compose: support multi-network

README.md

@@ -101,6 +101,7 @@ Minor:
 - Exporting Docker/OCI dual-format archives: `nerdctl save` .
 - Importing OCI archives as well as Docker archives: `nerdctl load` .
 - Specifying a non-image rootfs: `nerdctl run -it --rootfs <ROOTFS> /bin/sh` . The CLI syntax conforms to Podman convention.
+- Connecting a container to multiple networks at once: `nerdctl run --net foo --net bar`
 
 Trivial:
 - Inspecting raw OCI config: `nerdctl container inspect --mode=native` .
@@ -252,8 +253,9 @@ Basic flags:
   - Default: "missing"
 
 Network flags:
-- :whale: `--network=(bridge|host|none)`: Connect a container to a network
+- :whale: `--net, --network=(bridge|host|none|<CNI>)`: Connect a container to a network
   - Default: "bridge"
+  - :nerd_face: Unlike Docker, this flag can be specified multiple times (`--net foo --net bar`)
 - :whale: `-p, --publish`: Publish a container's port(s) to the host
 - :whale: `--dns`: Set custom DNS servers
 - :whale: `-h, --hostname`: Container host name

compose_up_test.go

@@ -146,3 +146,52 @@ COPY index.html /usr/share/nginx/html/index.html
 	t.Logf("respBody=%q", respBody)
 	assert.Assert(t, strings.Contains(string(respBody), indexHTML))
 }
+
+func TestComposeUpMultiNet(t *testing.T) {
+	base := testutil.NewBase(t)
+
+	var dockerComposeYAML = fmt.Sprintf(`
+version: '3.1'
+
+services:
+  svc0:
+    image: %s
+    networks:
+      - net0
+      - net1
+      - net2
+  svc1:
+    image: %s
+    networks:
+      - net0
+      - net1
+  svc2:
+    image: %s
+    networks:
+      - net2
+
+networks:
+  net0: {}
+  net1: {}
+  net2: {}
+`, testutil.NginxAlpineImage, testutil.NginxAlpineImage, testutil.NginxAlpineImage)
+	comp := testutil.NewComposeDir(t, dockerComposeYAML)
+	defer comp.CleanUp()
+
+	projectName := comp.ProjectName()
+	t.Logf("projectName=%q", projectName)
+
+	base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d").AssertOK()
+	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").Run()
+
+	svc0 := fmt.Sprintf("%s_svc0_1", projectName)
+	svc1 := fmt.Sprintf("%s_svc1_1", projectName)
+	svc2 := fmt.Sprintf("%s_svc2_1", projectName)
+
+	base.Cmd("exec", svc0, "ping", "-c", "1", "svc0").AssertOK()
+	base.Cmd("exec", svc0, "ping", "-c", "1", "svc1").AssertOK()
+	base.Cmd("exec", svc0, "ping", "-c", "1", "svc2").AssertOK()
+	base.Cmd("exec", svc1, "ping", "-c", "1", "svc0").AssertOK()
+	base.Cmd("exec", svc2, "ping", "-c", "1", "svc0").AssertOK()
+	base.Cmd("exec", svc1, "ping", "-c", "1", "svc2").AssertFail()
+}

docs/compose.md

@@ -39,9 +39,6 @@ which was derived from [Docker Compose file version 3 specification](https://doc
 #### `services.<SERVICE>.entrypoint`
 - Multiple entrypoint strings cannot be specified.
 
-#### `services.<SERVICE>.networks`
-- Multiple networks cannot be specified.
-
 #### `services.<SERVICE>.secrets`, `services.<SERVICE>.configs`
 - `uid`, `gid`: Cannot be specified. The default value is not propagated from `USER` instruction of Dockerfile.
   The file owner corresponds to the original file on the host.

pkg/composer/serviceparser/serviceparser.go

@@ -266,11 +266,6 @@ func getNetworks(project *compose.Project, svc compose.ServiceConfig) ([]string,
 		fullNames = append(fullNames, net.Name)
 	}
 
-	if len(fullNames) > 1 {
-		return nil, errors.Errorf("service %s: specifying multiple networks (%v) is not supported yet",
-			svc.Name, fullNames)
-	}
-
 	return fullNames, nil
 }
 

pkg/dnsutil/hostsstore/hostsstore.go

@@ -26,8 +26,8 @@ import (
 	"path/filepath"
 
 	"github.com/containerd/containerd/errdefs"
-	"github.com/containerd/go-cni"
 	"github.com/containerd/nerdctl/pkg/lockutil"
+	"github.com/containernetworking/cni/pkg/types/current"
 )
 
 const (
@@ -101,7 +101,7 @@ func NewStore(dataStore string) (Store, error) {
 type Meta struct {
 	Namespace string
 	ID        string
-	Networks  map[string]*cni.CNIResult
+	Networks  map[string]*current.Result
 	Hostname  string
 	Name      string
 }

pkg/dnsutil/hostsstore/updater.go

@@ -33,18 +33,20 @@ import (
 // newUpdater creates an updater for hostsD (/var/lib/nerdctl/<ADDRHASH>/etchosts)
 func newUpdater(hostsD string) *updater {
 	u := &updater{
-		hostsD:      hostsD,
-		metaByIPStr: make(map[string]*Meta),
-		metaByDir:   make(map[string]*Meta),
+		hostsD:        hostsD,
+		metaByIPStr:   make(map[string]*Meta),
+		nwNameByIPStr: make(map[string]string),
+		metaByDir:     make(map[string]*Meta),
 	}
 	return u
 }
 
 // updater is the struct for updater.update()
 type updater struct {
-	hostsD      string           // "/var/lib/nerdctl/<ADDRHASH>/etchosts"
-	metaByIPStr map[string]*Meta // key: IP string
-	metaByDir   map[string]*Meta // key: "/var/lib/nerdctl/<ADDRHASH>/etchosts/<NS>/<ID>"
+	hostsD        string            // "/var/lib/nerdctl/<ADDRHASH>/etchosts"
+	metaByIPStr   map[string]*Meta  // key: IP string
+	nwNameByIPStr map[string]string // key: IP string, value: key of Meta.Networks
+	metaByDir     map[string]*Meta  // key: "/var/lib/nerdctl/<ADDRHASH>/etchosts/<NS>/<ID>"
 }
 
 // update updates the hostsD tree.
@@ -79,15 +81,15 @@ func (u *updater) phase1() error {
 			return err
 		}
 		u.metaByDir[filepath.Dir(path)] = &meta
-		for _, cniRes := range meta.Networks {
-			for _, cfg := range cniRes.Interfaces {
-				for _, ipCfg := range cfg.IPConfigs {
-					if ip := ipCfg.IP; ip != nil {
-						if ip.IsLoopback() || ip.IsUnspecified() {
-							continue
-						}
-						u.metaByIPStr[ip.String()] = &meta
+		for nwName, cniRes := range meta.Networks {
+			for _, ipCfg := range cniRes.IPs {
+				if ip := ipCfg.Address.IP; ip != nil {
+					if ip.IsLoopback() || ip.IsUnspecified() {
+						continue
 					}
+					ipStr := ip.String()
+					u.metaByIPStr[ipStr] = &meta
+					u.nwNameByIPStr[ipStr] = nwName
 				}
 			}
 		}
@@ -129,8 +131,9 @@ func (u *updater) phase2() error {
 		buf.WriteString("127.0.0.1	localhost localhost.localdomain\n")
 		buf.WriteString(":1		localhost localhost.localdomain\n")
 		// TODO: cut off entries for the containers in other networks
-		for ip, meta := range u.metaByIPStr {
-			if line := createLine(ip, meta, myNetworks); line != "" {
+		for ip, nwName := range u.nwNameByIPStr {
+			meta := u.metaByIPStr[ip]
+			if line := createLine(ip, nwName, meta, myNetworks); line != "" {
 				if _, err := buf.WriteString(line); err != nil {
 					return err
 				}
@@ -152,25 +155,22 @@ func (u *updater) phase2() error {
 // for `nerdctl --name=foo --hostname=bar --network=n0`.
 //
 // May return an empty string
-func createLine(ip string, meta *Meta, myNetworks map[string]struct{}) string {
+func createLine(thatIP, thatNetwork string, meta *Meta, myNetworks map[string]struct{}) string {
+	if _, ok := myNetworks[thatNetwork]; !ok {
+		// Do not add lines for other networks
+		return ""
+	}
 	baseHostnames := []string{meta.Hostname}
 	if meta.Name != "" {
 		baseHostnames = append(baseHostnames, meta.Name)
 	}
 
-	line := ip + "\t"
+	line := thatIP + "\t"
 	for _, baseHostname := range baseHostnames {
 		line += baseHostname + " "
-		for nwName := range meta.Networks {
-			if _, ok := myNetworks[nwName]; !ok {
-				// Do not add lines for other networks
-				return ""
-			}
-			if nwName == netutil.DefaultNetworkName {
-				// Do not add a entry like "foo.bridge"
-				continue
-			}
-			line += baseHostname + "." + nwName + " "
+		if thatNetwork != netutil.DefaultNetworkName {
+			// Do not add a entry like "foo.bridge"
+			line += baseHostname + "." + thatNetwork + " "
 		}
 	}
 	line = strings.TrimSpace(line) + "\n"

pkg/dnsutil/hostsstore/updater_test.go

@@ -20,7 +20,7 @@ import (
 	"net"
 	"testing"
 
-	"github.com/containerd/go-cni"
+	"github.com/containernetworking/cni/pkg/types/current"
 	"gotest.tools/v3/assert"
 )
 
@@ -75,15 +75,16 @@ func TestCreateLine(t *testing.T) {
 		thatMeta := &Meta{
 			Namespace: "default",
 			ID:        "984d63ce45ae",
-			Networks: map[string]*cni.CNIResult{
+			Networks: map[string]*current.Result{
 				tc.thatNetwork: {
-					Interfaces: map[string]*cni.Config{
-						"eth0": {
-							IPConfigs: []*cni.IPConfig{
-								{
-									IP: net.ParseIP(tc.thatIP),
-								},
-							},
+					Interfaces: []*current.Interface{
+						{
+							Name: "eth0",
+						},
+					},
+					IPs: []*current.IPConfig{
+						{
+							Address: net.IPNet{IP: net.ParseIP(tc.thatIP)},
 						},
 					},
 				},
@@ -95,7 +96,7 @@ func TestCreateLine(t *testing.T) {
 		myNetworks := map[string]struct{}{
 			tc.myNetwork: {},
 		}
-		line := createLine(tc.thatIP, thatMeta, myNetworks)
+		line := createLine(tc.thatIP, tc.thatNetwork, thatMeta, myNetworks)
 		t.Logf("tc=%+v, line=%q", tc, line)
 		assert.Equal(t, tc.expected, line)
 	}

pkg/netutil/nettype/nettype.go

@@ -0,0 +1,55 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package nettype
+
+import "github.com/pkg/errors"
+
+type Type int
+
+const (
+	Invalid Type = iota
+	None
+	Host
+	CNI
+)
+
+func Detect(names []string) (Type, error) {
+	var res Type
+
+	for _, name := range names {
+		var tmp Type
+		switch name {
+		case "none":
+			tmp = None
+		case "host":
+			tmp = Host
+		default:
+			tmp = CNI
+		}
+		if res != Invalid && res != tmp {
+			return Invalid, errors.Errorf("mixed network types: %v and %v", res, tmp)
+		}
+		res = tmp
+	}
+
+	// defaults to CNI
+	if res == Invalid {
+		res = CNI
+	}
+
+	return res, nil
+}

pkg/netutil/nettype/nettype_test.go

@@ -0,0 +1,79 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package nettype
+
+import (
+	"testing"
+
+	"gotest.tools/v3/assert"
+)
+
+func TestDetect(t *testing.T) {
+	type testCase struct {
+		names    []string
+		expected Type
+		err      string
+	}
+	testCases := []testCase{
+		{
+			names:    nil,
+			expected: CNI,
+		},
+		{
+			names:    []string{"none"},
+			expected: None,
+		},
+		{
+			names:    []string{"host"},
+			expected: Host,
+		},
+		{
+			names:    []string{"bridge"},
+			expected: CNI,
+		},
+		{
+			names:    []string{"foo", "bar"},
+			expected: CNI,
+		},
+		{
+			names:    []string{"foo", "bar", "bridge"},
+			expected: CNI,
+		},
+		{
+			names: []string{"none", "host"},
+			err:   "mixed network types",
+		},
+		{
+			names: []string{"none", "bridge"},
+			err:   "mixed network types",
+		},
+		{
+			names: []string{"host", "foo"},
+			err:   "mixed network types",
+		},
+	}
+
+	for _, tc := range testCases {
+		got, err := Detect(tc.names)
+		if tc.err == "" {
+			assert.NilError(t, err)
+			assert.Equal(t, tc.expected, got)
+		} else {
+			assert.ErrorContains(t, err, tc.err)
+		}
+	}
+}