William Martin williammartin

Iptables Regression Overview

We have encountered what appears to be a regression in iptables performance when appending many rules sequentially. We believe we have narrowed the regression to this but do not understand the implications of this commit. Summary provided below but more info available on this tracker story

Reproduction (credit @rosenhouse)

Set up

Objective

To verify whether the iptables regression patches improve performance for both direct iptables executions and for garden NetOut API calls.

iptables rule addition

4.2 kernel

Networking Flakiness in GATS

Description

When running nested GATS, we occasionally get containers without network connectivity.

It's unclear whether this is new flakiness. It's unclear whether this affects BOSH deployments.

The tests that seem to hit this the most are those in networking_test.go around resolving DNS, but DNS resolution is failing due to a lack of connectivity (unable to ping 8.8.8.8) rather than a problem with resolution.

	cd /usr/local/
	wget "https://storage.googleapis.com/golang/go1.7.1.linux-amd64.tar.gz"
	tar -zxf go1.7.1.linux-amd64.tar.gz
	rm go1.7.1.linux-amd64.tar.gz
	cd
	mkdir go
	cd go
	mkdir src pkg bin
	cd ../

	package subreaper

	import (
	"unsafe"

	"golang.org/x/sys/unix"
	)

	func Set() error {
	return unix.Prctl(unix.PR_SET_CHILD_SUBREAPER, uintptr(1), 0, 0, 0)

	package main

	import (
	"fmt"
	"os"
	"os/exec"
	"time"

	"github.com/williammartin/subreaper"
	)

	package main

	import (
	"fmt"
	"os"
	"os/exec"
	"os/signal"
	"time"

	"github.com/williammartin/subreaper"

	package matcher_test

	import (
	"os/exec"
	"time"

	. "github.com/onsi/ginkgo"
	. "github.com/onsi/gomega"
	"golang.org/x/sys/unix"
	)

	func BeARunningProcess() types.GomegaMatcher {
	return &BeARunningProcessMatcher{}
	}

	type BeARunningProcessMatcher struct {
	actualPid int
	}

	func (matcher *BeARunningProcessMatcher) Match(actual interface{}) (bool, error) {
	pid, ok := actual.(int)

	package acceptance_test

	import (
	"os/exec"

	. "github.com/onsi/ginkgo"
	. "github.com/onsi/gomega"
	"github.com/onsi/gomega/gbytes"
	"github.com/onsi/gomega/gexec"
	)