Skip to content

netns: namespace handle for Linux netns files and FreeBSD jails - #7

Merged
ahze merged 1 commit into
mainfrom
feat/netns-handle
Nov 12, 2026
Merged

ahze merged 1 commit into
mainfrom
feat/netns-handle

Conversation

@ahze

@ahze ahze commented Nov 12, 2026

Copy link
Copy Markdown
Member

Introduce network::netns with a Netns type and a NetnsRef borrow. On
Linux they are File and BorrowedFd, so the Linux code keeps its types
and setns behavior. On FreeBSD a namespace is the VNET jail named by the
netns path: Netns::open looks the jid up with jail_get, and because a
process cannot leave a jail, work inside it runs in a forked child. A
netlink socket for the jail is created in such a child and handed back
over SCM_RIGHTS; the kernel serves netlink requests in the vnet the
socket was created in.

DriverInfo, the netlink CreateLinkOptions and set_link_ns take NetnsRef.
The exec_netns macro keeps its Linux definition and gets a FreeBSD one
that runs the block in the jail. Moving a link into a jail and creating
a link inside one return "not supported yet" on FreeBSD; that is the
SIOCSIFVNET ioctl, which comes with the bridge driver.

The connection tester and the netlink unit tests need Linux namespaces
and are gated to Linux.

The netns validation looks the jail up on FreeBSD instead of opening a
file, and the FreeBSD socket accepts EISCONN from connect: the kernel
marks a netlink socket connected as soon as it is bound.

Introduce network::netns with a Netns type and a NetnsRef borrow. On
Linux they are File and BorrowedFd, so the Linux code keeps its types
and setns behavior. On FreeBSD a namespace is the VNET jail named by the
netns path: Netns::open looks the jid up with jail_get, and because a
process cannot leave a jail, work inside it runs in a forked child. A
netlink socket for the jail is created in such a child and handed back
over SCM_RIGHTS; the kernel serves netlink requests in the vnet the
socket was created in.

DriverInfo, the netlink CreateLinkOptions and set_link_ns take NetnsRef.
The exec_netns macro keeps its Linux definition and gets a FreeBSD one
that runs the block in the jail. Moving a link into a jail and creating
a link inside one return "not supported yet" on FreeBSD; that is the
SIOCSIFVNET ioctl, which comes with the bridge driver.

The connection tester and the netlink unit tests need Linux namespaces
and are gated to Linux.

The netns validation looks the jail up on FreeBSD instead of opening a
file, and the FreeBSD socket accepts EISCONN from connect: the kernel
marks a netlink socket connected as soon as it is bound.

Signed-off-by: Michael Johnson <buhnux@gmail.com>
@ahze
ahze merged commit 9767d4e into main Nov 12, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant