RAW sockets are not supported

[iangudger]

SOCK_RAW is not supported. Most ping implementations depend on it.

Ping sockets are supported, which are used by newer versions of ping. For example, Ubuntu 18.04 includes a sufficiently modern version of ping (make sure you are using the most recent version by running docker pull ubuntu).

[tpanum]

Is there any plans for an implementation of this?

[fvoznika]

SOCK_RAW has a large surface, so we're looking if it's possible to implement a smaller set to support tools like ping and tcpdump. What ping version are you using ping -V?

[tpanum]

We are maintaining CTF Platform, and use Docker for our challenges. However, we are looking for a Docker runtime that can prevent participants to suddenly from performing a kernel exploit that would take down the entire host.

In our use case, we rely on some fairly complex networking tools (e.g. nmap), which I believe on a broader spectrum rely on SOCK_RAW [I am not fully into the implementation of all the scanning techniques in nmap]. So for our concerns, it might be too much of a restriction to allow only a subset.

However, it is totally understandable if you do not wish gvisor to go down that path. We were just exploring the opportunities of using it to make our runtime safer, without destroying the use experience for our participants.

[iangudger]

Can you provide a list of tools you would like to see supported? As fvoznika said, we probably won't implement every SOCK_RAW feature, but if you give us a list of tools, we can look into what would be required to support them.

[fvoznika]

Old version of ping that still use raw sockets now works with gVisor (see 121db29). More raw socket support is upcoming, stay tuned.

[kevinGC]

Raw sockets have been supported for some time. Closing.