Automatically symlink when proxying unix domain sockets under /var/run

[awh]

The proxy currently generates a warning when you attempt to proxy sockets whose immediate parent is /var/run, due to the issue with mount namespaces capturing network namespaces. Users are advised to make a symlink of the target socket in a subdirectory and supply that instead; this advice should be automated.

[rade]

The idea here is that it avoids the obscure warning we currently issue.

Perhaps we should create a symlink for any domain socket, except /var/run/weave/weave.sock? That way we can just always mount /var/run/weave.

[paulbellamy]

Doing a symlink for any domain socket sounds cleaner. But, in order for the volumes to get unmounted (in case they are /var/run), we need the symlink-creating container to exit. To do that we could either:

• 1. Special-case /var/run, mount it into the exec_remote container, and only do the symlink dance for sockets in /var/run.
• 2. Have the proxy launch another temporary container with the dirs mounted, and have that create the symlinks.
• 3. Parse the proxy flags locally, mounting the socket dirs into the exec_remote container, and create the symlinks from there.

Of those, 1, or 2 sound the cleanest.

[paulbellamy]

Favouring option 1, as it will run faster (less container creates/destroys), and be less code than launching containers from the proxy.

[paulbellamy]

Have realised that option1 won't work because the proxy won't know what address to return for weave env, so we are stuck with option 2.