Question: Why does slirpnetstack need to be run sudo?

[sidkshatriya]

Pardon me if this question seems silly/uninformed.

In the README of this project you write that slirpnetstack should be run like this on the host side:

sudo ./bin/slirpnetstack -interface tun0 -netns /proc/31530/ns/net

Why does it need to be run sudo on the host side? It should be able to enter the net ns without need for sudo privileges. Also since slirpnetstack has its own user space stack (via gvisor), it just needs to make the appropriate syscalls that should not require any special privileges.

[majek]

Why does it need to be run sudo on the host side. It should be able to enter the net ns without need for sudo privileges.

Nope. If I remember right you can create network namespace from user. But you can't enter arbitrary network namespace from user. There are more ways to run slirp without sudo, for example if you pass --fd then you can just pass/inherit the tuntap handle from parent without any priv.

[sidkshatriya]

I think --preserve-credentials switch in nsenter should allow to enter a namespace from user without sudo (if that user has created that namespace). See rootless-containers/slirp4netns#222

Edit: Added clarification in brackets

[Lanius-collaris]

@majek
You should join the user namespace before joining the network namespace, but if a multi-threaded process call setns() , it may get EINVAL error. I found a workaround, executing nsenter command.
My PoC:
https://github.com/Lanius-collaris/gvisor-playground/blob/6cace667dd80659849754130bd88ea612ed4ce9c/app/libs/aegis/linux_tool/demo_cli/main.go#L62-L64