From f3faf833212b7e5a0e98ebe18d40d5bd11aed887 Mon Sep 17 00:00:00 2001
From: Matthias Radestock <matthias.radestock@gmail.com>
Date: Sat, 27 Dec 2014 15:14:29 +0000
Subject: [PATCH] refuse to attach containers running in the host network
 namespace Since bad things happen otherwise, i.e. we end up creating veth
 pairs with an ethwe on the host

Closes #270.
---
 weave | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/weave b/weave
index 1b010a6e..11fd28b9 100755
--- a/weave
+++ b/weave
@@ -194,6 +194,11 @@ with_container_netns () {
 }
 
 connect_container_to_bridge() {
+    if [ "$(readlink /proc/$CONTAINER_PID/ns/net)" = "$(readlink /proc/$$/ns/net)" ] ; then
+        echo "Container is running in the host network namespace, and therefore cannot be" >&2
+        echo "connected to weave. Perhaps the container was started with --net=host." >&2
+        return 1
+    fi
     if ! ip link add name $LOCAL_IFNAME mtu $MTU type veth peer name $GUEST_IFNAME mtu $MTU ; then
         return 1
     fi