refactor: wire unix-socket NIOs through a per-node runtime directory

uBridge cannot reach sockets bind-mounted from the node's projects
directory: the path exceeds AF_UNIX's 107-byte sun_path cap. The /proc
detour from the previous commit is a dead end too - the runner drops
from root to the server uid, which makes the process non-dumpable and
its /proc/<pid>/root unreadable for the unprivileged server.

Instead, mirror how CML itself runs the image (source=<scratch>/tmp,
target=/tmp in its node definition): bind a per-node directory from the
runtime directory (<XDG_RUNTIME_DIR>/gns3/unixio/<node-id>, next to the
uBridge control sockets) at the image's socket directory. The path is
short, the directory is owned by the server user (whom the agent drops
its privileges to), and it is removed with the node. A socket directory
covered by a persisted volume keeps working as before.

IOLDockerVM persists only /tmp/run (nested bind at /tmp/run) and cleans
stale sockets/netio dirs from the socket directory on start, skipping
the cleanup when the container is already running. A failed wiring now
stops uBridge so the next start does not hit 'bridge already exist'.

gns3server/compute/docker/iol_docker_vm.py

@@ -28,17 +28,22 @@ Networking does not use the container's network namespace at all: the runner's
 netiomux exposes per-interface AF_UNIX datagram sockets in the container's
 ``/tmp`` (``s%02d.sock`` receive, ``c%02d.sock`` send — raw Ethernet frames),
 wired by the generic ``GNS3_UNIX_SOCKET_NIO`` capability of VendorDockerVM
-(uBridge reaches them through the container's root in /proc). Because the
-netio bus directory is private to the container's /tmp, the application IDs
-are fixed constants with no cross-node collisions.
+(uBridge reaches them through a per-node runtime directory bound at /tmp —
+see ``VendorDockerVM._unix_socket_host_dir``). Because the netio bus
+directory is private to the node, the application IDs are fixed constants
+with no cross-node collisions.
 
 This class is selected by the ``GNS3_IOL_RUNNER=1`` environment marker.
 """
 
+import contextlib
+import glob
 import json
 import logging
 import os
+import shutil
 
+from gns3server.compute.docker.docker_error import DockerHttp404Error
 from gns3server.compute.docker.vendor_docker_vm import VendorDockerVM
 
 log = logging.getLogger(__name__)
@@ -124,22 +129,40 @@ class IOLDockerVM(VendorDockerVM):
           boot (the runner writes NETMAP there but does not create it).
         * ``<working_dir>/config/iol-config.json`` is rewritten on every
           start so adapter-count and memory changes take effect.
+        * Sockets and netio bus directories left in the wiring directory by a
+          previous (possibly SIGKILLed) run are removed — the runner rebinds
+          them on boot and would fail on a stale file.
 
-        The netiomux sockets and the netio bus directory need no cleanup:
-        they live in the container's own /tmp, which is fresh in every
-        container GNS3 creates (containers are recreated on each start).
+        ``tmp/run`` (startup-config, NVRAM) is never touched. Neither is
+        anything while the container is already running (idempotent start of
+        a live node: the sockets belong to the running runner).
         """
 
+        try:
+            state = await self._get_container_state()
+        except DockerHttp404Error:
+            state = "stopped"
+
         os.makedirs(os.path.join(self.working_dir, "tmp", "run"), exist_ok=True)
         self._write_iol_config()
 
+        if state == "running":
+            return
+
+        wiring_dir = self._unix_socket_wiring_dir()
+        for pattern in ("s??.sock", "c??.sock"):
+            for stale in glob.glob(os.path.join(wiring_dir, pattern)):
+                with contextlib.suppress(OSError):
+                    os.unlink(stale)
+        for netio_dir in glob.glob(os.path.join(wiring_dir, "netio*")):
+            shutil.rmtree(netio_dir, ignore_errors=True)
+
     def _write_iol_config(self):
         """
         Write the runner's config file on the host side of the /config volume.
         The runner drops to user-id/group-id after its setup, so everything it
-        creates is owned by the server user — which is also what lets an
-        unprivileged uBridge traverse /proc/<pid>/root to reach the
-        container's sockets.
+        creates is owned by the server user — which is also what lets the
+        (unprivileged) uBridge write into the node's socket directory.
         """
 
         config = {

gns3server/compute/docker/vendor_docker_vm.py

@@ -32,6 +32,7 @@ import json
 import logging
 import os
 import shutil
+import tempfile
 
 from gns3server.utils.asyncio import wait_for_file_creation
 from gns3server.utils.asyncio.telnet_server import AsyncioTelnetServer
@@ -70,13 +71,16 @@ class VendorDockerVM(DockerVM):
       network namespace. For images whose network agent exposes, per adapter
       ``N``, a receive socket ``s%02d.sock`` and a send-to path ``c%02d.sock``
       (raw Ethernet frames, one datagram per frame) inside the container —
-      e.g. Cisco CML's iol-runner (see IOLDockerVM). uBridge reaches the
-      sockets through the container's root in ``/proc`` (see
-      ``_unix_socket_wiring_dir``), so no volume mount is required; it binds
+      e.g. Cisco CML's iol-runner (see IOLDockerVM). uBridge binds
       ``c{N:02d}.sock`` (its receive side) and sends to ``s{N:02d}.sock``.
-      No TAP is created, the container's network namespace is untouched and
-      the ``mac_address`` template field is ignored (the image's agent owns
-      the MAC scheme).
+      Unless the directory is already covered by a persisted volume, a
+      per-node directory from the runtime directory is bind-mounted there —
+      owned by the server user (such agents drop privileges and cannot write
+      into a root-owned directory) and short enough for an AF_UNIX path,
+      which a node directory inside the projects tree exceeds. No TAP is
+      created, the container's network namespace is untouched and the
+      ``mac_address`` template field is ignored (the image's agent owns the
+      MAC scheme).
     * ``GNS3_UNIX_SOCKET_DIR=<dir>`` — in-container directory holding the
       socket files (default ``/tmp``).
     """
@@ -165,6 +169,22 @@ class VendorDockerVM(DockerVM):
         are never shadowed by an empty mount.
         """
         binds = super()._mount_binds(image_info)
+        if self._unix_socket_nio:
+            socket_dir = self._unix_socket_dir.rstrip("/")
+            if not any(
+                v.rstrip("/") == socket_dir or socket_dir.startswith(v.rstrip("/") + "/")
+                for v in self._volumes
+            ):
+                # The image's network agent drops privileges before using the
+                # socket directory, so it must be writable by the server user:
+                # bind a per-node directory from the runtime directory (see
+                # _unix_socket_host_dir).
+                binds.append({
+                    "Type": "bind",
+                    "Source": self._unix_socket_host_dir(),
+                    "Target": socket_dir,
+                    "BindOptions": {"Propagation": "rprivate"},
+                })
         if self._gns3_init:
             return binds
         binds = [b for b in binds if b.get("Target") != "/gns3volumes/etc/network"]
@@ -307,20 +327,55 @@ class VendorDockerVM(DockerVM):
             return self._interface_names[adapter_number]
         return f"eth{adapter_number}"
 
-    async def _unix_socket_wiring_dir(self):
+    def _unix_socket_host_dir(self):
         """
-        Host-side directory to reference in the uBridge unix-NIO commands:
-        the container's socket directory reached through its root in /proc.
+        Host-side directory bind-mounted at the in-container socket directory
+        when the latter is not already covered by a persisted volume: a
+        per-node directory under the runtime directory, next to the uBridge
+        control sockets.
 
-        The sockets live in the container's own filesystem (no volume mount
-        needed); /proc/<pid>/root/<dir> resolves to the same files uBridge
-        sees, from outside any namespace. This also keeps the path well under
-        the 107-byte sun_path cap — a node directory (projects/<uuid>/…)
-        alone exceeds it.
+        AF_UNIX paths are capped at 107 bytes (sun_path minus the NUL) — a
+        node directory inside the projects tree (projects/<uuid>/
+        project-files/docker/<uuid>/tmp) alone is ~120, so uBridge would
+        reject the NIO with "invalid file path size". The runtime directory
+        path stays short no matter where the projects live, and being owned
+        by the server user, the image's privilege-dropping agent can write
+        to it.
         """
 
-        pid = await self._get_namespace()
-        return f"/proc/{pid}/root{self._unix_socket_dir}"
+        runtime_dir = os.environ.get("XDG_RUNTIME_DIR") or tempfile.gettempdir()
+        host_dir = os.path.join(runtime_dir, "gns3", "unixio", self.id)
+        try:
+            os.makedirs(host_dir, mode=0o700, exist_ok=True)
+        except OSError as e:
+            raise DockerError(
+                f"Could not create unix-socket directory '{host_dir}' for container '{self._name}': {e}"
+            )
+        return host_dir
+
+    def _remove_unix_socket_host_dir(self):
+        """Best-effort removal of the per-node unix-socket directory."""
+
+        if self._unix_socket_nio:
+            shutil.rmtree(self._unix_socket_host_dir(), ignore_errors=True)
+
+    def _unix_socket_wiring_dir(self):
+        """
+        Directory referenced in the uBridge unix-NIO commands: the persisted
+        volume holding the socket directory, or the per-node runtime
+        directory bound there by _mount_binds.
+        """
+
+        socket_dir = self._unix_socket_dir.rstrip("/")
+        for volume in self._volumes:
+            if socket_dir == volume.rstrip("/") or socket_dir.startswith(volume.rstrip("/") + "/"):
+                return os.path.join(self.working_dir, os.path.relpath(socket_dir, "/"))
+        return self._unix_socket_host_dir()
+
+    async def delete(self):
+        # The per-node socket directory is ephemeral; the node is not.
+        await super().delete()
+        self._remove_unix_socket_host_dir()
 
     async def _add_ubridge_connection(self, nio, adapter_number):
         """
@@ -336,9 +391,10 @@ class VendorDockerVM(DockerVM):
         * ``c{N:02d}.sock`` — the path it sends guest-egress frames to.
 
         uBridge binds the c-socket as its receive side and sends to the
-        s-socket (both reached through /proc — see _unix_socket_wiring_dir).
-        No TAP is allocated, the namespace is untouched and guest MAC
-        addresses are whatever the image's agent uses.
+        s-socket (both on the host side of the socket directory — see
+        _unix_socket_wiring_dir). No TAP is allocated, the namespace is
+        untouched and guest MAC addresses are whatever the image's agent
+        uses.
         """
 
         if not self._unix_socket_nio:
@@ -354,31 +410,37 @@ class VendorDockerVM(DockerVM):
             )
 
         bridge_name = f"bridge{adapter_number}"
-        await self._ubridge_send(f"bridge create {bridge_name}")
-        self._bridges.add(bridge_name)
-
-        wiring_dir = await self._unix_socket_wiring_dir()
-        local_sock = os.path.join(wiring_dir, f"c{adapter_number:02d}.sock")
-        remote_sock = os.path.join(wiring_dir, f"s{adapter_number:02d}.sock")
-
-        # A c-socket left over from a previous ubridge run would fail its bind.
-        with contextlib.suppress(OSError):
-            os.unlink(local_sock)
-
-        # The socket appears when the container's agent finishes its interface
-        # setup; wait instead of silently blackholing the adapter.
         try:
-            await wait_for_file_creation(remote_sock, timeout=30)
-        except asyncio.TimeoutError:
-            raise DockerError(
-                f"Socket '{remote_sock}' for adapter {adapter_number} of container "
-                f"'{self._name}' did not appear within 30 seconds. Check that the "
-                f"container's port count covers adapter {adapter_number} and that "
-                f"its network agent creates the per-adapter socket pair in "
-                f"'{self._unix_socket_dir}'."
-            )
+            await self._ubridge_send(f"bridge create {bridge_name}")
+            self._bridges.add(bridge_name)
 
-        await self._ubridge_send(f'bridge add_nio_unix {bridge_name} "{local_sock}" "{remote_sock}"')
+            wiring_dir = self._unix_socket_wiring_dir()
+            local_sock = os.path.join(wiring_dir, f"c{adapter_number:02d}.sock")
+            remote_sock = os.path.join(wiring_dir, f"s{adapter_number:02d}.sock")
+
+            # A c-socket left over from a previous ubridge run would fail its bind.
+            with contextlib.suppress(OSError):
+                os.unlink(local_sock)
+
+            # The socket appears when the container's agent finishes its interface
+            # setup; wait instead of silently blackholing the adapter.
+            try:
+                await wait_for_file_creation(remote_sock, timeout=30)
+            except asyncio.TimeoutError:
+                raise DockerError(
+                    f"Socket '{remote_sock}' for adapter {adapter_number} of container "
+                    f"'{self._name}' did not appear within 30 seconds. Check that the "
+                    f"container's port count covers adapter {adapter_number} and that "
+                    f"its network agent creates the per-adapter socket pair in "
+                    f"'{self._unix_socket_dir}'."
+                )
+
+            await self._ubridge_send(f'bridge add_nio_unix {bridge_name} "{local_sock}" "{remote_sock}"')
+        except Exception:
+            # A half-wired bridge would make the next start fail with
+            # "bridge already exist": uBridge stops with the failed start.
+            await self._stop_ubridge()
+            raise
         adapter.host_ifc = local_sock  # bookkeeping / removal logging only
         log.debug(
             "Adapter %d of container '%s' wired via unix sockets %s <-> %s",