I'm trying to set up a system to run a few containers using crun-krun and I can't for the life of me get the networking to work correctly.
The fundamental issue I keep running into is that the man page for krun is pretty brief and doesn't document the system architecture at all. Poking around the recent discussions around PRs and such it seems that crun sets up the container namespace that it normally would without krun, then invokes libkrun inside of that. That doesn't really account for what I'm seeing though, from what I understand in TSI mode libkrun should present the host network directly to the guest by transparently relaying the sockets, in which case the container should see the exact same network it would have running under crun normally, but instead it gets a dummy0 network device with a completely different IP and no outbound network access. And in passt mode containers do get outbound network access but I keep running into all kinds of weird port mapping issues where containers will sometimes be able to talk to each other over a shared network and sometimes not, tcp connections over published ports sometimes don't work without any clear difference in configuration, and udp port mappings never work at all. I've tried launching interactive containers on the same networks to poke around and it's not clear at all what's going on just poking around the edges like this.
Ideally what we should have is a more detailed description of krun's architecture, how libkrun gets configured, how passt gets configured when in use, how networking interacts with published ports, and some kind of troubleshooting advice, e.g. some method to inspect the network layout, flags to increase log verbosity etc.
I'm trying to set up a system to run a few containers using crun-krun and I can't for the life of me get the networking to work correctly.
The fundamental issue I keep running into is that the man page for krun is pretty brief and doesn't document the system architecture at all. Poking around the recent discussions around PRs and such it seems that crun sets up the container namespace that it normally would without krun, then invokes libkrun inside of that. That doesn't really account for what I'm seeing though, from what I understand in TSI mode libkrun should present the host network directly to the guest by transparently relaying the sockets, in which case the container should see the exact same network it would have running under crun normally, but instead it gets a dummy0 network device with a completely different IP and no outbound network access. And in passt mode containers do get outbound network access but I keep running into all kinds of weird port mapping issues where containers will sometimes be able to talk to each other over a shared network and sometimes not, tcp connections over published ports sometimes don't work without any clear difference in configuration, and udp port mappings never work at all. I've tried launching interactive containers on the same networks to poke around and it's not clear at all what's going on just poking around the edges like this.
Ideally what we should have is a more detailed description of krun's architecture, how libkrun gets configured, how passt gets configured when in use, how networking interacts with published ports, and some kind of troubleshooting advice, e.g. some method to inspect the network layout, flags to increase log verbosity etc.