Use Conmon to hold ports open for CNI iptables portmapping about podman

[rhatdan]

Could you open this issue in CRI-O, since we are trying to drop conmon from libpod.

[mheon]

I'll keep this open here to track, and open an issue against CRI-O to modify conmon to support opening and holding ports

[rhatdan]

If we move away from conmon, would this be easier with runc?

[mheon]

Yeah, we'd do it ourself, which should be easy enough - run through our port forwards and reserve them all on the host

[rhatdan]

@mheon @baude What is the current state of this?

[mheon]

The current plan is to open the ports in libpod and pass their file descriptors over to Conmon, being careful not to overlap them with FDs that actually need to be leaked into the container. I don't think any progress has been made on implementing that.

[rhatdan]

@baude made any progress?

[baude]

I wasn't aware this was assigned to me. I think this is more suited to @giuseppe due to C skills. What do you guys think?

[mheon]

@baude The new plan is to open the ports in libpod, and then leak the FDs into conmon and close them. Might still be a good job for someone with more conmon experience, because we have to do the leaking in such a way as to not interfere with the FDs we are already leaking to conmon.

[rhatdan]

@giuseppe PTAL

[giuseppe]

sure I can take a look at it. Could someone more familiar with this part point me to where the ports are currently open?

[rhatdan]

@baude Could you help @giuseppe out?

[baude]

I have to defer to @mheon ... this was his idea.

[mheon]

@giuseppe I don't think we are opening them anywhere yet - presumably we'd do it somewhere in the OCI create code as we're starting to set up Conmon.

[giuseppe]

@mheon so just to be sure I understood, when I do something like -p 80:8081 I'll need to listen on port 80, and leak the fd into conmon? Is anyone ever going to listen on that port? Does it need to be configured to allow multiple listen (SO_REUSEPORT)?

[mheon]

@giuseppe No one should ever listen on the port - we're just holding it open so that nothing on the host can try and use it. As such, we definitely shouldn't be setting SO_REUSEPORT.

[giuseppe]

PR here: #1100