Networking connection management based on container identification
Described herein are systems, methods, and software to enhance packet . In one implementation, a host computing element identifies a packet from a process executing on the host computing element. In response to identifying the packet, the host computing element determines whether the packet originates from a container namespace corresponding to a container on the host computing element or a host namespace corresponding to the host computing element. If the packet originates from a container namespace, the host computing element may determine supplemental information for the container associated with the container namespace, and process the packet based on the supplemental information.
1. A method of processing packets in a host computing element, the method comprising:
identifying, in a kernel of the host computing element, a packet for communication to a second computing element;
determining whether the packet originates from a container namespace corresponding to a container on the host computing element or a host namespace corresponding to the host computing element based on process identification numbers (PIDs) associated with an originating process for the packet;
when the packet originates from a container namespace, determining supplemental information for a container associated with the container namespace, wherein the supplemental information comprises a container type, a container identifier, or an absolute binary path to the originating process in the container; and
processing the packet in the kernel of the host computing element based on the supplemental information.
2. The method of claim 1 , wherein determining whether the packet originates from a container namespace corresponding to a container on the host computing element or a host namespace corresponding to the host computing element based on the PIDs associated the originating process for the packet comprises:
identifying a PID for a local namespace of the packet;
identifying a PID for a global namespace of the packet; and
determining whether the packet originates from a container namespace corresponding to a container on the host computing element or a host namespace corresponding to the host computing element based on whether the PID for the local namespace matches the PID for the global namespace.
3. The method of claim 1 , wherein the host computing element comprises a virtual machine executing on a host computing system.
4. The method of claim 1 , wherein the second computing element comprises a second container.
5. The method of claim 1 further comprising identifying whether the packet comprises a connection establishment packet, and wherein determining whether the packet originates from a container namespace corresponding to a container on the host computing element or a host namespace corresponding to the host computing element occurs in response to identifying that the packet comprises a connection establishment packet.
6. The method of claim 1 , wherein the connection establishment packet comprises an acknowledgment packet or a synchronization packet.
7. A computing apparatus comprising:
one or more non-transitory computer readable storage media;
a processing system operatively coupled to the one or more non-transitory computer readable storage media; and
program instructions stored on the one or more computer readable storage media to process packets in a host computing element that, when read and executed by the processing system, direct the processing system to at least:
identify, in a kernel of the host computing element, a packet for communication to a second computing element;
determine whether the packet originates from a container namespace corresponding to a container on the host computing element or a host namespace corresponding to the host computing element based on process identification numbers (PIDs) associated with an originating process for the packet;
when the packet originates from a container namespace, determining supplemental information for a container associated with the container namespace, wherein the supplemental information comprises a container type, a container identifier, or an absolute binary path to the originating process in the container; and
process the packet in the kernel of the host computing element based on the supplemental information.
8. The computing apparatus of claim 7 , wherein determining whether the packet originates from a container namespace corresponding to a container on the host computing element or a host namespace corresponding to the host computing element comprises:
identifying a PID for a local namespace of the packet;
identifying a PID for a global namespace of the packet; and
determining whether the packet originates from a container namespace corresponding to a container on the host computing element or a host namespace corresponding to the host computing element based on whether the PID for the local namespace matches the PID for the global namespace.
9. The computing apparatus of claim 7 , wherein the host computing element comprises a virtual machine.
10. The computing apparatus of claim 7 , wherein the second computing element comprises a second container.
11. The computing apparatus of claim 7 , wherein the program instructions further direct the processing system to identify whether the packet comprises a connection establishment packet, and wherein determining whether the packet originates from a container namespace corresponding to a container on the host computing element or a host namespace corresponding to the host computing element occurs in response to identifying that the packet comprises a connection establishment packet.
12. The computing apparatus of claim 11 , wherein the connection establishment packet comprises a Transmission Control Protocol (TCP) acknowledgment packet or synchronization packet.
13. An apparatus comprising:
one or more non-transitory computer readable storage media; and
program instructions stored on the one or more computer readable storage media to process packets in a host virtual machine that, when read and executed by a processing system, direct the processing system to at least:
identify, in a kernel of the host virtual machine, a packet for communication to a destination computing element;
identify a process identification number (PID) for a local namespace of the packet;
identify a PID for a global namespace of the packet;
determine whether the packet originates from a container namespace corresponding to a container on the host virtual machine or a host namespace corresponding to the host virtual machine based on whether the PID for the local namespace matches the PID for the global namespace;
if the packet originates from a container namespace, determining supplemental information for a container associated with the container namespace, wherein the supplemental information comprises a container type, a container identifier, or an absolute binary path to the originating process in the container; and
process the packet in the kernel of the host virtual machine based on the supplemental information.
14. The apparatus of claim 13 , wherein the program instructions further direct the processing system to identify whether the packet comprises a connection establishment packet, and wherein determining whether the packet originates from a container namespace corresponding to a container on the host virtual machine or a host namespace corresponding to the host virtual machine occurs in response to identifying that the packet comprises a connection establishment packet.