Introduce netavark create command #1394

ashley-cui · 2026-01-27T13:39:27Z

The netavark create command is a new command that takes a partially filled out network config, and some options, via a json on stdin. The command will validate the network and fill out incompleted fields in the config. It then will return a complete network config json. The behavior is to match and replace https://github.com/containers/container-libs/blob/1e46b0756b39f76f287c64aa46c41107ad1110bb/common/libnetwork/netavark/config.go#L118

ashley-cui · 2026-01-27T13:43:54Z

Container libs part lives here as a draft, but the tests won't pass until this PR merges, unless there's another way to throw it at tests? The config tests are updated there and pass locally, but if there's good ideas for testing, I'm all ears.

TomSweeneyRedHat · 2026-01-28T16:17:03Z

@ashley-cui you have some test unhappiness

docs/netavark-create-input.md

docs/netavark.1.md

The netavark create command is a new command that takes a partially filled out network config, and some options, via a json on stdin. The command will validate the network and fill out incompleted fields in the config. It then will return a complete network config json. The behavior is to match and replace https://github.com/containers/container-libs/blob/1e46b0756b39f76f287c64aa46c41107ad1110bb/common/libnetwork/netavark/config.go#L118 Signed-off-by: Ashley Cui <acui@redhat.com>

packit-as-a-service · 2026-01-28T18:49:26Z

Ephemeral COPR build failed. @containers/packit-build please check.

ashley-cui · 2026-01-28T19:14:07Z

@containers/netavark-maintainers PTAL

TomSweeneyRedHat · 2026-01-28T20:01:26Z

LGTM
but I'd like at least one person with some serious rust chops to look at this.

Luap99

not a full review but some comments

I did not carefully check all the validation logic matches common but I guess we can run the common libnetwork unit tests with your new code to ensure we have proper coverage if you haven't done already

Luap99 · 2026-01-29T14:44:23Z

src/network/create_config/mod.rs

+    }
+}
+
+pub fn new_network(


I don't like to much logic in mod.rs files, just polutes my editor navigation if all the files are called mod.rs.

just move it into driver.rs IMO

Luap99 · 2026-01-29T14:51:16Z

src/network/create_config/driver.rs

+        "" => Ok(String::from("false")),
+        "1" => Ok(String::from("true")),
+        "0" => Ok(String::from("false")),
+        "strict" | "true" | "false" => Ok(ndr.to_string()),


that does not seem right here for routes?

In general with all these functions here I am a bit worried about duplication with the already existing parsing in, i.e. bridge.rs file in validation there.

I think this option parsing should likely be streamlined to have one proper function that can parse all options based on the driver and return it as a sane type? Like this I find it to messy if we parse things differently in two places.

Luap99 · 2026-01-29T14:56:49Z

src/network/create_config/driver.rs

+) -> NetavarkResult<()> {
+    // Find the plugin binary
+    let driver_name = &network.driver;
+    let plugin_path = if let Some(dirs) = plugin_directories {


this here can likely be shared with the other location where we lookup the plugin?

Luap99 · 2026-01-29T14:58:27Z

src/network/create_config/driver.rs

+    };
+
+    // Clone the network since we need to send it via JSON
+    let input = network.clone();


I am not sure why we would need to clone here

Luap99 · 2026-01-29T14:58:49Z

src/network/create_config/driver.rs

+    let mut child = Command::new(&plugin_path)
+        .arg("create")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::inherit())
+        .spawn()?;
+
+    let stdin = child.stdin.take().unwrap();
+    serde_json::to_writer(&stdin, &input)?;
+    // Close stdin here to avoid that the plugin waits forever for an EOF.
+    // And then we would wait for the child to exit which would cause a hang.
+    drop(stdin);
+
+    // Note: We need to buffer the output and then deserialize into the correct type after
+    // the plugin exits, since the plugin can return two different json types depending on
+    // the exit code.
+    let mut buffer: Vec<u8> = Vec::new();
+
+    let mut stdout = child.stdout.take().unwrap();
+    // Do not handle error here, we have to wait for the child first.
+    let result = stdout.read_to_end(&mut buffer);
+
+    let exit_status = wrap!(child.wait(), "wait for plugin to exit")?;
+    if let Some(rc) = exit_status.code() {
+        // make sure the buffer is correct
+        wrap!(result, "read into buffer")?;
+        if rc == 0 {
+            // read the modified network config
+            let updated_network: Network = serde_json::from_slice(&buffer)?;
+            // Update the network with the plugin's response
+            *network = updated_network;
+            Ok(())
+        } else {
+            // exit code not 0 => error
+            let err: JsonError = serde_json::from_slice(&buffer)?;
+            Err(NetavarkError::msg(format!(
+                "plugin {:?} failed with exit code {}, message: {}",
+                plugin_path.file_name().unwrap_or_default(),
+                rc,
+                err.error
+            )))
+        }
+    } else {
+        // If we could not get the exit code then the process was killed by a signal.
+        // I don't think it is necessary to read and return the signal so we just return a generic error.
+        Err(NetavarkError::msg(format!(
+            "plugin {:?} killed by signal",
+            plugin_path.file_name().unwrap_or_default()
+        )))
+    }
+}


this feels like copy pasted from the other location so this must be shared as well

Luap99 · 2026-01-29T15:02:17Z

src/network/create_config/driver.rs

+            match key.as_str() {
+                constants::OPTION_MODE => {
+                    if is_macvlan {
+                        if !constants::VALID_MACVLAN_MODES.contains(&value.as_str()) {


we already have get_macvlan_mode_from_string() so this new code is not needed, see prior comment about consolidating option parsing into once central place ideally

Luap99 · 2026-01-29T15:02:27Z

src/network/create_config/driver.rs

+                                value
+                            )));
+                        }
+                    } else if !constants::VALID_IPVLAN_MODES.contains(&value.as_str()) {


same here get_ipvlan_mode_from_string

Luap99 · 2026-01-29T15:05:21Z

Cargo.toml

 tower = { version = "0.5.3", features = ["util"] }
 hyper-util = "0.1.19"
+regex = "1.12.2"
+pnet = "0.35.0"


we already have our own netlink libs so we should not add more dependencies for this.

Luap99 · 2026-01-29T15:15:49Z

src/network/create_config/driver.rs

+    let prefix = default_interface_name
+        .as_deref()
+        .ok_or_else(|| NetavarkError::msg("default interface name is not set"))?;
+    let mut names: Vec<String> = datalink::interfaces()


we need a new function to get all interface names via our netlink lib, ideally similar to

fn getLinkNames() -> Option<Vec<String>> { let mut sock = netlink::Socket::<NetlinkRoute>::new().ok()?; let links = sock.dump_links(&mut vec![]).ok()?; let mut names = Vec::with_capacity(links.len()); for link in links { for attribute in link.attributes.into_iter() { if let LinkAttribute::IfName(name) = attribute { names.push(name); break; } } } Some(names) }

ashley-cui mentioned this pull request Jan 27, 2026

Use netavark create to fill out network config containers/container-libs#610

Draft

ashley-cui force-pushed the create branch from 05694c0 to 542f7ee Compare January 27, 2026 14:41

TomSweeneyRedHat reviewed Jan 28, 2026

View reviewed changes

docs/netavark-create-input.md Show resolved Hide resolved

TomSweeneyRedHat reviewed Jan 28, 2026

View reviewed changes

docs/netavark-create-input.md Outdated Show resolved Hide resolved

TomSweeneyRedHat reviewed Jan 28, 2026

View reviewed changes

docs/netavark.1.md Outdated Show resolved Hide resolved

TomSweeneyRedHat reviewed Jan 28, 2026

View reviewed changes

docs/netavark.1.md Outdated Show resolved Hide resolved

ashley-cui force-pushed the create branch from 542f7ee to ea6d595 Compare January 28, 2026 18:48

ashley-cui force-pushed the create branch from ea6d595 to 5047c27 Compare January 28, 2026 18:48

Luap99 reviewed Jan 29, 2026

View reviewed changes

Introduce netavark create command #1394

Are you sure you want to change the base?

Introduce netavark create command #1394

Uh oh!

Conversation

ashley-cui commented Jan 27, 2026

Uh oh!

ashley-cui commented Jan 27, 2026

Uh oh!

TomSweeneyRedHat commented Jan 28, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

packit-as-a-service bot commented Jan 28, 2026

Uh oh!

ashley-cui commented Jan 28, 2026

Uh oh!

TomSweeneyRedHat commented Jan 28, 2026

Uh oh!

Luap99 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants