
2+
// +build !no_lxcusernic
3+
14
package lxcusernic
25

36
import (
@@ -214,3 +217,6 @@ func dhcpRenewRoutine(c *client4.Client, dev string, initialIP net.IP, lease tim
214217
lease = p.IPAddressLeaseTime(lease)
215218
}
216219
}
220+
221+
// Available indicates whether this driver is compiled in (used for generating help text)
222+
const Available = true

‎pkg/network/lxcusernic/lxcusernic_disabled.go‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
//go:build no_lxcusernic
2+
// +build no_lxcusernic
3+
4+
package lxcusernic
5+
6+
import (
7+
"context"
8+
"errors"
9+
10+
"github.com/rootless-containers/rootlesskit/v3/pkg/api"
11+
"github.com/rootless-containers/rootlesskit/v3/pkg/messages"
12+
"github.com/rootless-containers/rootlesskit/v3/pkg/network"
13+
)
14+
15+
// NewParentDriver returns a stub when built with the no_lxcusernic tag.
16+
func NewParentDriver(binary string, mtu int, bridge string, ifname string) (network.ParentDriver, error) {
17+
return &disabledParent{}, errors.New("lxc-user-nic network driver disabled by build tag no_lxcusernic")
18+
}
19+
20+
type disabledParent struct{}
21+
22+
func (d *disabledParent) Info(ctx context.Context) (*api.NetworkDriverInfo, error) {
23+
return nil, errors.New("lxc-user-nic network driver disabled by build tag no_lxcusernic")
24+
}
25+
26+
func (d *disabledParent) MTU() int { return 0 }
27+
28+
func (d *disabledParent) ConfigureNetwork(childPID int, stateDir string, detachedNetNSPath string) (*messages.ParentInitNetworkDriverCompleted, func() error, error) {
29+
return nil, func() error { return nil }, errors.New("lxc-user-nic network driver disabled by build tag no_lxcusernic")
30+
}
31+
32+
// NewChildDriver returns a stub when built with the no_lxcusernic tag.
33+
func NewChildDriver() network.ChildDriver { return &disabledChild{} }
34+
35+
type disabledChild struct{}
36+
37+
func (d *disabledChild) ChildDriverInfo() (*network.ChildDriverInfo, error) {
38+
return &network.ChildDriverInfo{ConfiguresInterface: false}, nil
39+
}
40+
41+
func (d *disabledChild) ConfigureNetworkChild(netmsg *messages.ParentInitNetworkDriverCompleted, detachedNetNSPath string) (string, error) {
42+
return "", errors.New("lxc-user-nic network driver disabled by build tag no_lxcusernic")
43+
}
44+
45+
// Available indicates whether this driver is compiled in (used for generating help text)
46+
const Available = false

‎pkg/network/slirp4netns/slirp4netns.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
//go:build !no_slirp4netns
2+
// +build !no_slirp4netns
3+
14
package slirp4netns
25

36
import (
@@ -353,3 +356,6 @@ func (d *childDriver) ConfigureNetworkChild(netmsg *messages.ParentInitNetworkDr
353356
// and they are up to the child.
354357
return tap, nil
355358
}
359+
360+
// Available indicates whether this driver is compiled in (used for generating help text)
361+
const Available = true

0 commit comments

Comments
 (0)