feat: Improved networking (#712)

.github/ISSUE_TEMPLATE/FEATURE_REQUEST.yml

@@ -3,6 +3,13 @@ description: Suggest an idea for improving the container
 title: "[Feature]: "
 labels: ["enhancement"]
 body:
+  - type: checkboxes
+    attributes:
+      label: Is there an existing feature request for this?
+      description: Please search to see if the feature request already exists.
+      options:
+      - label: I have searched the existing feature requests
+        required: true
   - type: textarea
     id: problem
     attributes:

.github/ISSUE_TEMPLATE/QUESTION.yml

@@ -6,8 +6,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Have a question about this container?
+        Please do not use this form for technical issues, and make sure to check the [FAQ](https://github.com/vdsm/virtual-dsm/blob/master/readme.md) first!
-        Please make sure to check the [FAQ](https://github.com/vdsm/virtual-dsm/blob/master/readme.md) first!
   - type: textarea
     id: question
     attributes:

.github/workflows/build.yml

@@ -78,7 +78,7 @@ jobs:
           context: .
           push: true
           provenance: false
-          platforms: linux/amd64,linux/arm64,linux/arm
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           annotations: ${{ steps.meta.outputs.annotations }}

readme.md

@@ -249,5 +249,5 @@ Only run this container on Synology hardware, any other use is not permitted by
 
 [Build]: https://github.com/vdsm/virtual-dsm/actions/workflows/build.yml/badge.svg
 [Size]: https://img.shields.io/docker/image-size/vdsm/virtual-dsm/latest?color=066da5&label=size
-[Pulls]: https://img.shields.io/docker/pulls/kroese/virtual-dsm.svg?style=flat&label=pulls&logo=docker
+[Pulls]: https://img.shields.io/docker/pulls/vdsm/virtual-dsm.svg?style=flat&label=pulls&logo=docker
 [Version]: https://img.shields.io/docker/v/vdsm/virtual-dsm/latest?arch=amd64&sort=semver&color=066da5

src/disk.sh

@@ -87,6 +87,16 @@ isCow() {
   return 1
 }
 
+supportsDirect() {
+  local FS=$1
+
+  if [[ "${FS,,}" == "ecryptfs" ]] || [[ "${FS,,}" == "tmpfs" ]]; then
+    return 1
+  fi
+
+  return 0
+}
+
 createDisk() {
   local DISK_FILE=$1
   local DISK_SPACE=$2
@@ -329,6 +339,10 @@ checkFS () {
     info "Warning: the filesystem of $DIR is FUSE, this extra layer will negatively affect performance!"
   fi
 
+  if ! supportsDirect "$FS"; then
+    info "Warning: the filesystem of $DIR is $FS, which does not support O_DIRECT mode, adjusting settings..."
+  fi
+
   if isCow "$FS"; then
     if [ -f "$DISK_FILE" ]; then
       FA=$(lsattr "$DISK_FILE")
@@ -348,23 +362,30 @@ createDevice () {
   local DISK_INDEX=$3
   local DISK_ADDRESS=$4
   local DISK_FMT=$5
+  local DISK_IO=$6
+  local DISK_CACHE=$7
 
-  echo "-drive file=$DISK_FILE,if=none,id=drive-$DISK_ID,format=$DISK_FMT,cache=$DISK_CACHE,aio=$DISK_IO,discard=$DISK_DISCARD,detect-zeroes=on \
+  local result="-drive file=$DISK_FILE,if=none,id=drive-$DISK_ID,format=$DISK_FMT,cache=$DISK_CACHE,aio=$DISK_IO,discard=$DISK_DISCARD,detect-zeroes=on"
+
+  result="$result \
     -device virtio-scsi-pci,id=hw-$DISK_ID,iothread=io2,bus=pcie.0,addr=$DISK_ADDRESS \
     -device scsi-hd,bus=hw-$DISK_ID.0,channel=0,scsi-id=0,lun=0,drive=drive-$DISK_ID,id=$DISK_ID,rotation_rate=$DISK_ROTATION,bootindex=$DISK_INDEX"
 
+  echo "$result"
   return 0
 }
 
 addDisk () {
-  local DISK_ID=$1
+  local DISK_BASE=$1
-  local DISK_BASE=$2
+  local DISK_EXT=$2
-  local DISK_EXT=$3
+  local DISK_DESC=$3
-  local DISK_DESC=$4
+  local DISK_SPACE=$4
-  local DISK_SPACE=$5
+  local DISK_INDEX=$5
-  local DISK_INDEX=$6
+  local DISK_ADDRESS=$6
-  local DISK_ADDRESS=$7
+  local DISK_FMT=$7
-  local DISK_FMT=$8
+  local DISK_IO=$8
+  local DISK_CACHE=$9
+  local DISK_ID="userdata$DISK_INDEX"
   local DISK_FILE="$DISK_BASE.$DISK_EXT"
   local DIR DATA_SIZE FS PREV_FMT PREV_EXT CUR_SIZE OPTS
 
@@ -386,6 +407,11 @@ addDisk () {
   FS=$(stat -f -c %T "$DIR")
   checkFS "$FS" "$DISK_FILE" "$DISK_DESC" || exit $?
 
+  if ! supportsDirect "$FS"; then
+    DISK_IO="threads"
+    DISK_CACHE="writeback"
+  fi
+
   if ! [ -s "$DISK_FILE" ] ; then
 
     if [[ "${DISK_FMT,,}" != "raw" ]]; then
@@ -414,7 +440,7 @@ addDisk () {
 
   fi
 
-  OPTS=$(createDevice "$DISK_ID" "$DISK_FILE" "$DISK_INDEX" "$DISK_ADDRESS" "$DISK_FMT")
+  OPTS=$(createDevice "$DISK_ID" "$DISK_FILE" "$DISK_INDEX" "$DISK_ADDRESS" "$DISK_FMT" "$DISK_IO" "$DISK_CACHE")
   DISK_OPTS="$DISK_OPTS $OPTS"
 
   return 0
@@ -422,17 +448,17 @@ addDisk () {
 
 addDevice () {
 
-  local DISK_ID=$1
+  local DISK_DEV=$1
-  local DISK_DEV=$2
+  local DISK_DESC=$2
-  local DISK_DESC=$3
+  local DISK_INDEX=$3
-  local DISK_INDEX=$4
+  local DISK_ADDRESS=$4
-  local DISK_ADDRESS=$5
+  local DISK_ID="userdata$DISK_INDEX"
 
   [ -z "$DISK_DEV" ] && return 0
   [ ! -b "$DISK_DEV" ] && error "Device $DISK_DEV cannot be found! Please add it to the 'devices' section of your compose file." && exit 55
 
   local OPTS
-  OPTS=$(createDevice "$DISK_ID" "$DISK_DEV" "$DISK_INDEX" "$DISK_ADDRESS" "raw")
+  OPTS=$(createDevice "$DISK_ID" "$DISK_DEV" "$DISK_INDEX" "$DISK_ADDRESS" "raw" "$DISK_IO" "$DISK_CACHE")
   DISK_OPTS="$DISK_OPTS $OPTS"
 
   return 0
@@ -502,27 +528,27 @@ DISK4_FILE="/storage4/data4"
 : "${DEVICE4:=""}"
 
 if [ -n "$DEVICE" ]; then
-  addDevice "userdata" "$DEVICE" "device" "3" "0xc" || exit $?
+  addDevice "$DEVICE" "device" "3" "0xc" || exit $?
 else
-  addDisk "userdata" "$DISK1_FILE" "$DISK_EXT" "disk" "$DISK_SIZE" "3" "0xc" "$DISK_FMT" || exit $?
+  addDisk "$DISK1_FILE" "$DISK_EXT" "disk" "$DISK_SIZE" "3" "0xc" "$DISK_FMT" "$DISK_IO" "$DISK_CACHE" || exit $?
 fi
 
 if [ -n "$DEVICE2" ]; then
-  addDevice "userdata2" "$DEVICE2" "device2" "4" "0xd" || exit $?
+  addDevice "$DEVICE2" "device2" "4" "0xd" || exit $?
 else
-  addDisk "userdata2" "$DISK2_FILE" "$DISK_EXT" "disk2" "$DISK2_SIZE" "4" "0xd" "$DISK_FMT" || exit $?
+  addDisk "$DISK2_FILE" "$DISK_EXT" "disk2" "$DISK2_SIZE" "4" "0xd" "$DISK_FMT" "$DISK_IO" "$DISK_CACHE" || exit $?
 fi
 
 if [ -n "$DEVICE3" ]; then
-  addDevice "userdata3" "$DEVICE3" "device3" "5" "0xe" || exit $?
+  addDevice "$DEVICE3" "device3" "5" "0xe" || exit $?
 else
-  addDisk "userdata3" "$DISK3_FILE" "$DISK_EXT" "disk3" "$DISK3_SIZE" "5" "0xe" "$DISK_FMT" || exit $?
+  addDisk "$DISK3_FILE" "$DISK_EXT" "disk3" "$DISK3_SIZE" "5" "0xe" "$DISK_FMT" "$DISK_IO" "$DISK_CACHE" || exit $?
 fi
 
 if [ -n "$DEVICE4" ]; then
-  addDevice "userdata4" "$DEVICE4" "device4" "6" "0xf" || exit $?
+  addDevice "$DEVICE4" "device4" "6" "0xf" || exit $?
 else
-  addDisk "userdata4" "$DISK4_FILE" "$DISK_EXT" "disk4" "$DISK4_SIZE" "6" "0xf" "$DISK_FMT" || exit $?
+  addDisk "$DISK4_FILE" "$DISK_EXT" "disk4" "$DISK4_SIZE" "6" "0xf" "$DISK_FMT" "$DISK_IO" "$DISK_CACHE" || exit $?
 fi
 
 html "Initialized disks successfully..."

src/entry.sh

@@ -18,7 +18,7 @@ cd /run
 
 trap - ERR
 
-info "Booting ${APP} on a ${CPU} using QEMU v${VERS} with kernel $(uname -r)..."
+info "Booting ${APP}..."
 [[ "$DEBUG" == [Yy1]* ]] && echo "Arguments: $ARGS" && echo
 
 if [[ "$CONSOLE" == [Yy]* ]]; then

src/install.sh

@@ -66,6 +66,10 @@ if [[ "${FS,,}" == "fuse"* ]]; then
   info "Warning: the filesystem of $STORAGE is FUSE, this extra layer will negatively affect performance!"
 fi
 
+if [[ "${FS,,}" == "ecryptfs" ]] || [[ "${FS,,}" == "tmpfs" ]]; then
+  info "Warning: the filesystem of $STORAGE is $FS, which does not support O_DIRECT mode, adjusting settings..."
+fi
+
 if [[ "${FS,,}" == "fat"* || "${FS,,}" == "vfat"* || "${FS,,}" == "msdos"* ]]; then
   error "Unable to install on $FS filesystems, please use a different filesystem for /storage." && exit 61
 fi
@@ -126,7 +130,9 @@ if [ ! -s "$RDC" ]; then
   fKill "progress.sh"
 
   if (( rc != 0 )); then
-    (( rc != 22 )) && error "Failed to download $LOC, reason: $rc" && exit 60
+    if (( rc != 22 )) && (( rc != 56 )); then
+      error "Failed to download $LOC, reason: $rc" && exit 60
+    fi
     SUM="skip"
   else
     SUM=$(md5sum "$RD" | cut -f 1 -d " ")

src/network.sh

@@ -6,6 +6,7 @@ set -Eeuo pipefail
 : "${MAC:=""}"
 : "${DHCP:="N"}"
 : "${NETWORK:="Y"}"
+: "${HOST_PORTS:=""}"
 
 : "${VM_NET_DEV:=""}"
 : "${VM_NET_TAP:="dsm"}"
@@ -35,8 +36,8 @@ configureDHCP() {
   { ip link add link "$VM_NET_DEV" name "$VM_NET_TAP" address "$VM_NET_MAC" type macvtap mode bridge ; rc=$?; } || :
 
   if (( rc != 0 )); then
-    error "Cannot create macvtap interface. Please make sure the network type is 'macvlan' and not 'ipvlan',"
+    error "Cannot create macvtap interface. Please make sure that the network type is 'macvlan' and not 'ipvlan',"
-    error "and that the NET_ADMIN capability has been added to the container: --cap-add NET_ADMIN" && exit 16
+    error "that your kernel is recent (>4) and supports it, and that the container has the NET_ADMIN capability set." && exit 16
   fi
 
   while ! ip link set "$VM_NET_TAP" up; do
@@ -103,6 +104,21 @@ configureDNS() {
   return 0
 }
 
+getPorts() {
+
+  local list=$1
+
+  [ -z "$list" ] && echo "" && return 0
+
+  if [[ "$list" != *","* ]]; then
+    echo " ! --dport $list"
+  else
+    echo " -m multiport ! --dports $list"
+  fi
+
+  return 0
+}
+
 configureNAT() {
 
   # Create the necessary file structure for /dev/net/tun
@@ -119,12 +135,15 @@ configureNAT() {
 
   # Check port forwarding flag
   if [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then
-    { sysctl -w net.ipv4.ip_forward=1 ; rc=$?; } || :
+    { sysctl -w net.ipv4.ip_forward=1 > /dev/null; rc=$?; } || :
-    if (( rc != 0 )); then
+    if (( rc != 0 )) || [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then
       error "IP forwarding is disabled. $ADD_ERR --sysctl net.ipv4.ip_forward=1" && exit 24
     fi
   fi
 
+  local tables="The 'ip_tables' kernel module is not loaded. Try this command: sudo modprobe ip_tables iptable_nat"
+  local tuntap="The 'tun' kernel module is not available. Try this command: 'sudo modprobe tun' or run the container with 'privileged: true'."
+
   # Create a bridge with a static IP for the VM guest
 
   VM_NET_IP='20.20.20.21'
@@ -143,7 +162,9 @@ configureNAT() {
   done
 
   # QEMU Works with taps, set tap to the bridge created
-  ip tuntap add dev "$VM_NET_TAP" mode tap
+  if ! ip tuntap add dev "$VM_NET_TAP" mode tap; then
+    error "$tuntap" && exit 31
+  fi
 
   while ! ip link set "$VM_NET_TAP" up promisc on; do
     info "Waiting for TAP to become available..."
@@ -156,13 +177,19 @@ configureNAT() {
   update-alternatives --set iptables /usr/sbin/iptables-legacy > /dev/null
   update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy > /dev/null
 
-  iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -j MASQUERADE
+  exclude=$(getPorts "$HOST_PORTS")
-  iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p tcp -j DNAT --to "$VM_NET_IP"
+
+  if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -j MASQUERADE; then
+    error "$tables" && exit 30
+  fi
+
+  # shellcheck disable=SC2086
+  iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p tcp${exclude} -j DNAT --to "$VM_NET_IP"
   iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p udp  -j DNAT --to "$VM_NET_IP"
 
   if (( KERNEL > 4 )); then
     # Hack for guest VMs complaining about "bad udp checksums in 5 packets"
-    iptables -A POSTROUTING -t mangle -p udp --dport bootpc -j CHECKSUM --checksum-fill || true
+    iptables -A POSTROUTING -t mangle -p udp --dport bootpc -j CHECKSUM --checksum-fill > /dev/null 2>&1 || true
   fi
 
   NET_OPTS="-netdev tap,ifname=$VM_NET_TAP,script=no,downscript=no,id=hostnet0"
@@ -273,10 +300,14 @@ if [[ "$DEBUG" == [Yy1]* ]]; then
   echo
 fi
 
+if [[ "$IP" == "172.17."* ]]; then
+  warn "your container IP starts with 172.17.* which will cause conflicts when you install the Container Manager package inside DSM!"
+fi
+
 if [[ "$DHCP" == [Yy1]* ]]; then
 
-  if [[ "$GATEWAY" == "172."* ]] && [[ "$DEBUG" != [Yy1]* ]]; then
+  if [[ "$GATEWAY" == "172."* ]]; then
-    error "You can only enable DHCP while the container is on a macvlan network!" && exit 26
+    warn "your gateway IP starts with 172.* which is often a sign that you are not on a macvlan network (required for DHCP)!"
   fi
 
   # Configuration for DHCP IP

src/power.sh

@@ -10,10 +10,11 @@ API_HOST="127.0.0.1:2210"
 QEMU_TERM=""
 QEMU_PORT=7100
 QEMU_TIMEOUT=50
-QEMU_PID="/run/shm/qemu.pid"
+QEMU_DIR="/run/shm"
-QEMU_LOG="/run/shm/qemu.log"
+QEMU_PID="$QEMU_DIR/qemu.pid"
-QEMU_OUT="/run/shm/qemu.out"
+QEMU_LOG="$QEMU_DIR/qemu.log"
-QEMU_END="/run/shm/qemu.end"
+QEMU_OUT="$QEMU_DIR/qemu.out"
+QEMU_END="$QEMU_DIR/qemu.end"
 
 if [[ "$KVM" == [Nn]* ]]; then
   API_TIMEOUT=$(( API_TIMEOUT*2 ))

src/proc.sh

@@ -90,7 +90,7 @@ else
 fi
 
 if [ -z "$HOST_CPU" ]; then
-  HOST_CPU=$(lscpu | grep 'Model name' | cut -f 2 -d ":" | awk '{$1=$1}1' | sed 's# @.*##g' | sed s/"(R)"//g | sed 's/[^[:alnum:] ]\+/ /g' | sed 's/  */ /g')
+  HOST_CPU=$(lscpu | grep -m 1 'Model name' | cut -f 2 -d ":" | awk '{$1=$1}1' | sed 's# @.*##g' | sed s/"(R)"//g | sed 's/[^[:alnum:] ]\+/ /g' | sed 's/  */ /g')
 fi
 
 if [ -n "$HOST_CPU" ]; then

src/reset.sh

@@ -12,7 +12,6 @@ trap 'error "Status $? while: $BASH_COMMAND (line $LINENO/$BASH_LINENO)"' ERR
 
 echo "❯ Starting $APP for Docker v$(</run/version)..."
 echo "❯ For support visit $SUPPORT"
-echo
 
 # Docker environment variables
 
@@ -38,12 +37,13 @@ TEMPLATE="/var/www/index.html"
 FOOTER1="$APP for Docker v$(</run/version)"
 FOOTER2="<a href='$SUPPORT'>$SUPPORT</a>"
 
+SYS=$(uname -r)
 HOST=$(hostname -s)
-KERNEL=$(uname -r | cut -b 1)
+KERNEL=$(echo "$SYS" | cut -b 1)
-MINOR=$(uname -r | cut -d '.' -f2)
+MINOR=$(echo "$SYS" | cut -d '.' -f2)
 ARCH=$(dpkg --print-architecture)
-VERS=$(qemu-system-x86_64 --version | head -n 1 | cut -d '(' -f 1 | awk '{ print $NF }')
+RAM="$(free -g | grep Mem: | awk '{print $7}')/$(free -g | grep Mem: | awk '{print $2}') GB"
-CPU=$(lscpu | grep 'Model name' | cut -f 2 -d ":" | awk '{$1=$1}1' | sed 's# @.*##g' | sed s/"(R)"//g | sed 's/[^[:alnum:] ]\+/ /g' | sed 's/  */ /g')
+CPU=$(lscpu | grep -m 1 'Model name' | cut -f 2 -d ":" | awk '{$1=$1}1' | sed 's# @.*##g' | sed s/"(R)"//g | sed 's/[^[:alnum:] ]\+/ /g' | sed 's/  */ /g')
 
 # Check system
 
@@ -59,6 +59,23 @@ if [ ! -d "$STORAGE" ]; then
   error "Storage folder ($STORAGE) not found!" && exit 13
 fi
 
+# Check filesystem
+FS=$(stat -f -c %T "$STORAGE")
+
+if [[ "${FS,,}" == "ecryptfs" ]] || [[ "${FS,,}" == "tmpfs" ]]; then
+  DISK_IO="threads"
+  DISK_CACHE="writeback"
+fi
+
+# Print system info
+SYS="${SYS/-generic/}"
+FS="${FS/ext2\/ext3/ext4}"
+SPACE=$(df --output=avail -B 1 "$STORAGE" | tail -n 1)
+SPACE_GB=$(( (SPACE + 1073741823)/1073741824 ))
+
+echo "❯ CPU: ${CPU} | RAM: ${RAM} | DISK: $SPACE_GB GB (${FS}) | HOST: ${SYS}..."
+echo
+
 # Cleanup files
 rm -f /run/shm/qemu.*
 rm -f /run/shm/dsm.url