<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
</head>
<body bgcolor="#ffffff" text="#000000">
A patch was applied to the kernel in November 2008 that deletes
virtual network interfaces when network namespaces are cleaned up
(d0c082cea6dfb9b674b4f6e1e84025662dbd24e8). A discussion about this
patch took place on the OpenVZ list (<a
class="moz-txt-link-freetext"
href="https://lists.linux-foundation.org/pipermail/containers/2008-October/013460.html">https://lists.linux-foundation.org/pipermail/containers/2008-October/013460.html</a>),
where Daniel Lezcano wrote:<br>
<pre>><i> After discussing with Benjamin, this patch means an user can no longer
</i>><i> manage a pool of virtual devices because they will be automatically
</i>><i> destroyed when the namespace exits. I don't think it is a big concern,
</i>><i> but just in case I am asking :)
</i></pre>
<br>
I currently have two use cases where this behavior is not desirable:<br>
<ol>
<li>I use a veth pair device to connect two containers together
(as opposed to connecting a container to the host). To do this,
I create the veth pair device manually in the host with iproute2
("ip link add type veth"). Then when I start each container, it
pulls in one of the interfaces of the veth pair device with
"lxc.network.type = phys". When I stop one of the containers,
its interface to the veth pair device is deleted instead of
moved back to the host, so I can not just start the stopped
container again and re-establish the same link.<br>
</li>
<li>I start a process in the host that creates a TUN/TAP
interface, such as a VPN client. I pull the TUN/TAP interface
into the container with "lxc.network.type = phys". When the
container exits, the TUN/TAP interface is deleted because it is
a virtual interface, while the VPN client process continues to
run in the host. Again I can not just start the container again
with the same connection; I have to restart the VPN client.<br>
</li>
</ol>
<br>
It makes sense that virtual network interfaces that get created
inside a container should be deleted when the container exits.
However, I feel that network interfaces from the host that get
assigned to the container should be returned to the host when the
container exits, whether they are physical or virtual.<br>
<br>
Can the kernel distinguish between network interfaces that were
created inside the namespace, and network interfaces that were moved
there?<br>
<br>
David<br>
<br>
P.S. should I send this message to the netdev list instead?<br>
</body>
</html>