Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 0c60a0e

Browse files
robmryrobmry
authored
Merge pull request moby#50467 from robmry/no_nftables_in_swarm
No nftables in swarm
2 parents e1281f0 + 090c319 commit 0c60a0e

File tree

6 files changed

+50
-7
lines changed

6 files changed

+50
-7
lines changed

‎daemon/config/config_linux.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,11 @@ func (conf *Config) IsSwarmCompatible() error {
126126
if conf.LiveRestoreEnabled {
127127
return errors.New("--live-restore daemon configuration is incompatible with swarm mode")
128128
}
129+
// Swarm has not yet been updated to use nftables. But, if "iptables" is disabled, it
130+
// doesn't add rules anyway.
131+
if conf.FirewallBackend == "nftables" && conf.EnableIPTables {
132+
return errors.New("--firewall-backend=nftables is incompatible with swarm mode")
133+
}
129134
return nil
130135
}
131136

‎integration/daemon/daemon_linux_test.go‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"github.com/docker/docker/testutil"
1313
"github.com/docker/docker/testutil/daemon"
1414
"github.com/moby/moby/api/types/network"
15+
swarmtypes "github.com/moby/moby/api/types/swarm"
1516
"github.com/vishvananda/netlink"
1617
"gotest.tools/v3/assert"
1718
is "gotest.tools/v3/assert/cmp"
@@ -494,3 +495,31 @@ func createBridge(t *testing.T, ifName string, addrs []string) net.IP {
494495
}
495496
return llAddr
496497
}
498+
499+
// TestSwarmNoNftables checks that, because swarm does not yet have nftables support,
500+
// it's not possible to:
501+
// - enable Swarm when nftables is enabled, or to
502+
// - restart an already Swarm enabled daemon with nftables enabled as well.
503+
func TestSwarmNoNftables(t *testing.T) {
504+
ctx := testutil.StartSpan(baseContext, t)
505+
skip.If(t, testEnv.IsRemoteDaemon)
506+
skip.If(t, testEnv.IsRootless, "rootless mode doesn't support Swarm-mode")
507+
508+
t.Run("start", func(t *testing.T) {
509+
d := daemon.New(t)
510+
d.Start(t, "--firewall-backend=nftables")
511+
defer d.Stop(t)
512+
err := d.SwarmInitWithError(ctx, t, swarmtypes.InitRequest{AdvertiseAddr: "127.0.0.1:2377"})
513+
assert.Check(t, is.ErrorContains(err, "--firewall-backend=nftables is incompatible with swarm mode"))
514+
})
515+
516+
t.Run("restart", func(t *testing.T) {
517+
d := daemon.New(t)
518+
d.Start(t, "--firewall-backend=iptables")
519+
defer d.Stop(t)
520+
d.SwarmInit(ctx, t, swarmtypes.InitRequest{AdvertiseAddr: "127.0.0.1:2377"})
521+
522+
err := d.RestartWithError("--firewall-backend=nftables")
523+
assert.Check(t, is.ErrorContains(err, "daemon exited during startup"))
524+
})
525+
}

‎integration/network/overlay/overlay_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ func TestHostPortMappings(t *testing.T) {
6565
ctx := setupTest(t)
6666

6767
d := daemon.New(t)
68-
d.StartWithBusybox(ctx, t)
68+
d.StartNodeWithBusybox(ctx, t)
6969
defer d.Stop(t)
7070

7171
d.SwarmInit(ctx, t, swarmtypes.InitRequest{AdvertiseAddr: "127.0.0.1:2377"})

‎integration/system/ping_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ func TestPingSwarmHeader(t *testing.T) {
6060

6161
ctx := setupTest(t)
6262
d := daemon.New(t)
63-
d.Start(t)
63+
d.StartNode(t)
6464
defer d.Stop(t)
6565
apiClient := d.NewClientT(t)
6666
defer apiClient.Close()

‎testutil/daemon/daemon.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -530,10 +530,10 @@ func (d *Daemon) StartWithLogFile(out *os.File, providedArgs ...string) error {
530530
d.args = append(d.args, "--storage-driver", d.storageDriver)
531531
}
532532

533-
hasFwBackendArg := !slices.ContainsFunc(providedArgs, func(s string) bool {
533+
hasFwBackendArg := slices.ContainsFunc(providedArgs, func(s string) bool {
534534
return strings.HasPrefix(s, "--firewall-backend")
535535
})
536-
if hasFwBackendArg {
536+
if !hasFwBackendArg {
537537
if fw := os.Getenv("DOCKER_FIREWALL_BACKEND"); fw != "" {
538538
d.args = append(d.args, "--firewall-backend="+fw)
539539
}

‎testutil/daemon/swarm.go‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -77,8 +77,8 @@ func (d *Daemon) NodeID() string {
7777
return d.CachedInfo.Swarm.NodeID
7878
}
7979

80-
// SwarmInit initializes a new swarm cluster.
81-
func (d *Daemon) SwarmInit(ctx context.Context, t testing.TB, req swarm.InitRequest) {
80+
// SwarmInitWithError initializes a new swarm cluster and returns an error.
81+
func (d *Daemon) SwarmInitWithError(ctx context.Context, t testing.TB, req swarm.InitRequest) error {
8282
t.Helper()
8383
if req.ListenAddr == "" {
8484
req.ListenAddr = fmt.Sprintf("%s:%d", d.swarmListenAddr, d.SwarmPort)
@@ -93,8 +93,17 @@ func (d *Daemon) SwarmInit(ctx context.Context, t testing.TB, req swarm.InitRequ
9393
cli := d.NewClientT(t)
9494
defer cli.Close()
9595
_, err := cli.SwarmInit(ctx, req)
96+
if err == nil {
97+
d.CachedInfo = d.Info(t)
98+
}
99+
return err
100+
}
101+
102+
// SwarmInit initializes a new swarm cluster.
103+
func (d *Daemon) SwarmInit(ctx context.Context, t testing.TB, req swarm.InitRequest) {
104+
t.Helper()
105+
err := d.SwarmInitWithError(ctx, t, req)
96106
assert.NilError(t, err, "initializing swarm")
97-
d.CachedInfo = d.Info(t)
98107
}
99108

100109
// SwarmJoin joins a daemon to an existing cluster.

0 commit comments

Comments
 (0)