Network compartment not created until a container is started in the HCN namespace about windows-containers

[MikeZappa87]

Hello, is this in the context of Kubernetes (are you using the cri plugin of containerd) or outside of Kubernetes?

[rawahars]

Hi @MikeZappa87, No this is outside of Kubernetes environment.

In Kubernetes, I think pause container is started first in the HCN namespace and then the containers from the pod are launched.

[MikeZappa87]

Is it possible to make use of the cri-api (RunPodSandbox/CreateContainer)? This is common outside of the K8s space so you wouldn't be outside of the normal. It would satisfy creating the compartment, executing the cni plugin. I will check why creating a namespace doesn't show in the get-netcompartment.

How are you doing this? Via ctr?

[rawahars]

So unfortunately we have our own workflow which does not use the cri-api. Presently I was using the containerd SDK client to accomplish the workflow I mentioned earlier.

However, there is an easy test for this is just using New-HnsNamespace Powershell command to create an HCN namespace. If you check the compartments using Get-NetCompartment, it won't have any entry. Or if you use Get-HNSNamespace, then there won't be a CompartmentID associated with this HCN Namespace.

[MikeZappa87]

One item to note is:

"Start a container using containerd and pass the HCN namespace ID in the OCI spec options." Is that it probably won't do anything since https://github.com/containerd/containerd/blob/4d2c8879908285454a4006534cb0af82bb58a406/pkg/netns/netns_windows.go#L33

We don't pass anything to the create compartment.

[microsoft-github-policy-service]

This issue has been open for 30 days with no updates.
@MikeZappa87, please provide an update or close this issue.

[kestratt]

HNS will create the compartment during container creation. It is expected that the compartment isn't present yet.

[kestratt]

There is work currently being done to tie the lifetime of the network namespace and compartment to the pod itself. This feature is targeting Windows Server 2022.

[rawahars]

Thanks @MikeZappa87 and @kestratt for the information.

[microsoft-github-policy-service]

This issue has been open for 90 days with no updates.
@MikeZappa87, please provide an update or close this issue.