From b23d2b86539bd23c0a35368ac8e69d9a369057ed Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 00:51:40 +0000 Subject: [PATCH 1/3] Build(deps): Bump github.com/containers/gvisor-tap-vsock Bumps [github.com/containers/gvisor-tap-vsock](https://github.com/containers/gvisor-tap-vsock) from 0.8.9 to 0.9.0. - [Release notes](https://github.com/containers/gvisor-tap-vsock/releases) - [Commits](https://github.com/containers/gvisor-tap-vsock/compare/v0.8.9...v0.9.0) --- updated-dependencies: - dependency-name: github.com/containers/gvisor-tap-vsock dependency-version: 0.9.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 14 ++++++++------ go.sum | 60 +++++++++++++++++++++++++++------------------------------- 2 files changed, 36 insertions(+), 38 deletions(-) diff --git a/go.mod b/go.mod index 8497171b..638e156a 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.26.0 require ( github.com/Masterminds/semver/v3 v3.5.0 github.com/containernetworking/plugins v1.9.1 - github.com/containers/gvisor-tap-vsock v0.8.9 + github.com/containers/gvisor-tap-vsock v0.9.0 github.com/gofrs/flock v0.13.1 github.com/google/uuid v1.6.0 github.com/gorilla/mux v1.8.1 @@ -22,21 +22,23 @@ require ( require ( github.com/Microsoft/go-winio v0.6.2 // indirect - github.com/apparentlymart/go-cidr v1.1.1 // indirect github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect github.com/google/btree v1.1.3 // indirect github.com/google/go-cmp v0.7.0 // indirect github.com/google/gopacket v1.1.19 // indirect - github.com/miekg/dns v1.1.72 // indirect + github.com/linuxkit/virtsock v0.0.0-20220523201153-1a23e78aa7a2 // indirect + github.com/mdlayher/socket v0.6.0 // indirect + github.com/mdlayher/vsock v1.3.0 // indirect + github.com/miekg/dns v1.1.73 // indirect github.com/pierrec/lz4/v4 v4.1.22 // indirect + github.com/pkg/errors v0.9.1 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 // indirect github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect golang.org/x/crypto v0.57.0 // indirect - golang.org/x/mod v0.35.0 // indirect + golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa // indirect golang.org/x/net v0.60.0 // indirect golang.org/x/sync v0.23.0 // indirect golang.org/x/time v0.13.0 // indirect - golang.org/x/tools v0.43.0 // indirect - gvisor.dev/gvisor v0.0.0-20240916094835-a174eb65023f // indirect + gvisor.dev/gvisor v0.0.0-20260413194555-9680d69bf798 // indirect ) diff --git a/go.sum b/go.sum index 070d01d0..ede605e4 100644 --- a/go.sum +++ b/go.sum @@ -2,21 +2,17 @@ github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAw github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= -github.com/apparentlymart/go-cidr v1.1.1 h1:oEEk8CE0HP0YpHxsegk/TaOtR2FLHdWv4p3eM4ceUwg= -github.com/apparentlymart/go-cidr v1.1.1/go.mod h1:EBcsNrHc3zQeuaeCeCtQruQm+n9/YjEn/vI25Lg7Gwc= github.com/armon/go-proxyproto v0.0.0-20210323213023-7e956b284f0a/go.mod h1:QmP9hvJ91BbJmGVGSbutW19IC0Q9phDCLGaomwTJbgU= github.com/containernetworking/cni v1.3.0 h1:v6EpN8RznAZj9765HhXQrtXgX+ECGebEYEmnuFjskwo= github.com/containernetworking/cni v1.3.0/go.mod h1:Bs8glZjjFfGPHMw6hQu82RUgEPNGEaBb9KS5KtNMnJ4= github.com/containernetworking/plugins v1.9.1 h1:8oU6WsIsU3bpnNZuvHp74a6cE1MJwbj2P7s4/yTUNlA= github.com/containernetworking/plugins v1.9.1/go.mod h1:fj7kS55qg3o/RgS+WGsF3+ZxwIImMPusQZKzBpcSr4c= -github.com/containers/gvisor-tap-vsock v0.8.9 h1:6b7pqxFcKJ0EycBt1V4zPo3FQtgLLgs50AYkbFIb9eU= -github.com/containers/gvisor-tap-vsock v0.8.9/go.mod h1:OfqLraPkar5xMQcGbl9czDDSM6/xelt0HJpyB3es6v0= +github.com/containers/gvisor-tap-vsock v0.9.0 h1:wu/FkG0i0ThG1FiloQOx45W99EnZBGn0YXwZ1OD/Kw4= +github.com/containers/gvisor-tap-vsock v0.9.0/go.mod h1:FioitCwxk4Yo9zLQKRp2IvSdX707iOdVz5KwDu8WItM= github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo= github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= -github.com/foxcpp/go-mockdns v1.2.0 h1:omK3OrHRD1IWJz1FuFBCFquhXslXoF17OvBS6JPzZF0= -github.com/foxcpp/go-mockdns v1.2.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk= -github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M= -github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= +github.com/foxcpp/go-mockdns v1.3.0 h1:p4PKLZnM1Ii78JzsxJxcYQ5sQT3lIdiPM/vT1SaL9S8= +github.com/foxcpp/go-mockdns v1.3.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI= @@ -29,8 +25,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8= github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo= -github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 h1:EEHtgt9IwisQ2AZ4pIsMjahcegHh6rmhqxzIRQIyepY= -github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U= +github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg= +github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY= @@ -41,26 +37,28 @@ github.com/insomniacslk/dhcp v0.0.0-20260901064844-234b97448fae h1:nXGg65fXsylSU github.com/insomniacslk/dhcp v0.0.0-20260901064844-234b97448fae/go.mod h1:tGfUTcnFYGYvVNCaZZhwlJySU/fQQxh9TmpsFzWXnnY= github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA= github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w= +github.com/linuxkit/virtsock v0.0.0-20220523201153-1a23e78aa7a2 h1:DZMFueDbfz6PNc1GwDRA8+6lBx1TB9UnxDQliCqR73Y= +github.com/linuxkit/virtsock v0.0.0-20220523201153-1a23e78aa7a2/go.mod h1:SWzULI85WerrFt3u+nIm5F9l7EvxZTKQvd0InF3nmgM= github.com/mdlayher/packet v1.1.2 h1:3Up1NG6LZrsgDVn6X4L9Ge/iyRyxFEFD9o6Pr3Q1nQY= github.com/mdlayher/packet v1.1.2/go.mod h1:GEu1+n9sG5VtiRE4SydOmX5GTwyyYlteZiFU+x0kew4= -github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos= -github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ= -github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI= -github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs= +github.com/mdlayher/socket v0.6.0 h1:ScZPaAGyO1icQnbFrhPM8mnXyMu9qukC1K4ZoM2IQKU= +github.com/mdlayher/socket v0.6.0/go.mod h1:q7vozUAnxSqnjHc12Fik5yUKIzfZ8ITCfMkhOtE9z18= +github.com/mdlayher/vsock v1.3.0 h1:bqQfZ1OznI03y6YiXp2sze05RVdzLn/zsfjnjd4+ivI= +github.com/mdlayher/vsock v1.3.0/go.mod h1:WsuksavOvwCnV5UqGHUkvAvCy+Dqy81y4goKQTzxxNY= +github.com/miekg/dns v1.1.73 h1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE= +github.com/miekg/dns v1.1.73/go.mod h1:RW2Obtfd5NZHvOFe3zYG0W8koWOQtAzyHaLo8vASBuQ= github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg= github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4= github.com/moby/vpnkit v0.6.0 h1:HEh3iQ57oigvPNbR89R14pw3difgPyFOMMD3JAoqPoY= github.com/moby/vpnkit v0.6.0/go.mod h1:CNuEpfSK4ZY/NKFWD5M79GUZcYFydh81XQ2GZnT44cQ= -github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE= -github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU= -github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE= -github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU= -github.com/onsi/ginkgo/v2 v2.25.1 h1:Fwp6crTREKM+oA6Cz4MsO8RhKQzs2/gOIVOUscMAfZY= -github.com/onsi/ginkgo/v2 v2.25.1/go.mod h1:ppTWQ1dh9KM/F1XgpeRqelR+zHVwV81DGRSDnFxK7Sk= -github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28= -github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg= +github.com/onsi/ginkgo/v2 v2.33.0 h1:C8gBA6Uc2ZEubiV+SXiu5tZnMTwEmXHgkJwGozKtZf8= +github.com/onsi/ginkgo/v2 v2.33.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44= +github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ= +github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA= github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU= github.com/pierrec/lz4/v4 v4.1.22/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4= +github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= +github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo= @@ -77,18 +75,18 @@ github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zd github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM= github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 h1:FnBeRrxr7OU4VvAzt5X7s6266i6cSVkkFPS0TuXWbIg= github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM= -go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs= -go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8= go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= +golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa h1:FRnLl4eNAQl8hwxVVC17teOw8kdjVDVAiFMtgUdTSRQ= +golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE= golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= -golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= -golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= @@ -108,12 +106,10 @@ golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= golang.org/x/time v0.13.0 h1:eUlYslOIt32DgYD6utsuUeHs4d7AsEYLuIAdg7FlYgI= golang.org/x/time v0.13.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= -golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s= -golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0= +golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= +golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= -gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q= gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA= -gvisor.dev/gvisor v0.0.0-20240916094835-a174eb65023f h1:O2w2DymsOlM/nv2pLNWCMCYOldgBBMkD7H0/prN5W2k= -gvisor.dev/gvisor v0.0.0-20240916094835-a174eb65023f/go.mod h1:sxc3Uvk/vHcd3tj7/DHVBoR5wvWT/MmRq2pj7HRJnwU= +gvisor.dev/gvisor v0.0.0-20260413194555-9680d69bf798 h1:7h21uRYtzPJjXp9W/BZLx68z8TwW8+h5BPdI4P5ZkJ0= +gvisor.dev/gvisor v0.0.0-20260413194555-9680d69bf798/go.mod h1:xQ2PWgHmWJA/Ph4i1q1jBm39BKhc3W0DXqWoDSyuBOY= From 086c483eb8afd38bd2ea8c665e386e69843329f3 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Tue, 13 Oct 2026 10:21:14 +0900 Subject: [PATCH 2/3] gvisor-tap-vsock: adapt to v0.9.0 In gvisor-tap-vsock v0.9.0, VirtualNetwork.Mux() returns http.Handler instead of *http.ServeMux, so *virtualnetwork.VirtualNetwork no longer satisfied port.VirtualNetworkProvider and the network object was silently dropped, failing with "virtual network services mux not available in child context". - Change VirtualNetworkProvider.Mux() to return http.Handler - Add a compile-time assertion so this cannot regress silently - Call the new VirtualNetwork.Close() on cleanup Co-Authored-By: Claude Opus 5.5 (1M context) Signed-off-by: Akihiro Suda --- pkg/network/gvisortapvsock/gvisortapvsock.go | 11 ++++++++--- pkg/port/port.go | 2 +- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/pkg/network/gvisortapvsock/gvisortapvsock.go b/pkg/network/gvisortapvsock/gvisortapvsock.go index de437e28..c54cfa7d 100644 --- a/pkg/network/gvisortapvsock/gvisortapvsock.go +++ b/pkg/network/gvisortapvsock/gvisortapvsock.go @@ -28,8 +28,13 @@ import ( "github.com/rootless-containers/rootlesskit/v3/pkg/network" "github.com/rootless-containers/rootlesskit/v3/pkg/network/iputils" "github.com/rootless-containers/rootlesskit/v3/pkg/network/parentutils" + "github.com/rootless-containers/rootlesskit/v3/pkg/port" ) +// Ensure that *virtualnetwork.VirtualNetwork satisfies port.VirtualNetworkProvider, +// as pkg/parent silently drops the network object otherwise. +var _ port.VirtualNetworkProvider = (*virtualnetwork.VirtualNetwork)(nil) + const ( DriverName = "gvisor-tap-vsock" // Default buffer size for packet reading/writing @@ -294,9 +299,9 @@ func (d *parentDriver) handleConnection(conn net.Conn) { func (d *parentDriver) createCleanupFunc(vn *virtualnetwork.VirtualNetwork) func() error { return func() error { logrus.Debug("closing gvisor-tap-vsock virtual network") - // The VirtualNetwork struct doesn't have an explicit Close method, - // but we'll keep a reference to it to prevent garbage collection - _ = vn + if err := vn.Close(); err != nil { + logrus.Errorf("closing virtual network: %v", err) + } // Close the socket if d.cancel != nil { diff --git a/pkg/port/port.go b/pkg/port/port.go index ea646e5c..b24703af 100644 --- a/pkg/port/port.go +++ b/pkg/port/port.go @@ -40,7 +40,7 @@ type Manager interface { // that provide an in-process virtual network implementation usable by port drivers. // For drivers that do not expose such a network object, this can be nil. type VirtualNetworkProvider interface { - Mux() *http.ServeMux + Mux() http.Handler } // ChildContext is used for RunParentDriver From 2c3033b1e02f0894021f3ced038c6a241f26e38b Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Tue, 13 Oct 2026 17:27:43 +0900 Subject: [PATCH 3/3] port/gvisortapvsock: propagate TCP source IP The buffered TCP proxy introduced in ef4d092 dials the child via VirtualNetwork.DialContextTCP, which always connects from the gateway address, so the TCP source IP was not propagated even after gvisor-tap-vsock v0.9.0 (containers/gvisor-tap-vsock#634). UDP is already propagated, as it still uses the upstream PortsForwarder. Use VirtualNetwork.DialContextTCPFrom with the client address of the accepted connection, preserving the throughput of the buffered proxy. go.mod temporarily replaces gvisor-tap-vsock with containers/gvisor-tap-vsock#747 until it is merged and released. Fix #573 Co-Authored-By: Claude Opus 5.5 (1M context) Signed-off-by: Akihiro Suda --- docs/port.md | 3 +- go.mod | 2 ++ go.sum | 4 +-- hack/integration-port-source-ip.sh | 32 +++++++++++-------- .../gvisortapvsock/gvisortapvsock_test.go | 2 +- pkg/port/gvisortapvsock/tcp.go | 5 +-- 6 files changed, 28 insertions(+), 20 deletions(-) diff --git a/docs/port.md b/docs/port.md index 53369381..12ac8f47 100644 --- a/docs/port.md +++ b/docs/port.md @@ -10,7 +10,7 @@ The default value is `none` (do not expose ports). | `builtin` | 29.3 Gbps | Propagated for TCP (since v3.0) | Source IP propagation (`--source-ip-transparent`) applies to TCP only; UDP is not propagated. In the case of Rootless Docker, userland-proxy has to be disabled for propagating the source IP. The underlying firewall rules use `nft`, falling back to `iptables` if `nft` is unavailable; the backend name is resolved eagerly at startup but rules are installed lazily on first transparent connection. `--source-ip-transparent-backend` can be used to force one or the other. The resolved backend is reported via the REST API (`PortDriverInfo.Extra["sourceIPTransparentBackend"]`). | `implicit` | 39.9 Gbps | Propagated | Requires `pasta` network | `pesto` (Experimental) | 45.2 Gbps | Propagated | Requires `pasta` network and passt `2026_05_07.1afd4ed` or later. Supports explicit port management through `rootlessctl`. -| `gvisor-tap-vsock` (Experimental) | 3.77 Gbps | Not propagated | Throughput is currently limited; see issue link below for improvement ideas. +| `gvisor-tap-vsock` (Experimental) | 3.77 Gbps | Propagated | Throughput is currently limited; see issue link below for improvement ideas. Source IP is not propagated for loopback clients (e.g., 127.0.0.1). Benchmark: iperf3 from the parent to the child is measured on GitHub Actions ([Aug 4, 2026](https://github.com/rootless-containers/rootlesskit/actions/runs/30896585927/job/91950824205)) @@ -27,7 +27,6 @@ IPv6 port forwarding additionally requires the `--ipv6` flag, as the `pasta` net > [!NOTE] > The `gvisor-tap-vsock` port driver is experimental. -> - Source IP is not propagated: https://github.com/rootless-containers/rootlesskit/issues/573 > - Current throughput is known to be slower than other drivers. We are tracking ideas for improving throughput here: https://github.com/rootless-containers/rootlesskit/issues/529 * To be documented: [`bypass4netns`](https://github.com/rootless-containers/bypass4netns) for native performance. diff --git a/go.mod b/go.mod index 638e156a..505c8bcb 100644 --- a/go.mod +++ b/go.mod @@ -42,3 +42,5 @@ require ( golang.org/x/time v0.13.0 // indirect gvisor.dev/gvisor v0.0.0-20260413194555-9680d69bf798 // indirect ) + +replace github.com/containers/gvisor-tap-vsock => github.com/AkihiroSuda/gvisor-tap-vsock v0.3.1-0.20261013022343-f9a335509534 diff --git a/go.sum b/go.sum index ede605e4..4de77d63 100644 --- a/go.sum +++ b/go.sum @@ -1,3 +1,5 @@ +github.com/AkihiroSuda/gvisor-tap-vsock v0.3.1-0.20261013022343-f9a335509534 h1:MIzUjELwkeE96TUquYxJ/5s1RRA7sQ+gOPX3F5O2oNg= +github.com/AkihiroSuda/gvisor-tap-vsock v0.3.1-0.20261013022343-f9a335509534/go.mod h1:FioitCwxk4Yo9zLQKRp2IvSdX707iOdVz5KwDu8WItM= github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE= github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= @@ -7,8 +9,6 @@ github.com/containernetworking/cni v1.3.0 h1:v6EpN8RznAZj9765HhXQrtXgX+ECGebEYEm github.com/containernetworking/cni v1.3.0/go.mod h1:Bs8glZjjFfGPHMw6hQu82RUgEPNGEaBb9KS5KtNMnJ4= github.com/containernetworking/plugins v1.9.1 h1:8oU6WsIsU3bpnNZuvHp74a6cE1MJwbj2P7s4/yTUNlA= github.com/containernetworking/plugins v1.9.1/go.mod h1:fj7kS55qg3o/RgS+WGsF3+ZxwIImMPusQZKzBpcSr4c= -github.com/containers/gvisor-tap-vsock v0.9.0 h1:wu/FkG0i0ThG1FiloQOx45W99EnZBGn0YXwZ1OD/Kw4= -github.com/containers/gvisor-tap-vsock v0.9.0/go.mod h1:FioitCwxk4Yo9zLQKRp2IvSdX707iOdVz5KwDu8WItM= github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo= github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/foxcpp/go-mockdns v1.3.0 h1:p4PKLZnM1Ii78JzsxJxcYQ5sQT3lIdiPM/vT1SaL9S8= diff --git a/hack/integration-port-source-ip.sh b/hack/integration-port-source-ip.sh index 6c505d29..943f3061 100755 --- a/hack/integration-port-source-ip.sh +++ b/hack/integration-port-source-ip.sh @@ -1,6 +1,7 @@ #!/bin/bash -# Test source IP propagation of the builtin port driver (--source-ip-transparent). -# https://github.com/rootless-containers/rootlesskit/issues/648 +# Test source IP propagation of port drivers. +# - builtin (--source-ip-transparent): https://github.com/rootless-containers/rootlesskit/issues/648 +# - gvisor-tap-vsock: https://github.com/rootless-containers/rootlesskit/issues/573 source $(realpath $(dirname $0))/common.inc.sh ROOTLESSCTL="rootlessctl" @@ -8,12 +9,13 @@ ROOTLESSCTL="rootlessctl" # The source IP is not propagated for loopback addresses nonloopback="$(hostname -I | awk '{print $1}')" -# test_source_ip NET [ROOTLESSKIT ARGS...] +# test_source_ip NET PORT_DRIVER [ROOTLESSKIT ARGS...] function test_source_ip() { net="$1" - shift + port_driver="$2" + shift 2 rootlesskit_args="$@" - INFO "Testing net=\"${net}\" rootlesskit_args=\"${rootlesskit_args}\"" + INFO "Testing net=\"${net}\" port_driver=\"${port_driver}\" rootlesskit_args=\"${rootlesskit_args}\"" tmp=$(mktemp -d) state_dir=${tmp}/state html_dir=${tmp}/html @@ -35,7 +37,7 @@ EOF --net=${net} \ --disable-host-loopback \ --copy-up=/etc \ - --port-driver=builtin \ + --port-driver=${port_driver} \ --debug \ -p 0.0.0.0:8080:80/tcp \ ${rootlesskit_args} \ @@ -55,9 +57,11 @@ EOF wait $pid >/dev/null 2>&1 || true rm -rf $tmp - if [ "${backend}" = "none" ] || [ "${backend}" = "null" ] || [ -z "${backend}" ]; then - ERROR "sourceIPTransparentBackend is \"${backend}\"" - exit 1 + if [ "${port_driver}" = "builtin" ]; then + if [ "${backend}" = "none" ] || [ "${backend}" = "null" ] || [ -z "${backend}" ]; then + ERROR "sourceIPTransparentBackend is \"${backend}\"" + exit 1 + fi fi if [ "${remote_addr}" != "${nonloopback}" ]; then ERROR "Expected REMOTE_ADDR to be \"${nonloopback}\", got \"${remote_addr}\"" @@ -66,9 +70,11 @@ EOF INFO "OK: sourceIPTransparentBackend=\"${backend}\", REMOTE_ADDR=\"${remote_addr}\"" } -test_source_ip slirp4netns -test_source_ip slirp4netns --detach-netns -test_source_ip gvisor-tap-vsock -test_source_ip gvisor-tap-vsock --detach-netns +test_source_ip slirp4netns builtin +test_source_ip slirp4netns builtin --detach-netns +test_source_ip gvisor-tap-vsock builtin +test_source_ip gvisor-tap-vsock builtin --detach-netns +test_source_ip gvisor-tap-vsock gvisor-tap-vsock +test_source_ip gvisor-tap-vsock gvisor-tap-vsock --detach-netns INFO "===== PASSING =====" diff --git a/pkg/port/gvisortapvsock/gvisortapvsock_test.go b/pkg/port/gvisortapvsock/gvisortapvsock_test.go index 503312c6..b6dd0ab1 100644 --- a/pkg/port/gvisortapvsock/gvisortapvsock_test.go +++ b/pkg/port/gvisortapvsock/gvisortapvsock_test.go @@ -18,7 +18,7 @@ type testTCPDialer struct { addr string } -func (d testTCPDialer) DialContextTCP(ctx context.Context, addr string) (net.Conn, error) { +func (d testTCPDialer) DialContextTCPFrom(ctx context.Context, _ net.Addr, addr string) (net.Conn, error) { return (&net.Dialer{}).DialContext(ctx, "tcp", d.addr) } diff --git a/pkg/port/gvisortapvsock/tcp.go b/pkg/port/gvisortapvsock/tcp.go index 7171e3ec..2401525f 100644 --- a/pkg/port/gvisortapvsock/tcp.go +++ b/pkg/port/gvisortapvsock/tcp.go @@ -17,7 +17,7 @@ import ( const tcpCopyBufferSize = 256 * 1024 type tcpDialer interface { - DialContextTCP(context.Context, string) (net.Conn, error) + DialContextTCPFrom(context.Context, net.Addr, string) (net.Conn, error) } // exposeTCP is called with d.mu held, like the upstream expose API. @@ -33,7 +33,8 @@ func (d *driver) exposeTCP(local, remote string) error { proxy.AddRoute(local, &tcpproxy.DialProxy{ Addr: remote, DialContext: func(ctx context.Context, _, addr string) (net.Conn, error) { - conn, err := dialer.DialContextTCP(ctx, addr) + src, _ := ctx.Value(tcpproxy.SourceAddrContextKey).(net.Addr) + conn, err := dialer.DialContextTCPFrom(ctx, src, addr) if err != nil { return nil, err }