Runc: Port Mapping

[Elbasha-Elkyber]

hi,
i am trying to use runc to execute a container hosting SQL server and some other software,
i would like to know how may i map the ports of this container to the host ports
how may i do something like Docker -p xx:yy
also can you refer to any documentation available for the .Josn file configuration syntax?

[Elbasha-Elkyber]

Anyone to comment? is it that hard?
how may i execute container with networking on the latest version, detailed steps please, with port mapping

[LK4D4]

@Elbasha-Elkyber There is no way to do this through json configuration. You need to setup network namespace yourself or use host network namespace.

[hqhq]

@Elbasha-Elkyber runC is a simple runtime tool, it's not supposed to be as functional as Docker, I don't think feature like this will be added to runC, because it's not a container-support-level feature, but a high-level-configurable feature

Maybe you can config iptables yourself to do this port mapping, sorry I haven't done this before, can't give you more details now. You can learn from Docker, see details how Docker does this will help, I think that'll be some iptable configuration stuff, which can be done by hand.

[Elbasha-Elkyber]

thanks, but can i even run a container with networking, like a web server or a SQL server in a container running through Runc?

[hqhq]

@Elbasha-Elkyber Sorry I might be wrong, I realized runC container has only loopback device, so iptable configuration on host won't be enough. You need a veth-pair between host and container. So if you want to use networking in runC container, one possible way is like @LK4D4 said, setup network namespace yourself or use host network namespace.

And I found there is no network defined in spec, so it's not configurable right now, maybe you can ask in https://github.com/opencontainers/specs/pull/230 to see if specs has any plans on this.

[Elbasha-Elkyber]

thank you for the elaboration but , may i ask you to help me one step further and give me some hints on how to do that (setup network namespace or use host network namespace with Runc containers). i just need the container to have some listening ports active to get an enclosed server to be working.

[Elbasha-Elkyber]

i would also suggest to publish a manual for that as most of the guys working with containers would definitely need some services running inside to be exposed to the network. also please i noticed that guideline on the GitHub page has an outdated specs that will induce errors if followed, i think you need to change it too

[hqhq]

@Elbasha-Elkyber To play with netns, you can use ip netns, there are some examples, but I'm not sure how to play this with existed runc container.

If you want to use host network namespace, just change runtime.json, remove network in namespaces. With that, the network in runc container will be exactly the same as host.

For manual, I think we should wait for specs, see what's the plan about network in container, I already asked about this in opencontainers/specs#230.

And you are right guideline is outdated, I opened a PR #371 to fix this, thanks for reporting.

[Elbasha-Elkyber]

thank you so much for the followup , i tried and removed the network section ,
however i get the same error that indicates a domain name resolution failure .
when i execute apt-get update inside a ubuntu container (based on the instructions on the manual) running through RunC, i get the following :
Failed to fetch http://archive.ubuntu.com/ubuntu/dists/trusty-security/Release.gpg Could not resolve 'archive.ubuntu.com'

[marcosnils]

@Elbasha-Elkyber to get resolution working you need to mount the resolv.conf from the host:

 {
      "type": "bind",
      "source": "/etc/resolv.conf",
      "destination": "/etc/resolv.conf",
      "options": "rbind,ro"
    }

[Elbasha-Elkyber]

for me to do so in runc V 0.2.0 , i added the mentioned section with a tag and an array indicators for the options as it gave me an error when i added it as is
"netw":{
"type": "bind",
"source": "/etc/resolv.conf",
"destination": "/etc/resolv.conf",
"options": [
"rbind,ro"
]

},

and it didnot work as well, so please let me know if i did something wrong

[marcosnils]

Just add a resolve.conf in your rootfs and you should be ok

sent from mobile
On Oct 27, 2015 9:32 PM, "Elbasha-Elkyber" [email protected] wrote:

for me to do so in runc V 0.2.0 , i added the mentioned section with a tag
and an array indicators for the options as it gave me an error when i added
it as is
"netw":{
"type": "bind",
"source": "/etc/resolv.conf",
"destination": "/etc/resolv.conf",
"options": [
"rbind,ro"
]

},

and it didnot work as well, so please let me know if i did something wrong

—
Reply to this email directly or view it on GitHub
https://github.com/opencontainers/runc/issues/356#issuecomment-151683464
.

[Elbasha-Elkyber]

thanksssssss, it worked
i will try hosting a server inside and will check if it will be accessible from outside using the host ip. , will update if it worked,
thanks

[marcosnils]

If you removed the network ns and the host has the port opened you should
be able to access

sent from mobile
On Oct 27, 2015 9:55 PM, "Elbasha-Elkyber" [email protected] wrote:

thanksssssss, it worked
i will try hosting a server inside and will check if it will be accessible
from outside using the host ip. , will update if it worked,
thanks

—
Reply to this email directly or view it on GitHub
https://github.com/opencontainers/runc/issues/356#issuecomment-151687116
.

[Elbasha-Elkyber]

it worked perfectly, thanks

[mrunalp]

@Elbasha-Elkyber Can we close the issue? Thanks!

[Elbasha-Elkyber]

yes sure :) thanks

[harshitdaga]

@Elbasha-Elkyber I am trying to do the same thing but it is not working for me. Can you please share your config file? Also, what is required to be added in the resolv.conf file?

[danishprakash]

@harshitdaga It's probably way too late but just leaving this here.
Essentially, you don't create a new network namespace by removing the network entry from namespaces and then bind mount your host's /ets/resolv.conf inside the container:

{
    "linux": {
        "namespaces": [
            {
                "type": "pid"
            },
            {
                "type": "ipc"
            },
            {
                "type": "uts"
            },
            {
                "type": "mount"
            }
        ],
    "mounts": [
        {
            "type": "bind",
            "source": "/etc/resolv.conf",
            "destination": "/etc/resolv.conf",
            "options": [
                "rbind",
                "ro"
            ]
        }
    ]
}

the config.json is snipped for brevity.