Networking: Support Dynamic Network Connect/Disconnect

[mcastelino]

docker network connect
docker network disconnect

Allows you to connect a network to an running container.
cc-oci-runtime does not support this capability today.

[grahamwhaley]

@mcastelino before somebody goes digging, do you have ideas why cc-oci-runtime does not currently support it? Any idea what is missing/wrong?

[mcastelino]

@grahamwhaley there is nothing wrong in clear containers. Container networking assumes transparent use of namespaces and the ability for a container to see anything that is inserted into the namespace automatically. As clear containers have an additional level of separation (VT-x) in addition to being namespaced, the clear container code base has to be enhanced to detect any additional devices that show up in the name space and plug them into the VT-x based runtime.

[louisekrug]

here in BT we have a number of potential use cases that all rely on multiple network interfaces, so i'd be interested in any solution to this

[mcastelino]

@louisekrug we will support multi network interfaces. Use cases such as docker swarm require this functionality. This feature will be added shortly. PR #399

The gap currently is the dynamic connection of a network to an already running container using network connect. Do you use the dynamic network connect capability?

This is due to the nature of the OCI spec which currently does not provide a notification of this network connect. It would be of interest to us, if there is need for this for your deployment, which would mean we will need to monitor the container namespace at runtime for additional interfaces and hot plug them into the Clear Container VM.

[sameo]

Now tracked as part of the virtcontainers project:
containers/virtcontainers#241