Netns - Revision history

Amelentyev: Fix a syntax error in the config example

2024-07-21T19:32:02Z

Fix a syntax error in the config example

← Older revision		Revision as of 19:32, 21 July 2024
Line 68:		Line 68:
	- 0.0.0.0/0		- 0.0.0.0/0
	routing:		routing:
	routes: []		routes:
	- to: 0.0.0.0/0		- to: 0.0.0.0/0
	dev: wg0		dev: wg0

Sertonix: add category networking

2023-11-10T10:52:15Z

add category networking

← Older revision		Revision as of 10:52, 10 November 2023
Line 87:		Line 87:
	* iptables		* iptables
	* nftables		* nftables

			[[Category:Networking]]

Sertonix: use cmd & cat template

2023-09-29T10:38:23Z

use cmd & cat template

← Older revision		Revision as of 10:38, 29 September 2023
Line 13:		Line 13:
	Netns can be ad-hoc managed using the <code>ip netns</code> commands.		Netns can be ad-hoc managed using the <code>ip netns</code> commands.

	<~~pre~~>		{{cmd\|<nowiki># ip netns
	ip netns		# ip netns add tenant1
	ip netns add tenant1		# ip netns del tenant1
	ip netns del tenant1		# ip netns exec tenant1 ip -br link
	ip netns exec tenant1 ip -br link		</nowiki>}}
	</~~pre~~>

	=== ifstate ===		=== ifstate ===
Line 24:		Line 23:
	[https://ifstate.net IfState], a declarative network configuration tool, is full netns aware since IfState 1.9.0. The following config example creates a wireguard tunnel and a vlan sub-interface. The wireguard link <code>wg0</code> and the vlan sub-interface are moved into the <code>vpn</code> netns.		[https://ifstate.net IfState], a declarative network configuration tool, is full netns aware since IfState 1.9.0. The following config example creates a wireguard tunnel and a vlan sub-interface. The wireguard link <code>wg0</code> and the vlan sub-interface are moved into the <code>vpn</code> netns.

	<~~pre~~>		{{cat\|/etc/ifstate/config.yml\|<nowiki># root netns
	# root netns
	interfaces:		interfaces:
	- name: eth0		- name: eth0
Line 74:		Line 72:
	dev: wg0		dev: wg0
	rules: []		rules: []
	</~~pre~~>		</nowiki>}}

	== netns-based Service Isolation ==		== netns-based Service Isolation ==

Zcrayfish: Finished fixing case.

2023-09-26T20:08:12Z

Finished fixing case.

← Older revision		Revision as of 20:08, 26 September 2023
Line 1:		Line 1:
	{{DISPLAYTITLE:netns}}		{{DISPLAYTITLE:netns}}

	'''~~Netns~~''' (network namespaces) are another instance of the network stack with its own network devices (links), ip setup and firewall rules. Besides of using netns for building containers they can be used to get a stricter isolation than using [[VRF]]s.		'''netns''' (network namespaces) are another instance of the network stack with its own network devices (links), ip setup and firewall rules. Besides of using netns for building containers they can be used to get a stricter isolation than using [[VRF]]s.

	== Prerequisites ==		== Prerequisites ==
Line 7:		Line 7:
	The packages and patches described in this article are available in Alpine edge and ≥3.19.		The packages and patches described in this article are available in Alpine edge and ≥3.19.

	== ~~NETNS~~ management ==		== netns management ==

	=== iproute2 ===		=== iproute2 ===
Line 76:		Line 76:
	</pre>		</pre>

	== ~~NETNS~~-based Service Isolation ==		== netns-based Service Isolation ==

	Services can be run isolated in a ~~NETNS~~ ('''and''' [[VRF]] inside the ~~NETNS~~) when running at least OpenRC 0.49.0-r1. You can set the <code>$netns</code> variable for the service in {{path\|/etc/conf.d}} in most cases.		Services can be run isolated in a netns ('''and''' [[VRF]] inside the netns) when running at least OpenRC 0.49.0-r1. You can set the <code>$netns</code> variable for the service in {{path\|/etc/conf.d}} in most cases.

	''The netns must already be created before a service can be started inside of it!''		''The netns must already be created before a service can be started inside of it!''

	== ~~NETNS~~-compatible initd scripts ==		== netns-compatible initd scripts ==

	Not all initd scripts might be netns compatible. Some network stack related packages have been patched to be netns aware:		Not all initd scripts might be netns compatible. Some network stack related packages have been patched to be netns aware:

Zcrayfish: Zcrayfish moved page NETNS to Netns: Title case

2023-09-26T20:07:14Z

Zcrayfish moved page NETNS to Netns: Title case

← Older revision	Revision as of 20:07, 26 September 2023
(No difference)

Zcrayfish: Case WIP

2023-09-26T20:06:38Z

Case WIP

← Older revision		Revision as of 20:06, 26 September 2023
Line 1:		Line 1:
			{{DISPLAYTITLE:netns}}

	'''Netns''' (network namespaces) are another instance of the network stack with its own network devices (links), ip setup and firewall rules. Besides of using netns for building containers they can be used to get a stricter isolation than using [[VRF]]s.		'''Netns''' (network namespaces) are another instance of the network stack with its own network devices (links), ip setup and firewall rules. Besides of using netns for building containers they can be used to get a stricter isolation than using [[VRF]]s.

Zcrayfish: /* NETNS-based Service Isolation */ Use path template.

2023-09-26T20:03:24Z

NETNS-based Service Isolation: Use path template.

← Older revision		Revision as of 20:03, 26 September 2023
Line 76:		Line 76:
	== NETNS-based Service Isolation ==		== NETNS-based Service Isolation ==

	Services can be run isolated in a NETNS ('''and''' [[VRF]] inside the NETNS) when running at least OpenRC 0.49.0-r1. You can set the <code>$netns</code> variable for the service in ~~<code>~~/etc/conf.d~~</code>~~ in most cases.		Services can be run isolated in a NETNS ('''and''' [[VRF]] inside the NETNS) when running at least OpenRC 0.49.0-r1. You can set the <code>$netns</code> variable for the service in {{path\|/etc/conf.d}} in most cases.

	''The netns must already be created before a service can be started inside of it!''		''The netns must already be created before a service can be started inside of it!''

Liske: Minor format fixes.

2023-09-26T20:02:44Z

Minor format fixes.

← Older revision		Revision as of 20:02, 26 September 2023
Line 76:		Line 76:
	== NETNS-based Service Isolation ==		== NETNS-based Service Isolation ==

	Services can be run isolated in a NETNS ('''and''' [[VRF]] inside the NETNS) when running OpenRC 0.49.0-r1+. You can set the <code>$netns</code> variable for the service in <code>/etc/conf.d</code> in most cases.		Services can be run isolated in a NETNS ('''and''' [[VRF]] inside the NETNS) when running at least OpenRC 0.49.0-r1. You can set the <code>$netns</code> variable for the service in <code>/etc/conf.d</code> in most cases.

	''The netns must already be created before a service can be started inside of it!''		''The netns must already be created before a service can be started inside of it!''
Line 84:		Line 84:
	Not all initd scripts might be netns compatible. Some network stack related packages have been patched to be netns aware:		Not all initd scripts might be netns compatible. Some network stack related packages have been patched to be netns aware:

	- ipset		* ipset
	- iptables		* iptables
	- nftables		* nftables

Liske: Initial content about Alpine's netns superpower.

2023-09-26T20:01:04Z

Initial content about Alpine's netns superpower.

New page

'''Netns''' (network namespaces) are another instance of the network stack with its own network devices (links), ip setup and firewall rules. Besides of using netns for building containers they can be used to get a stricter isolation than using [[VRF]]s.

== Prerequisites ==

The packages and patches described in this article are available in Alpine edge and ≥3.19.

== NETNS management ==

=== iproute2 ===

Netns can be ad-hoc managed using the <code>ip netns</code> commands.

<pre>
ip netns
ip netns add tenant1
ip netns del tenant1
ip netns exec tenant1 ip -br link
</pre>

=== ifstate ===

[https://ifstate.net IfState], a declarative network configuration tool, is full netns aware since IfState 1.9.0. The following config example creates a wireguard tunnel and a vlan sub-interface. The wireguard link <code>wg0</code> and the vlan sub-interface are moved into the <code>vpn</code> netns.

<pre>
# root netns
interfaces:
- name: eth0
addresses:
- 198.51.100.2/31
link:
state: up
kind: physical
routing:
routes:
- to: 0.0.0.0/0
via: 198.51.100.1
rules: []

namespaces:
# "vpn" netns
vpn:
interfaces:
- name: eth0.42
addresses:
- 192.0.2.1/25
link:
state: up
kind: vlan
vlan_id: 42
link: eth0
# link to eth0 in root netns
link_netns: null
- name: wg0
addresses:
- 192.0.2.254/30
link:
state: up
kind: wireguard
# bind wireguard to the root netns
bind_netns: null
wireguard:
private_key: !include /etc/wireguard/secret.key
peers:
- public_key: 3Eimby+9YtJwtx+peCsz6RiubRqAp+cATHNiGWsUsEU=
endpoint: 203.0.113.42
persistent_keepalive_interval: 30
allowedips:
- 0.0.0.0/0
routing:
routes: []
- to: 0.0.0.0/0
dev: wg0
rules: []
</pre>

== NETNS-based Service Isolation ==

Services can be run isolated in a NETNS ('''and''' [[VRF]] inside the NETNS) when running OpenRC 0.49.0-r1+. You can set the <code>$netns</code> variable for the service in <code>/etc/conf.d</code> in most cases.

''The netns must already be created before a service can be started inside of it!''

== NETNS-compatible initd scripts ==

Not all initd scripts might be netns compatible. Some network stack related packages have been patched to be netns aware:

- ipset
- iptables
- nftables