Add bridged physical networking via vmnet-helper

[s3rj1k]

Add bridged physical networking via vmnet-helper

A container-network-vmnet-helper plugin bridges container machines
onto a physical interface with static IPv4 and an address pool.
Machines attach via container machine set network=<spec> and set
extra kernel command-line args with kernel-arg=. Bridged networks
are machine-only; a regular container requesting one is rejected.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Motivation and Context

I, as a user, would like to have bridge support in machine containers, this change adds bridge support via external vmnet-helper and ability to set kernel args for custom kernels

Testing

• Tested locally
• Added/updated tests
• Added/updated docs

[s3rj1k]

Does not look like there is an upstream interest in this, closing PR

[nirs]

@jglogan this looks like an interesting integration. Can we someone review this?

[s3rj1k]

@nirs Thanks for the interest in this and for the network helper 😃

I am trying to follow the latest releases of container in main branch of forked repo.

https://github.com/s3rj1k/container/releases/tag/v1.1.0%2B5973b9c
https://s3rj1k.github.io/container/

---

Regarding this feature in general, for my use-case I need to have a VM that I can run easily with bridge and shard networks and where I can run wireguard in kernel mode and nested virtualization, essentially replacing UTM.

For container specifically this means, using machine mode, building custom OS image, rebuilding Linux kernel (for wireguard and nested virtualization), and supporting this feature across releases.

So I am actually starting to think at this point that taking libkrun and conjuring some simple CLI wrapper with exactly limited amount of features that I need from VMM will be more usable in terms of support in the long run.

[nirs]

@nirs Thanks for the interest in this and for the network helper 😃

I am trying to follow the latest releases of container in main branch of forked repo.

https://github.com/s3rj1k/container/releases/tag/v1.1.0%2B5973b9chttps://s3rj1k.github.io/container/

Regarding this feature in general, for my use-case I need to have a VM that I can run easily with bridge and shard networks and where I can run wireguard in kernel mode and nested virtualization, essentially replacing UTM.

For container specifically this means, using machine mode, building custom OS image, rebuilding Linux kernel (for wireguard and nested virtualization), and supporting this feature across releases.

So I am actually starting to think at this point that taking libkrun and conjuring some simple CLI wrapper with exactly limited amount of features that I need from VMM will be more usable in terms of support in the long run.

You can use krunkit (using libkrun) or vfkit (using virtualization framework). Both support nested virtualization and have good integration with vmnet-helper. You can check examples in vmnet-helper testing harness and minikube vfkit and krunkit drivers. krunkit supports also GPU hardware acceleration.

Integrating with Apple container looks interesting and useful for the community.