2

I used to run services in 14.04 by executing

ip netns exec namespacename service start servicename

But I realized that this doesnt work anymore on 16.04. The service starts in normal namespace.

I tried to edit /lib/systemd/system/servicename.service file to use namespace but it was not successful. First problem was that the program was executed with its own user who doesn't have access to namespaces. I changed it to run the program as root then use sudo in ExecStart but for some reason service control never came back to command prompt.

Any ideas on how to accomplish a service to automatically and permanently run inside a namespace every time it is restarted on Ubuntu 16.04 ?

If it matters the service in question is transmission-daemon

UPDATE:

I managed to get it working with the following .service file. In the file 'vpn' is the name of the namespace. My problem was setting the wrong Type for the service. I still feel that this solution is not the best solution. If you have a better way, please tell!

[Unit]
Description=Transmission BitTorrent Daemon
After=network.target

[Service]
User=root
Type=simple
ExecStart=/bin/sh -c 'exec /sbin/ip netns exec vpn /usr/bin/sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error --config-dir /var/lib/transmission-daemon/info'
ExecReload=/bin/kill -s HUP $MAINPID

[Install]
WantedBy=multi-user.target
2

Recently found in man systemd.exec(5)

PrivateNetwork=
           Takes a boolean argument. If true, sets up a new network namespace for the executed processes and configures only the loopback network device
           "lo" inside it. No other network devices will be available to the executed process. This is useful to turn off network access by the executed
           process. Defaults to false. It is possible to run two or more units within the same private network namespace by using the JoinsNamespaceOf=
           directive, see systemd.unit(5) for details. Note that this option will disconnect all socket families from the host, this includes AF_NETLINK
           and AF_UNIX. The latter has the effect that AF_UNIX sockets in the abstract socket namespace will become unavailable to the processes
           (however, those located in the file system will continue to be accessible).
| improve this answer | |
  • 1
    Please add more information than a simple copy from the documentation - namely how to use this parameter in the context of the question. – pabouk May 17 '19 at 12:29
  • I think the answer is quite good. I can go and read systemd.exec(5) for more information myself (which I did). I will try it next time I setup a service this way. But for now I am setting the answer as correct (unless somebody comes upw ith a better answer). Perhaps link to online documentation would be a nice touch : manpages.ubuntu.com/manpages/disco/man5/systemd.unit.5.html – yurtesen May 17 '19 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.