{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/comments/91069577","pull_request_review_id":11579086,"id":91069577,"diff_hunk":"@@ -2,13 +2,35 @@ package server\n \n import (\n \t\"fmt\"\n+\t\"sync\"\n \n \t\"github.com/docker/docker/pkg/stringid\"\n \t\"github.com/kubernetes-incubator/cri-o/oci\"\n+\t\"github.com/containernetworking/cni/pkg/ns\"\n \t\"k8s.io/kubernetes/pkg/fields\"\n \tpb \"k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime\"\n )\n \n+type sandboxNetNs struct {\n+\tsync.Mutex\n+\tns     ns.NetNS\n+\tclosed bool\n+}\n+\n+func netNsGet(nspath string) (*sandboxNetNs, error) {\n+\tnetNS, err := ns.GetNS(nspath)\n+\tif err != nil {\n+\t\treturn &sandboxNetNs{}, err\n+\t}\n+\n+\tsNetNs := &sandboxNetNs{","path":"server/sandbox.go","position":25,"original_position":25,"commit_id":"17ab17c2c2c43d07bc66d497b88eadb5131848e3","original_commit_id":"17ab17c2c2c43d07bc66d497b88eadb5131848e3","user":{"login":"runcom","id":849915,"avatar_url":"https://avatars.githubusercontent.com/u/849915?v=3","gravatar_id":"","url":"https://api.github.com/users/runcom","html_url":"https://github.com/runcom","followers_url":"https://api.github.com/users/runcom/followers","following_url":"https://api.github.com/users/runcom/following{/other_user}","gists_url":"https://api.github.com/users/runcom/gists{/gist_id}","starred_url":"https://api.github.com/users/runcom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/runcom/subscriptions","organizations_url":"https://api.github.com/users/runcom/orgs","repos_url":"https://api.github.com/users/runcom/repos","events_url":"https://api.github.com/users/runcom/events{/privacy}","received_events_url":"https://api.github.com/users/runcom/received_events","type":"User","site_admin":false},"body":"return the struct directly","created_at":"2016-12-06T12:41:03Z","updated_at":"2016-12-06T12:41:03Z","html_url":"https://github.com/kubernetes-incubator/cri-o/pull/237#discussion_r91069577","pull_request_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/237","_links":{"self":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/comments/91069577"},"html":{"href":"https://github.com/kubernetes-incubator/cri-o/pull/237#discussion_r91069577"},"pull_request":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/237"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/237","id":96716368,"html_url":"https://github.com/kubernetes-incubator/cri-o/pull/237","diff_url":"https://github.com/kubernetes-incubator/cri-o/pull/237.diff","patch_url":"https://github.com/kubernetes-incubator/cri-o/pull/237.patch","issue_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues/237","number":237,"state":"open","locked":false,"title":"Enable networking for hypervisor based container runtimes","user":{"login":"sameo","id":1043863,"avatar_url":"https://avatars.githubusercontent.com/u/1043863?v=3","gravatar_id":"","url":"https://api.github.com/users/sameo","html_url":"https://github.com/sameo","followers_url":"https://api.github.com/users/sameo/followers","following_url":"https://api.github.com/users/sameo/following{/other_user}","gists_url":"https://api.github.com/users/sameo/gists{/gist_id}","starred_url":"https://api.github.com/users/sameo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sameo/subscriptions","organizations_url":"https://api.github.com/users/sameo/orgs","repos_url":"https://api.github.com/users/sameo/repos","events_url":"https://api.github.com/users/sameo/events{/privacy}","received_events_url":"https://api.github.com/users/sameo/received_events","type":"User","site_admin":false},"body":"This pull request adds networking support for hypervisor based OCI compatible container runtimes.\r\nThis has been tested with Clear Containers, and together with the [cri-o](https://github.com/01org/cc-oci-runtime/tree/sameo/topic/cri-o) branch this PR allows us to fully run CRI-O with KVM based containers.\r\n\r\n## Problem statement\r\n\r\nHypervisor based container runtimes prepare their virtual machine (kernel arguments, QEMU process, monitoring process) for a pod when receiving the sandbox container creation command.\r\nPart of the VM preparation typically involves bridging the networking namespace existing interfaces with hypervisor supported interfaces (e.g. TAP). There typically is one bridge per networking namespace veth pair where the QEMU TAP interface and the veth peer are bridged together.\r\nThis means we need to the sandbox networking namespace to be running and configured before CRI-O asks us to create the sandbox container.\r\n\r\nWith the current code, the CNI plugin sets the networking namespace *after* creating the sandbox container which means we always end up with dangling veth peers and disconnected containers within any given pod.\r\n\r\n## Proposed solution\r\nThis PR attempts to fix the above problem by creating and configuring the sandbox networking namespace before creating the sandbox container. This is done in 2 steps:\r\n\r\n1. For each pod, create a persistent namespace under `/var/run/netns`. This is done by the [CNI ns package](https://github.com/containernetworking/cni/tree/master/pkg/ns). The created namespace is removed and cleaned up at pod stop and removal time.\r\n\r\n2. Change the sandbox creation and networking configuration order in the code. We now create the networking namespace, call the default CNI plugin on it, add the networking namespace path to the container OCI configuration, and then create the sandbox container.","created_at":"2016-12-06T12:37:42Z","updated_at":"2016-12-06T12:41:03Z","closed_at":null,"merged_at":null,"merge_commit_sha":"65cc4db8263f2bd118b12f560c6d4c5ac673bd2a","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/237/commits","review_comments_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/237/comments","review_comment_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues/237/comments","statuses_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/statuses/17ab17c2c2c43d07bc66d497b88eadb5131848e3","head":{"label":"sameo:topic/sandbox_netns","ref":"topic/sandbox_netns","sha":"17ab17c2c2c43d07bc66d497b88eadb5131848e3","user":{"login":"sameo","id":1043863,"avatar_url":"https://avatars.githubusercontent.com/u/1043863?v=3","gravatar_id":"","url":"https://api.github.com/users/sameo","html_url":"https://github.com/sameo","followers_url":"https://api.github.com/users/sameo/followers","following_url":"https://api.github.com/users/sameo/following{/other_user}","gists_url":"https://api.github.com/users/sameo/gists{/gist_id}","starred_url":"https://api.github.com/users/sameo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sameo/subscriptions","organizations_url":"https://api.github.com/users/sameo/orgs","repos_url":"https://api.github.com/users/sameo/repos","events_url":"https://api.github.com/users/sameo/events{/privacy}","received_events_url":"https://api.github.com/users/sameo/received_events","type":"User","site_admin":false},"repo":{"id":73402765,"name":"cri-o","full_name":"sameo/cri-o","owner":{"login":"sameo","id":1043863,"avatar_url":"https://avatars.githubusercontent.com/u/1043863?v=3","gravatar_id":"","url":"https://api.github.com/users/sameo","html_url":"https://github.com/sameo","followers_url":"https://api.github.com/users/sameo/followers","following_url":"https://api.github.com/users/sameo/following{/other_user}","gists_url":"https://api.github.com/users/sameo/gists{/gist_id}","starred_url":"https://api.github.com/users/sameo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sameo/subscriptions","organizations_url":"https://api.github.com/users/sameo/orgs","repos_url":"https://api.github.com/users/sameo/repos","events_url":"https://api.github.com/users/sameo/events{/privacy}","received_events_url":"https://api.github.com/users/sameo/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/sameo/cri-o","description":"Open Container Initiative-based implementation of Kubernetes Container Runtime Interface","fork":true,"url":"https://api.github.com/repos/sameo/cri-o","forks_url":"https://api.github.com/repos/sameo/cri-o/forks","keys_url":"https://api.github.com/repos/sameo/cri-o/keys{/key_id}","collaborators_url":"https://api.github.com/repos/sameo/cri-o/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/sameo/cri-o/teams","hooks_url":"https://api.github.com/repos/sameo/cri-o/hooks","issue_events_url":"https://api.github.com/repos/sameo/cri-o/issues/events{/number}","events_url":"https://api.github.com/repos/sameo/cri-o/events","assignees_url":"https://api.github.com/repos/sameo/cri-o/assignees{/user}","branches_url":"https://api.github.com/repos/sameo/cri-o/branches{/branch}","tags_url":"https://api.github.com/repos/sameo/cri-o/tags","blobs_url":"https://api.github.com/repos/sameo/cri-o/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/sameo/cri-o/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/sameo/cri-o/git/refs{/sha}","trees_url":"https://api.github.com/repos/sameo/cri-o/git/trees{/sha}","statuses_url":"https://api.github.com/repos/sameo/cri-o/statuses/{sha}","languages_url":"https://api.github.com/repos/sameo/cri-o/languages","stargazers_url":"https://api.github.com/repos/sameo/cri-o/stargazers","contributors_url":"https://api.github.com/repos/sameo/cri-o/contributors","subscribers_url":"https://api.github.com/repos/sameo/cri-o/subscribers","subscription_url":"https://api.github.com/repos/sameo/cri-o/subscription","commits_url":"https://api.github.com/repos/sameo/cri-o/commits{/sha}","git_commits_url":"https://api.github.com/repos/sameo/cri-o/git/commits{/sha}","comments_url":"https://api.github.com/repos/sameo/cri-o/comments{/number}","issue_comment_url":"https://api.github.com/repos/sameo/cri-o/issues/comments{/number}","contents_url":"https://api.github.com/repos/sameo/cri-o/contents/{+path}","compare_url":"https://api.github.com/repos/sameo/cri-o/compare/{base}...{head}","merges_url":"https://api.github.com/repos/sameo/cri-o/merges","archive_url":"https://api.github.com/repos/sameo/cri-o/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/sameo/cri-o/downloads","issues_url":"https://api.github.com/repos/sameo/cri-o/issues{/number}","pulls_url":"https://api.github.com/repos/sameo/cri-o/pulls{/number}","milestones_url":"https://api.github.com/repos/sameo/cri-o/milestones{/number}","notifications_url":"https://api.github.com/repos/sameo/cri-o/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/sameo/cri-o/labels{/name}","releases_url":"https://api.github.com/repos/sameo/cri-o/releases{/id}","deployments_url":"https://api.github.com/repos/sameo/cri-o/deployments","created_at":"2016-11-10T16:59:43Z","updated_at":"2016-11-10T16:59:44Z","pushed_at":"2016-12-06T12:21:12Z","git_url":"git://github.com/sameo/cri-o.git","ssh_url":"git@github.com:sameo/cri-o.git","clone_url":"https://github.com/sameo/cri-o.git","svn_url":"https://github.com/sameo/cri-o","homepage":"","size":2842,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes-incubator:master","ref":"master","sha":"79073df3c2106e4428f17832a50aa48ad4077e32","user":{"login":"kubernetes-incubator","id":20862812,"avatar_url":"https://avatars.githubusercontent.com/u/20862812?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes-incubator","html_url":"https://github.com/kubernetes-incubator","followers_url":"https://api.github.com/users/kubernetes-incubator/followers","following_url":"https://api.github.com/users/kubernetes-incubator/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes-incubator/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes-incubator/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes-incubator/subscriptions","organizations_url":"https://api.github.com/users/kubernetes-incubator/orgs","repos_url":"https://api.github.com/users/kubernetes-incubator/repos","events_url":"https://api.github.com/users/kubernetes-incubator/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes-incubator/received_events","type":"Organization","site_admin":false},"repo":{"id":67828134,"name":"cri-o","full_name":"kubernetes-incubator/cri-o","owner":{"login":"kubernetes-incubator","id":20862812,"avatar_url":"https://avatars.githubusercontent.com/u/20862812?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes-incubator","html_url":"https://github.com/kubernetes-incubator","followers_url":"https://api.github.com/users/kubernetes-incubator/followers","following_url":"https://api.github.com/users/kubernetes-incubator/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes-incubator/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes-incubator/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes-incubator/subscriptions","organizations_url":"https://api.github.com/users/kubernetes-incubator/orgs","repos_url":"https://api.github.com/users/kubernetes-incubator/repos","events_url":"https://api.github.com/users/kubernetes-incubator/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes-incubator/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes-incubator/cri-o","description":"Open Container Initiative-based implementation of Kubernetes Container Runtime Interface","fork":false,"url":"https://api.github.com/repos/kubernetes-incubator/cri-o","forks_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/forks","keys_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/teams","hooks_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/hooks","issue_events_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/events","assignees_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/tags","blobs_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/languages","stargazers_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/stargazers","contributors_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/contributors","subscribers_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/subscribers","subscription_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/subscription","commits_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/merges","archive_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/downloads","issues_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/deployments","created_at":"2016-09-09T19:56:31Z","updated_at":"2016-12-04T14:40:28Z","pushed_at":"2016-12-06T12:37:42Z","git_url":"git://github.com/kubernetes-incubator/cri-o.git","ssh_url":"git@github.com:kubernetes-incubator/cri-o.git","clone_url":"https://github.com/kubernetes-incubator/cri-o.git","svn_url":"https://github.com/kubernetes-incubator/cri-o","homepage":"","size":3283,"stargazers_count":293,"watchers_count":293,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":40,"mirror_url":null,"open_issues_count":43,"forks":40,"open_issues":43,"watchers":293,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/237"},"html":{"href":"https://github.com/kubernetes-incubator/cri-o/pull/237"},"issue":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues/237"},"comments":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues/237/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/237/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/237/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/statuses/17ab17c2c2c43d07bc66d497b88eadb5131848e3"}}}}
{"actor":{"display_login":"runcom"}}