fix: Disable kernel networking in bridge mode (#656)

docker-compose.yml

@@ -5,12 +5,8 @@ services:
         image: vdsm/virtual-dsm:latest
         environment:
             DISK_SIZE: "16G"
-            RAM_SIZE: "1G"
-            CPU_CORES: "1"
         devices:
             - /dev/kvm
-        device_cgroup_rules:
-            - 'c *:* rwm'
         cap_add:
             - NET_ADMIN
         ports:

readme.md

@@ -11,7 +11,7 @@
 
 </div></h1>
 
-Virtual DSM in a docker container.
+Virtual DSM in a Docker container.
 
 ## Features
 
@@ -46,7 +46,7 @@ services:
 Via `docker run`
 
 ```bash
-docker run -it --rm -p 5000:5000 --device=/dev/kvm --cap-add NET_ADMIN --stop-timeout 120 vdsm/virtual-dsm
+docker run -it --rm --name dsm -p 5000:5000 --device=/dev/kvm --cap-add NET_ADMIN --stop-timeout 120 vdsm/virtual-dsm
 ```
 
 ## FAQ
@@ -194,6 +194,8 @@ docker run -it --rm -p 5000:5000 --device=/dev/kvm --cap-add NET_ADMIN --stop-ti
   ```yaml
   environment:
     DHCP: "Y"
+  devices:
+    - /dev/vhost-net
   device_cgroup_rules:
     - 'c *:* rwm'
   ```
@@ -232,7 +234,7 @@ docker run -it --rm -p 5000:5000 --device=/dev/kvm --cap-add NET_ADMIN --stop-ti
 
   Yes, this project contains only open-source code and does not distribute any copyrighted material. Neither does it try to circumvent any copyright protection measures. So under all applicable laws, this project would be considered legal. 
   
-  However, by installing Synology's Virtual DSM, you must accept their end-user license agreement, which does not permit installation on non-Synology hardware. So only run this project on an official Synology NAS, as any other use will be a violation of their terms and conditions.
+  However, by installing Synology's Virtual DSM, you must accept their end-user license agreement, which does not permit installation on non-Synology hardware. So only run this container on an official Synology NAS, as any other use will be a violation of their terms and conditions.
 
 ## Stars
 [![Stars](https://starchart.cc/vdsm/virtual-dsm.svg?variant=adaptive)](https://starchart.cc/vdsm/virtual-dsm)

src/check.sh

@@ -1,8 +1,11 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
+: "${NETWORK:="Y"}"
+
 [ -f "/run/shm/qemu.end" ] && echo "QEMU is shutting down.." && exit 1
 [ ! -f "/run/shm/qemu.pid" ] && echo "QEMU is not running yet.." && exit 0
+[[ "$NETWORK" != [Yy1]* ]] && echo "Networking is disabled.." && exit 0
 
 file="/run/shm/dsm.url"
 address="/run/shm/qemu.ip"

src/entry.sh

@@ -32,4 +32,5 @@ terminal
 tail -fn +0 "$QEMU_LOG" 2>/dev/null &
 cat "$QEMU_TERM" 2>/dev/null & wait $! || :
 
-sleep 1 && finish 0
+sleep 1 & wait $!
+finish 0

src/network.sh

@@ -5,6 +5,7 @@ set -Eeuo pipefail
 
 : "${MAC:=""}"
 : "${DHCP:="N"}"
+: "${NETWORK:="Y"}"
 
 : "${VM_NET_DEV:=""}"
 : "${VM_NET_TAP:="dsm"}"
@@ -23,8 +24,14 @@ ADD_ERR="Please add the following setting to your container:"
 
 configureDHCP() {
 
-  # Create a macvtap network for the VM guest
+  # Create the necessary file structure for /dev/vhost-net
+  if [ ! -c /dev/vhost-net ]; then
+    if mknod /dev/vhost-net c 10 238; then
+      chmod 660 /dev/vhost-net
+    fi
+  fi
 
+  # Create a macvtap network for the VM guest
   { ip link add link "$VM_NET_DEV" name "$VM_NET_TAP" address "$VM_NET_MAC" type macvtap mode bridge ; rc=$?; } || :
 
   if (( rc != 0 )); then
@@ -160,8 +167,10 @@ configureNAT() {
 
   NET_OPTS="-netdev tap,ifname=$VM_NET_TAP,script=no,downscript=no,id=hostnet0"
 
-  { exec 40>>/dev/vhost-net; rc=$?; } 2>/dev/null || :
+  if [ -c /dev/vhost-net ]; then
-  (( rc == 0 )) && NET_OPTS="$NET_OPTS,vhost=on,vhostfd=40"
+    { exec 40>>/dev/vhost-net; rc=$?; } 2>/dev/null || :
+    (( rc == 0 )) && NET_OPTS="$NET_OPTS,vhost=on,vhostfd=40"
+  fi
 
   configureDNS
 
@@ -170,15 +179,21 @@ configureNAT() {
 
 closeNetwork() {
 
-  exec 30<&- || true
-  exec 40<&- || true
-
   if [[ "$DHCP" == [Yy1]* ]]; then
 
     # Shutdown nginx
     nginx -s stop 2> /dev/null
     fWait "nginx"
 
+  fi
+
+  [[ "$NETWORK" != [Yy1]* ]] && return 0
+
+  exec 30<&- || true
+  exec 40<&- || true
+
+  if [[ "$DHCP" == [Yy1]* ]]; then
+
     ip link set "$VM_NET_TAP" down || true
     ip link delete "$VM_NET_TAP" || true
 
@@ -212,8 +227,14 @@ getInfo() {
   fi
 
   if [ -z "$VM_NET_MAC" ]; then
-    # Generate MAC address based on Docker container ID in hostname
+    local file="$STORAGE/dsm.mac"
-    VM_NET_MAC=$(echo "$HOST" | md5sum | sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:11:32:\3:\4:\5/')
+    if [ -f "$file" ]; then
+      VM_NET_MAC=$(<"$file")
+    else
+      # Generate MAC address based on Docker container ID in hostname
+      VM_NET_MAC=$(echo "$HOST" | md5sum | sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:11:32:\3:\4:\5/')
+      echo "${VM_NET_MAC^^}" > "$file"
+    fi
   fi
 
   VM_NET_MAC="${VM_NET_MAC^^}"
@@ -239,10 +260,9 @@ getInfo() {
 #  Configure Network
 # ######################################
 
-if [ ! -c /dev/vhost-net ]; then
+if [[ "$NETWORK" != [Yy1]* ]]; then
-  if mknod /dev/vhost-net c 10 238; then
+  NET_OPTS=""
-    chmod 660 /dev/vhost-net
+  return 0
-  fi
 fi
 
 getInfo

src/print.sh

@@ -2,6 +2,9 @@
 set -Eeuo pipefail
 
 : "${DHCP:="N"}"
+: "${NETWORK:="Y"}"
+
+[[ "$NETWORK" != [Yy1]* ]] && exit 0
 
 info () { printf "%b%s%b" "\E[1;34m❯ \E[1;36m" "$1" "\E[0m\n" >&2; }
 error () { printf "%b%s%b" "\E[1;31m❯ " "ERROR: $1" "\E[0m\n" >&2; }
@@ -101,3 +104,5 @@ info "-----------------------------------------------------------"
 info " You can now login to DSM at $msg"
 info "-----------------------------------------------------------"
 echo "" >&2
+
+exit 0