[iproute PATCHv2 0/2] Netns performance improvements

[iproute PATCHv2 0/2] Netns performance improvements

[Phil Sutter]

Stress-testing OpenStack Neutron revealed poor performance of 'ip netns'
when dealing with a high amount of namespaces. The cause of this lies in
the combination of how iproute2 mounts NETNS_RUN_DIR and the netns files
therein and the fact that systemd makes all mount points of the system
shared.

Changes since v1:
- Added Suggested-by tag to patches.

Phil Sutter (2):
  ipnetns: Move NETNS_RUN_DIR into it's own propagation group
  ipnetns: Make netns mount points private

 ip/ipnetns.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

-- 
2.8.2

[iproute PATCHv2 1/2] ipnetns: Move NETNS_RUN_DIR into it's own propagation group

[Phil Sutter]

On systems where the parent mount point is shared, NETNS_RUN_DIR
inherits the parent's propagation group. This leads to netns mount
points being propagated to the parent and thus showing up twice in the
output of 'mount'.

By making the newly mounted NETNS_RUN_DIR private first, then shared
again, it will move to it's own propagation group which will still allow
for netns mounts to propagate between mount namespaces but gets rid of
the double netns entry at the same time.

Suggested-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 ip/ipnetns.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/ip/ipnetns.c b/ip/ipnetns.c
index b3ee23c23aaa2..1cefe73c68bfc 100644
--- a/ip/ipnetns.c
+++ b/ip/ipnetns.c
@@ -650,6 +650,11 @@ static int netns_add(int argc, char **argv)
 				NETNS_RUN_DIR, NETNS_RUN_DIR, strerror(errno));
 			return -1;
 		}
+		if (mount("", NETNS_RUN_DIR, "none", MS_PRIVATE, NULL)) {
+			fprintf(stderr, "mount --make-private %s failed: %s\n",
+				NETNS_RUN_DIR, strerror(errno));
+			return -1;
+		}
 		made_netns_run_dir_mount = 1;
 	}
 
-- 
2.8.2

[iproute PATCHv2 2/2] ipnetns: Make netns mount points private

[Phil Sutter]

On systems with a shared /proc mount point, the netns mounts inherit
that propagation group and therefore cause unnecessary overhead upon
netns deletion.

In order to achieve this, the MS_REC flag when making NETNS_RUN_DIR
shared has to be removed as well or otherwise it will make existing
netns mount points shared again.

Suggested-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 ip/ipnetns.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/ip/ipnetns.c b/ip/ipnetns.c
index 1cefe73c68bfc..acaedd5894e6c 100644
--- a/ip/ipnetns.c
+++ b/ip/ipnetns.c
@@ -636,7 +636,7 @@ static int netns_add(int argc, char **argv)
 	 * file in all namespaces allowing the network namespace to be freed
 	 * sooner.
 	 */
-	while (mount("", NETNS_RUN_DIR, "none", MS_SHARED | MS_REC, NULL)) {
+	while (mount("", NETNS_RUN_DIR, "none", MS_SHARED, NULL)) {
 		/* Fail unless we need to make the mount point */
 		if (errno != EINVAL || made_netns_run_dir_mount) {
 			fprintf(stderr, "mount --make-shared %s failed: %s\n",
@@ -678,6 +678,11 @@ static int netns_add(int argc, char **argv)
 			netns_path, strerror(errno));
 		goto out_delete;
 	}
+	if (mount("", netns_path, "none", MS_PRIVATE, NULL)) {
+		fprintf(stderr, "mount --make-private %s failed: %s\n",
+			netns_path, strerror(errno));
+		return -1;
+	}
 	return 0;
 out_delete:
 	netns_delete(argc, argv);
-- 
2.8.2

Re: [iproute PATCHv2 0/2] Netns performance improvements

[Stephen Hemminger]

On Tue,  5 Jul 2016 16:51:18 +0200
Phil Sutter <phil@nwl.cc> wrote:

> Stress-testing OpenStack Neutron revealed poor performance of 'ip netns'
> when dealing with a high amount of namespaces. The cause of this lies in
> the combination of how iproute2 mounts NETNS_RUN_DIR and the netns files
> therein and the fact that systemd makes all mount points of the system
> shared.
> 
> Changes since v1:
> - Added Suggested-by tag to patches.
> 
> Phil Sutter (2):
>   ipnetns: Move NETNS_RUN_DIR into it's own propagation group
>   ipnetns: Make netns mount points private
> 
>  ip/ipnetns.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
> 

I want an ack for Eric on this, it seems a little risky

Re: [iproute PATCHv2 0/2] Netns performance improvements

[Eric W. Biederman]

Stephen Hemminger <stephen@networkplumber.org> writes:

> On Tue,  5 Jul 2016 16:51:18 +0200
> Phil Sutter <phil@nwl.cc> wrote:
>
>> Stress-testing OpenStack Neutron revealed poor performance of 'ip netns'
>> when dealing with a high amount of namespaces. The cause of this lies in
>> the combination of how iproute2 mounts NETNS_RUN_DIR and the netns files
>> therein and the fact that systemd makes all mount points of the system
>> shared.
>> 
>> Changes since v1:
>> - Added Suggested-by tag to patches.
>> 
>> Phil Sutter (2):
>>   ipnetns: Move NETNS_RUN_DIR into it's own propagation group
>>   ipnetns: Make netns mount points private
>> 
>>  ip/ipnetns.c | 12 +++++++++++-
>>  1 file changed, 11 insertions(+), 1 deletion(-)
>> 
>
> I want an ack for Eric on this, it seems a little risky

If I have read the tea leaves properly the first patch is fighting
a system configuration of "mount --rbind /run /var/run" which seems
inappropriate.  A symlink is likely a better fix.

The effect of the second patch is probably better had by performing the
optimization in the kernel, so everyone gets the benefit.

I am persuadable to change this behavior.  But if all we are doing is
optimization and not intentionally changing the semantics there appear
to be better places for the optimizations to happen.

Eric