mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Kevin KrakauerandgVisor bot
93d86e9acc
The existing redirect mode uses XDP to maximize performance but is not suitably secure: packets are copied directly from the driver into a userspace buffer (UMEM). But because the UMEM is shared among all processes with a socket open on a particular NIC queue, sandboxes using redirect mode all map the same UMEM and thus can read each other's packets. Tunnel mode instead installs an eBPF program that copies packets from the host's NIC driver into a per-sandbox NIC driver. This incurs an additional copy, but there is no longer memory shared between sandboxes. Benchmarking tunnel mode with redis-benchmark shows a performance gain over standard Docker networking of 20%. Redirect mode showed a 30% improvement. PiperOrigin-RevId: 595746162
43 lines
1.3 KiB
Go
43 lines
1.3 KiB
Go
// Copyright 2022 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
//go:build amd64 || arm64
|
|
// +build amd64 arm64
|
|
|
|
// The xdp_loader tool is used to load compiled XDP object files into the XDP
|
|
// hook of a net device. It is intended primarily for testing.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
_ "embed"
|
|
"os"
|
|
|
|
"github.com/google/subcommands"
|
|
"gvisor.dev/gvisor/runsc/flag"
|
|
"gvisor.dev/gvisor/tools/xdp/cmd"
|
|
)
|
|
|
|
func main() {
|
|
subcommands.Register(new(cmd.DropCommand), "")
|
|
subcommands.Register(new(cmd.PassCommand), "")
|
|
subcommands.Register(new(cmd.RedirectHostCommand), "")
|
|
subcommands.Register(new(cmd.TcpdumpCommand), "")
|
|
subcommands.Register(new(cmd.TunnelCommand), "")
|
|
|
|
flag.Parse()
|
|
ctx := context.Background()
|
|
os.Exit(int(subcommands.Execute(ctx)))
|
|
}
|