socketat

README

socketat

Short history first, Golang and linux namespaces doesn't mix well, this blog series explain in detail the problem:

• https://www.weave.works/blog/linux-namespaces-and-go-don-t-mix
• https://www.weave.works/blog/linux-namespaces-golang-followup

On containerized environments,like Kubernetes, this present a big problem to develop network applications that may spawn multiple namespaces.

This library uses the technique described as "socketat" described in the kernel mailing list

It basically enters the namespace to create the socket and returns the socket file descriptor.

That file descriptor any any operations on the sockets created are confined to the namespace, but this time the user is not constrained by the golang limitations described.

The library wraps the net.Dial and net.Listen functions so they can run inside a network namespace:

func DialAt(network, address string, ns int) (conn net.Conn, err error)

func ListenAt(network, address string, ns int) (net.Listener, error) {

References:

Some good libraries to work with golang and linux namespaces:

1. https://github.com/containernetworking/plugins/blob/master/pkg/ns/ns_linux.go
2. https://github.com/vishvananda/netns

Documentation

Index

• func DialAt(network, address string, ns int) (conn net.Conn, err error)
• func DoAtNS(ns int, fn nsFunc) (obj interface{}, err error)
• func ListenAt(network, address string, ns int) (net.Listener, error)
• func SocketAt(domain, typ, proto, ns int) (int, error)

Functions

func DialAt

func DialAt(network, address string, ns int) (conn net.Conn, err error)

DialAt is like net.Dial but the connections is created inside the namespace passed as argument. The connection returned can be handled doesn't is goroutine safe and doesn't have the problems of golang with linux namespaces.

func DoAtNS

func DoAtNS(ns int, fn nsFunc) (obj interface{}, err error)

DoAtNS execute a function inside an specific namespace goroutines spawned inside linnux namespace can escape the namespace, fn() should not spawn any goroutine inside https://www.weave.works/blog/linux-namespaces-golang-followup

func ListenAt

func ListenAt(network, address string, ns int) (net.Listener, error)

ListenAt is like net.Listen but it creates a Listener inside the namespace passed as argument. The new connections accepted are still confined to the namespace, but the user doesn't have to worry about the problems of golang and goroutines.

func SocketAt

func SocketAt(domain, typ, proto, ns int) (int, error)

SocketAt creates a socket in the namespace passed as argument. ref: https://lore.kernel.org/patchwork/patch/217025/