rootless: run the puller/pusher in the host netns (but still in the userns)

[AkihiroSuda]

With the upcoming bypass4netns integration, rootless containers no longer needs to be slowed down with slirp, however, the puller and the pusher are still slowed down.

We should now look into possibility of running the puller/pusher in the host netns to avoid the slirp overhead.

[AkihiroSuda]

@fahedouch

The idea is to add a new flag like --detach-netns to rootlesskit.
When this flag is specified, RootlessKit mounts the new NetNS to $ROOTLESSKIT_STATE_DIR/netns and launches slirp4netns (or pasta) for that netns, but leaves the command process (i.e., containerd) in the host NetNS (w/ unshared UserNS and MountNS).
nerdctl and BuildKit have to support running CNI in the $ROOTLESSKIT_STATE_DIR/netns namespace.

[fahedouch]

@AkihiroSuda thanks for your insights

RootlessKit mounts the new NetNS to $ROOTLESSKIT_STATE_DIR/netns

• are you pointing to the new NetNS created by unshare() ? Or previously created netns (before launching rootlesskit) which will be mounted when invoke --detach-netns and then passed to slirp4netns . I beleive that in this case we should avoid unshared NetNS , right ?

launches slirp4netns (or pasta) for that netns, but leaves the command process (i.e., containerd) in the host NetNS (w/ unshared UserNS and MountNS)

once we disable unsharing netns for /proc/self/exec , process will run into new MountNS and new UserNS which are already cloned , So why should I unshare them ?

[AkihiroSuda]

are you pointing to the new NetNS created by unshare() ?

yes