networking

Documentation

Index

• Constants
• func CleanStaleBridge(log *slog.Logger)
• type Config
• type Manager
  • func New(cfg Config) (*Manager, error)
  • func (m *Manager) Cleanup()
  • func (m *Manager) GatewayIP() string
  • func (m *Manager) InstallFirewallRules() error
  • func (m *Manager) Setup(ctx context.Context, id string, netns string) (*SetupResult, error)
  • func (m *Manager) Teardown(ctx context.Context, id string, netns string) error
• type SetupResult

Constants

const DefaultSubnet = "10.88.0.0/16"

DefaultSubnet is the preferred IP range for containers.

Functions

func CleanStaleBridge

func CleanStaleBridge(log *slog.Logger)

CleanStaleBridge deletes the ephemerd0 bridge if it exists. Used on startup in the WSL containerd-only worker to remove bridges left over from a previous boot (all WSL2 distros share one kernel so bridges persist across instances).

Types

type Config

type Config struct {
	DataDir      string
	Subnet       string // container subnet (auto-selected if empty)
	MTU          int    // bridge MTU (auto-detected from host if 0)
	CNIBinDir    string // path to CNI plugin binaries (Linux only, ignored elsewhere)
	GatewayPorts []int  // extra TCP ports to allow from containers to the gateway (e.g., module proxy)

	// ControlPorts are TCP ports the ephemerd control plane binds on the
	// gateway (bridge) address that MUST NOT be reachable from inside
	// containers: the in-VM containerd (default 10000), the unauthenticated
	// dispatch gRPC server (containerd+1), and the debug exec server
	// (containerd+2). The firewall adds targeted INPUT DROP rules from the
	// container subnet to the gateway on these ports. Empty = no INPUT
	// control-plane rules (e.g. a bare-metal Linux host with no in-VM
	// dispatch server listening on the bridge).
	ControlPorts []int

	Log *slog.Logger
}

Config for container networking.

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager handles platform-specific container networking. On Linux, this uses CNI with a bridge and iptables firewall. On Windows, this uses HCN with a NAT network and ACL policies.

func New

func New(cfg Config) (*Manager, error)

New creates and initializes the networking manager for the current platform.

func (*Manager) Cleanup

func (m *Manager) Cleanup()

Cleanup removes all networking state: firewall rules, bridge interface, CNI config, IP allocations, and DNS files. Called on shutdown.

func (*Manager) GatewayIP

func (m *Manager) GatewayIP() string

GatewayIP returns the bridge gateway IP address (e.g., "10.88.0.1"). This is the first usable IP in the container subnet, reachable from inside containers. Used by services that need to be accessible to jobs (e.g., Go module proxy, DNS).

func (*Manager) InstallFirewallRules

func (m *Manager) InstallFirewallRules() error

InstallFirewallRules blocks container traffic to private network ranges.

func (*Manager) Setup

func (m *Manager) Setup(ctx context.Context, id string, netns string) (*SetupResult, error)

Setup attaches a container to the network.

func (*Manager) Teardown

func (m *Manager) Teardown(ctx context.Context, id string, netns string) error

Teardown detaches a container from the network.

type SetupResult

type SetupResult struct {
	// NetNS is the network namespace identifier (Linux: path, Windows: namespace ID).
	NetNS string
	// EndpointID is the HCN endpoint ID (Windows only). Used to attach
	// the network to the container via the OCI spec.
	EndpointID string
	// IP is the container's IP address on the bridge network.
	// Populated on Linux from the CNI result; empty on other platforms.
	IP string
}

SetupResult contains the network configuration applied to a container.