diff options
| -rw-r--r-- | debian-container/README | 5 | ||||
| -rwxr-xr-x | debian-container/debian-container.sh | 4 | ||||
| -rw-r--r-- | debian-container/lib/common.sh | 2 | ||||
| -rw-r--r-- | debian-container/lib/network.sh | 73 |
4 files changed, 83 insertions, 1 deletions
diff --git a/debian-container/README b/debian-container/README index 0328def..eceb2b3 100644 --- a/debian-container/README +++ b/debian-container/README @@ -55,6 +55,11 @@ sudo ./debian-container.sh enter test-1 --mount /home/richard/data:/data:ro sudo ./debian-container.sh exec test-1 -- uname -a sudo ./debian-container.sh exec test-1 --network host -- apt-get update sudo ./debian-container.sh exec test-1 --network nat -- apt-get update + +查看和清理 NAT 网络资源： + +sudo ./debian-container.sh network-status +sudo ./debian-container.sh network-clean sudo ./debian-container.sh exec test-1 --mount /home/richard/project:/workspace:rw -- make -C /workspace 列出和查看容器： diff --git a/debian-container/debian-container.sh b/debian-container/debian-container.sh index da7a4f2..288a6e8 100755 --- a/debian-container/debian-container.sh +++ b/debian-container/debian-container.sh @@ -31,7 +31,7 @@ esac dc_require_root case "$DC_ACTION" in - base-create|init|enter|exec|resize|delete) + base-create|init|enter|exec|resize|delete|network-clean) # 防止多个会话同时读写同一 ext4 镜像。 dc_acquire_lock ;; @@ -53,6 +53,8 @@ esac case "$DC_ACTION" in base-create) dc_base_create "$@" ;; base-info) dc_manifest_info "$@" ;; + network-status) dc_network_status ;; + network-clean) dc_network_clean ;; init) dc_init "$@" ;; _init) dc_init_rootfs "$@" ;; enter) dc_enter "$@" ;; diff --git a/debian-container/lib/common.sh b/debian-container/lib/common.sh index 075cd15..f829f11 100644 --- a/debian-container/lib/common.sh +++ b/debian-container/lib/common.sh @@ -51,6 +51,8 @@ dc_usage() { 命令： base-create [选项] 下载一次并创建 debootstrap 软件包 tarball base-info TAR 查看基础 tarball 的 manifest + network-status 查看 NAT 网络资源 + network-clean 清理 NAT 残留资源 init NAME [选项] 创建指定名称的容器镜像 enter NAME [选项] 进入指定容器 exec NAME [选项] 在指定容器中执行命令 diff --git a/debian-container/lib/network.sh b/debian-container/lib/network.sh index a5a31dd..efe0d47 100644 --- a/debian-container/lib/network.sh +++ b/debian-container/lib/network.sh @@ -100,3 +100,76 @@ dc_network_nat_run() { unshare --mount --uts --ipc --pid --fork --propagation private -- \ bash "$DC_SCRIPT" "$child_action" "$DC_INSTANCE" "$@" } + +dc_network_nat_namespaces() { + ip netns list | awk '$1 ~ /^rutils-/ { print $1 }' +} + +dc_network_status() { + local namespace + local link + + dc_require_commands awk ip nft + echo "网桥：$DC_NAT_BRIDGE" + if ip link show "$DC_NAT_BRIDGE" >/dev/null 2>&1; then + ip -brief addr show dev "$DC_NAT_BRIDGE" + else + echo '状态：不存在' + fi + + echo 'network namespace：' + while read -r namespace; do + [[ -n "$namespace" ]] || continue + echo " $namespace" + ip netns pids "$namespace" | awk '{ print " pid: " $0 }' + done < <(dc_network_nat_namespaces) + + echo 'veth：' + while read -r link; do + [[ -n "$link" ]] || continue + echo " $link" + done < <(ip -o link show | awk -F': ' '$2 ~ /^rvh[0-9]+@/ { sub(/@.*/, "", $2); print $2 }') + + echo 'nftables：' + if nft list table ip rutils_nat >/dev/null 2>&1; then + nft list table ip rutils_nat + else + echo ' rutils_nat 不存在' + fi +} + +dc_network_clean() { + local namespace + local link + local active=0 + + dc_require_commands awk ip nft + while read -r namespace; do + [[ -n "$namespace" ]] || continue + if [[ -n "$(ip netns pids "$namespace")" ]]; then + echo "保留活动 namespace：$namespace" + active=1 + else + ip netns delete "$namespace" + echo "已删除 namespace：$namespace" + fi + done < <(dc_network_nat_namespaces) + + if ((active == 0)); then + while read -r link; do + [[ -n "$link" ]] || continue + ip link delete "$link" 2>/dev/null || true + echo "已删除 veth：$link" + done < <(ip -o link show | awk -F': ' '$2 ~ /^rvh[0-9]+@/ { sub(/@.*/, "", $2); print $2 }') + + nft delete table ip rutils_nat 2>/dev/null || true + if ip link show "$DC_NAT_BRIDGE" >/dev/null 2>&1; then + ip link set "$DC_NAT_BRIDGE" down + ip link delete "$DC_NAT_BRIDGE" type bridge + fi + echo '已清理 NAT 网桥和 nftables 规则。' + else + echo '存在活动 namespace，保留 veth。' + echo '存在活动 namespace，保留 NAT 网桥和 nftables 规则。' + fi +} |