- Closes#457.
- A container can now declare additional DNS names for
a network attachment with a repeatable `alias` property
on `--network`, including subtree aliases that match
every name below a domain.
- With the default domain `test`, this container answers
to `gateway.test` by its name, to `api.test` by the exact
alias, and to `web.gateway.test`, `a.b.gateway.test`
and every other name below `gateway.test` by the
subtree alias. The motivating case is a gateway container
in front of a local Kubernetes cluster that answers for
`*.gateway.test`, with an ingress controller routing on
the `Host` header.
- An alias is an exact name, or a name with a leading
dot that matches every name below it. A name without
a dot gets the default domain, as container names do.
A subtree alias must be below a name the same
attachment owns, and exact names are unique across
all containers, so a container cannot claim another
container's namespace. The rules for one attachment
are checked when a container is created, again when
a stored container starts, and again by the network
helper when it registers the aliases. See
`docs/architecture/dns.md` for the design, the
invariants and the security considerations.
- Part of #1404.
- Updates containerization to 0.33.2.
- Reorganizes network plugin targets into:
- `ContainerNetworkClient` - network plugin client and default types
- `ContainerNetworkServer` - separate protocols for `Network` which
manages the underlying virtual network, `NetworkService`, which takes a
network and implements the API, and an actor `NetworkHarness` that
marshals between the API and the XPC protocol. The service-harness
separation will help us ensure XPC protocol compatibility in both
directions as we evolve the plugin APIs.
- Removes `disableAllocator()` which is no longer used since #1545
switched over to using XPC connections between runtime and network
plugin instances to track whether a network has attached containers.
J Logan