The most likely cause of failure is the container going away, in which.
case we don't need to clean up. And there are other points of possible
failure in the same category in attach(), so making sure we clean up the
container interface under all conditions is a broader issue.
When an IP address was reused by a new container, other containers
could experience delays of many seconds the first time they tried to
talk to that new container before successful communication would
occur. This delay came from three sources related to ARP cache
behaviour:
- The kernel would take a while to decide that an ARP mapping was
stale due to lack of positive evidence (due to the
base_reachable_time default of 30s)
- Even once an ARP mapping was considered stale, the kernel would wait
a few seconds before sending an ARP request, in the hope that a
higher layer (e.g. TCP) would confirm the ARP entry (due to the
delay_first_probe default of 5s)
- When the kernel sent out an ARP request to update a stale entry,
initial attempts would unicast the request to the old MAC address
before resorting to broadcast (due to the ucast_solicit default of
3)
This change reduces all these values, so that any delays
are a few seconds.
For most workloads, this should not greatly increase the amount
of ARP traffic, because communication via TCP is often sufficient
to confirm ARP entries. And one unicast ARP request is still sent
just in case.
Unfortunately, there's a fixed-but-only-recently bug in the kernel
that means that changing base_reachable_time can take a while to take
effect:
<https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4bf6980dd0328530783fd657c776e3719b421d30>.
This means that a container will continue to use a long reachable_time
delay for the first few minutes of its life.
So we complain with "already running" rather than "Found another
running container" when encountering a 'weave' container running a
different image version. Similarly, we remove stopped 'weave'
containers regardless of version.
Ditto for weavedns.
Which is all how it used to work.
- released weave scripts run their corresponding image versions
- unreleased weave scripts run the 'latest'-tagged image versions
The image version to run can also be specified explicitly by setting
VERSION. Useful for testing, mainly.
and return an error status rather than exit when containers stop just
before an HTTP call, which in turn allows us to make tell_dns properly
ignore weavedns container absences.
Fixes#300
Rather than looking for the host end of the veth pair, we look for the
expected interface inside the container. This has the advantage of
detecting weave-attached-ness even when the container is sharing a
network namespace with others.
Closes#303, #302.
Adam Harrison