Function devChangeNetNamespace

libcontainer/network_linux.go:113–232

devChangeNetNamespace allows to move a device given by name to a network namespace given by nsPath and optionally change the device name. The device name will be kept the same if device.Name is the zero value. This function ensures that the move and rename operations occur atomically. It preserves e

(name, nsPath string, device configs.LinuxNetDevice)

// This function ensures that the move and rename operations occur atomically.
// It preserves existing interface attributes, including global IP addresses.
func devChangeNetNamespace(name, nsPath string, device configs.LinuxNetDevice) error {
	logrus.Debugf("attaching network device %s with attrs %+v to network namespace %s", name, device, nsPath)
	link, err := netlink.LinkByName(name)
	// recover same behavior on vishvananda/netlink@1.2.1 and do not fail when the kernel returns NLM_F_DUMP_INTR.
	if err != nil && !errors.Is(err, netlink.ErrDumpInterrupted) {
		return fmt.Errorf("link not found for interface %s on runtime namespace: %w", name, err)
	}

	// Set the interface link state to DOWN before modifying attributes like namespace or name.
	// This prevents potential conflicts or disruptions on the host network during the transition,
	// particularly if other host components depend on this specific interface or its properties.
	err = netlink.LinkSetDown(link)
	if err != nil {
		return fmt.Errorf("fail to set link down: %w", err)
	}

	// Get the existing IP addresses on the interface.
	addresses, err := netlink.AddrList(link, netlink.FAMILY_ALL)
	// recover same behavior on vishvananda/netlink@1.2.1 and do not fail when the kernel returns NLM_F_DUMP_INTR.
	if err != nil && !errors.Is(err, netlink.ErrDumpInterrupted) {
		return fmt.Errorf("fail to get ip addresses: %w", err)
	}

	// Do interface rename and namespace change in the same operation to avoid
	// possible conflicts with the interface name.
	// NLM_F_REQUEST: "It must be set on all request messages."
	// NLM_F_ACK: "Request for an acknowledgment on success."
	// netlink(7) man page: https://man7.org/linux/man-pages/man7/netlink.7.html
	flags := unix.NLM_F_REQUEST | unix.NLM_F_ACK
	req := nl.NewNetlinkRequest(unix.RTM_NEWLINK, flags)

	// Get a netlink socket in current namespace
	nlSock, err := nl.GetNetlinkSocketAt(netns.None(), netns.None(), unix.NETLINK_ROUTE)
	if err != nil {
		return fmt.Errorf("could not get network namespace handle: %w", err)
	}
	defer nlSock.Close()

	req.Sockets = map[int]*nl.SocketHandle{
		unix.NETLINK_ROUTE: {Socket: nlSock},
	}

	// Set the interface index.
	msg := nl.NewIfInfomsg(unix.AF_UNSPEC)
	msg.Index = int32(link.Attrs().Index)
	req.AddData(msg)

	// Set the interface name, also rename if requested.
	newName := name
	if device.Name != "" {
		newName = device.Name
	}
	nameData := nl.NewRtAttr(unix.IFLA_IFNAME, nl.ZeroTerminated(newName))
	req.AddData(nameData)

	// Get the new network namespace.
	ns, err := netns.GetFromPath(nsPath)
	if err != nil {