Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

StaticNetwork.NetworkSetup() leaks a duplicate iptables NAT rule on every container restart in the Knative user-container path

オープン
  • 何か問題がありますか？
#992 コメント 2 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@magic-peach がすでに取り組んでいます。

2026年9月3日 から。

  • #1024 @magic-peach による — オープン

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
54/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
go, kubernetes
領域
networking

調査の方向性

pkg/network/network_static.go、特に setNATRule() と StaticNetwork.NetworkSetup() を読み、次に pkg/unikontainers/unikontainers.go の getNetworkType() と Kill() を調べてください。提案されている冪等なセットアップとクリーンアップのアプローチを比較してください。繰り返し行われる user-container の再起動によって、永続ネットワーク名前空間に重複した NAT ルールが残らなくなれば完了です。

索引モデルが issue の本文から書いたものです。

説明

bug K8s/Tools

While reviewing pkg/network/network_static.go I noticed that setNATRule() (lines 35-89) always runs iptables -t nat -A POSTROUTING -s -o -j MASQUERADE, and never checks whether an identical rule already exists before appending it. I searched the whole repository for "iptables" and this file is the only place it shows up, so there is no matching delete call anywhere else in the codebase either.

This function is called from StaticNetwork.NetworkSetup() (same file, line 103), which is only used when getNetworkType() (pkg/unikontainers/unikontainers.go, around line 1419) detects the Knative annotation io.kubernetes.cri.container-name equal to user-container.

The problem is that Kill() (pkg/unikontainers/unikontainers.go, lines 807-838) does clean up the TAP device through network.CleanupAllUruncTaps(), but it never touches iptables or removes the NAT rule that was added on setup. In Kubernetes, when a container inside a pod restarts because of a crash or a failed liveness probe, the pod's network namespace is not recreated, only the container is. So every restart calls NetworkSetup() again, which calls setNATRule() again, which appends another identical rule to the same still-alive network namespace. Since StaticIPAddr is a fixed constant, the appended rule is byte-for-byte the same every time, so nothing ever gets deduplicated or removed. Over repeated restarts this leaves an unbounded number of duplicate NAT rules sitting in that namespace's iptables nat table.

There is already a precedent for this exact pattern of bug in this project. Issue #406 documented that the network namespace persists across container restarts in Kubernetes and that TAP devices used to leak because of it, before CleanupAllUruncTaps() was added to handle that specific resource on Kill(). The NAT rule added by the same NetworkSetup() call simply has no equivalent cleanup path, so the same underlying condition applies here but was never addressed for iptables.

I checked for duplicates by searching issues for setNATRule, NAT MASQUERADE leak, iptables, and user-container restart, and found nothing describing this. The closest related issue, #587, was about a different resource and was closed as not planned because the locking it worried about turned out to already be correct, so it does not cover this.

A fix could either make setNATRule idempotent by checking for the rule with iptables -C before appending with -A, or add a matching delete function that gets called from Kill() and Delete() the same way CleanupAllUruncTaps() already is.

This is not related to VM or sandbox isolation boundaries, it is a host network hygiene issue in the CNI setup helper, so a public issue seemed appropriate rather than private disclosure.

主要言語
Go
スター
307
フォーク
219
平均マージ
1日 19時間
マージ済み PR（30日）
32

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

urunc-dev/urunc のほかの issue

urunc-dev/urunc の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。