Default net.ipv4.ip_unprivileged_port_start to 0 inside containers

[yashkukrecha]

This PR makes nerdctl default the container's net.ipv4.ip_unprivileged_port_start sysctl to 0, unless the user has explicitly set this sysctl via --sysctl.

Key changes:

• Adds a new helper withDefaultUnprivilegedPortSysctl in pkg/cmd/container/container.go.
• Applies this helper during container creation, after user-supplied sysctls are parsed.
• If the user passes a --sysctl for net.ipv4.ip_unprivileged_port_start, nerdctl does not override it.

Note: Host-wide sysctl configuration and containerd-rootless-setuptool.sh were intentionally left unchanged in this PR to keep the scope focused on the container namespace default requested in the issue.

Fixes #4595

[AkihiroSuda]

conflicts with:

nerdctl/pkg/cmd/container/run_linux.go

Line 100 in 1d69ed9

opts = append(opts, WithSysctls(strutil.ConvertKVStringsToMap(options.Sysctl)))

[yashkukrecha]

I added the defaulting for net.ipv4.ip_unprivileged_port_start in create.go, building on top of the behavior in run_linux.go. Does this still conflict?

[AkihiroSuda]

Please fix the lint errors, squash the commits, and sign off the DCO

[yashkukrecha]

Hi @AkihiroSuda, should all the tests be passing?

[haytok]

The tests for this update has failed.

=== Failed
=== FAIL: cmd/nerdctl/container TestContainerInspectHostConfigDefaults (0.67s)
    container_inspect_linux_test.go:343: HostConfig in TestContainerInspectHostConfigDefaults: &{ContainerIDFile: LogConfig:{Driver:json-file Opts:map[] LogURI: Address:/run/containerd/containerd.sock} PortBindings:map[] CgroupnsMode:private DNS:[] DNSOptions:[] DNSSearch:[] ExtraHosts:[] GroupAdd:[1 2 3 4 6 10 11 20 26 27] IpcMode:private OomScoreAdj:0 PidMode: ReadonlyRootfs:false Tmpfs:map[] UTSMode: ShmSize:0 Sysctls:map[net.ipv4.ip_unprivileged_port_start:0] Runtime:io.containerd.runc.v2 CPUSetMems: CPUSetCPUs: CPUQuota:0 CPUShares:0 CPUPeriod:0 CPURealtimePeriod:0 CPURealtimeRuntime:0 Memory:0 MemorySwap:0 OomKillDisable:false Devices:[] BlkioSettings:{BlkioWeight:0 BlkioWeightDevice:[] BlkioDeviceReadBps:[] BlkioDeviceWriteBps:[] BlkioDeviceReadIOps:[] BlkioDeviceWriteIOps:[]}}
    container_inspect_linux_test.go:365: assertion failed: 0 (int) != 1 (int)

Therefore, at least the following fixes are required:

• nerdctl/cmd/nerdctl/container/container_inspect_linux_test.go

  Line 365 in f1591d9

  assert.Equal(t, 0, len(inspect.HostConfig.Sysctls))

[yashkukrecha]

Hi, the only failing job is in-host - Windows. Looking at the logs, all the cmd/nerdctl/container tests are failing because nerdctl run returns a non-zero exit code with:

failed to create shim task: kernel: 'C:\Program Files\Linux Containers\kernel' not found

This seems like an environment issue in the Windows runner rather than something caused by my PR. Does this test need to be resolved before merging my PR?

[AkihiroSuda]

Can you try rebasing with the current main branch ?

[AkihiroSuda]

Doesn't look rebased well
https://lima-vm.io/docs/dev/git/#rebasing-onto-upstream-master

[yashkukrecha]

I rebased and it resulted in some failing flaky tests but also some failures unrelated to my PR, such as logging and binding to host port 5000.

[AkihiroSuda]

Not sure why Windows CI is still failing.
Maybe GHA is now deterministically picking a broken runner instance by the PR number?