Problem removing netns

Problem removing netns

[Bjørnar Ness]

I am experimenting with netns (Linux precision 3.2.0-0.bpo.2-amd64 #1
SMP Sun Jun 3 21:40:57 UTC 2012 x86_64 GNU/Linux)
and have problems removing unused namespace, this is what I do:

ip netns add netns_one
ip netns add netns_two
ip link add name if_one type veth peer name if_one_peer
ip link add name if_two type veth peer name if_two_peer
ip link set dev if_one_peer netns netns_one
ip link set dev if_two_peer netns netns_two

ip netns exec netns_one bash

# in other terminal:

ip netns delete netns_two

# => Cannot remove /var/run/netns/netns_two: Device or resource busy

Is this expected  behaviour? If so, what is the correct process to
actually remove a namespace?

-- 
Bj(/)rnar

Re: Problem removing netns

[Eric W. Biederman]

Bjørnar Ness <bjornar.ness@gmail.com> writes:

> I am experimenting with netns (Linux precision 3.2.0-0.bpo.2-amd64 #1
> SMP Sun Jun 3 21:40:57 UTC 2012 x86_64 GNU/Linux)
> and have problems removing unused namespace, this is what I do:
>
> ip netns add netns_one
> ip netns add netns_two
> ip link add name if_one type veth peer name if_one_peer
> ip link add name if_two type veth peer name if_two_peer
> ip link set dev if_one_peer netns netns_one
> ip link set dev if_two_peer netns netns_two
>
> ip netns exec netns_one bash
>
> # in other terminal:
>
> ip netns delete netns_two
>
> # => Cannot remove /var/run/netns/netns_two: Device or resource busy
>
> Is this expected  behaviour? If so, what is the correct process to
> actually remove a namespace?

This is unintended but "correct" behavior.

The linux VFS won't let you remove an a file or directory that has
something mounted on it. 

Cloning the mount namespace creates a copy of all of the mounts.

With the result that your long running processe created with
ip netns exec (or anything else that clones the mount namespace)
will continue to hold a references to mounted that keesp the network
namespace alive.

In my usage patterns I haven't tripped over this.

Probably the simplest fix would be to take advantage of mount propogate
so that when we unmount the network namespace in one mount namespace it
get unmounted in all of them.  I don't expect I will be able to look at
implementing anything like that for a while, although it shouldn't take
much work to implement that.

Eric