// RunPodSandbox creates and starts a pod-level sandbox. Runtimes should ensure
// the sandbox is in ready state.
func (c *criService) RunPodSandbox(ctx context.Context, r *runtime.RunPodSandboxRequest) (_ *runtime.RunPodSandboxResponse, retErr error) {

  ...
  
  // Save sandbox name
	sandboxInfo.AddLabel("name", name)

  // 初始化 sandbox, 注意此时的 network namespace 未指定
	// Create initial internal sandbox object.
	sandbox := sandboxstore.NewSandbox(
		sandboxstore.Metadata{
			ID:             id,
			Name:           name,
			Config:         config,
			RuntimeHandler: r.GetRuntimeHandler(),
		},
		sandboxstore.Status{
			State: sandboxstore.StateUnknown,
		},
	)

	if _, err := c.client.SandboxStore().Create(ctx, sandboxInfo); err != nil {
		return nil, fmt.Errorf("failed to save sandbox metadata: %w", err)
	}
  
  ...
  
  // Setup the network namespace if host networking wasn't requested.
	if !hostNetwork(config) && !userNsEnabled {
		netStart := time.Now()

		var netnsMountDir = "/var/run/netns"
		if c.config.NetNSMountsUnderStateDir {
			netnsMountDir = filepath.Join(c.config.StateDir, "netns")
		}
    
    // 创建 network namespace! 本文重点关注函数
		sandbox.NetNS, err = netns.NewNetNS(netnsMountDir)
    
    // 指定 network namespace 路径
    // Update network namespace in the store, which is used to generate the container's spec
		sandbox.NetNSPath = sandbox.NetNS.GetPath()
    
    ...

		if err := c.setupPodNetwork(ctx, &sandbox); err != nil {
			return nil, fmt.Errorf("failed to setup network for sandbox %q: %w", id, err)
		}

  }  
}

$ sudo ip netns add mynet

$ sudo ip netns set mynet 12345

$ sudo ip netns list
mynet (id: 12345)

$ ls -al /var/run/netns/
total 0
drwxr-xr-x  2 root root   60 Dec  2 09:17 .
drwxr-xr-x 33 root root 1000 Dec  2 09:17 ..
-r--r--r--  1 root root    0 Dec  2 09:17 mynet

$ sudo ip netns pids mynet

$ sudo ip netns identify [PID]

$ stat /var/run/netns/mynet
  File: /var/run/netns/mynet
  Size: 0         	Blocks: 0          IO Block: 4096   regular empty file
Device: 4h/4d	Inode: 4026532942  Links: 1
Access: (0444/-r--r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2023-12-02 11:47:47.632117163 +0800
Modify: 2023-12-02 11:47:47.632117163 +0800
Change: 2023-12-02 11:47:47.632117163 +0800

$ readlink /proc/$$/ns/net
net:[4026531992]

$ readlink /proc/$$/ns/net
net:[4026531992]

$ sudo unshare --net bash

$ readlink /proc/$$/ns/net
net:[4026532828]

$ mount --bind /proc/$$/ns/net /var/run/netns/mynet
$ ls -i /var/run/netns/mynet

$ sudo ip netns pids mynet
9615

$ ps aux | grep 9615 | grep -v grep
root        9615  0.0  0.1   7428  4196 pts/1    S    11:16   0:00 bash

$ netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name

$ sudo nsenter --net=/var/run/netns/mynet python3 -m http.server

$ sudo ip netns pids mynet
9615
32337

$ netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp6       0      0 :::8000                 :::*                    LISTEN      32145/python3

$ nsenter --target 1234 --net=/var/run/netns/mynet

$ ip netns pids mynet | xargs kill
$ ip netns del mynet

// Some of the following functions are migrated from
// https://github.com/containernetworking/plugins/blob/main/pkg/testutils/netns_linux.go

// newNS creates a new persistent (bind-mounted) network namespace and returns the
// path to the network namespace.
// If pid is not 0, returns the netns from that pid persistently mounted. Otherwise,
// a new netns is created.
func newNS(baseDir string, pid uint32) (nsPath string, err error) {
	b := make([]byte, 16)

	_, err = rand.Read(b)


  // 创建 network namespace 对应的目录和 mount point
	// Create the directory for mounting network namespaces
	// This needs to be a shared mountpoint in case it is mounted in to
	// other namespaces (containers)
	if err := os.MkdirAll(baseDir, 0755); err != nil {
		return "", err
	}

	// create an empty file at the mount point and fail if it already exists
	nsName := fmt.Sprintf("cni-%x-%x-%x-%x-%x", b[0:4], b[4:6], b[6:8], b[8:10], b[10:])
	nsPath = path.Join(baseDir, nsName)
	mountPointFd, err := os.OpenFile(nsPath, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0666)
	if err != nil {
		return "", err
	}
	mountPointFd.Close()

	defer func() {
		// Ensure the mount point is cleaned up on errors
		if err != nil {
			os.RemoveAll(nsPath)
		}
	}()

  
  // 如果指定了pid，则返回其对应的 network namespace 文件
	if pid != 0 {
		procNsPath := getNetNSPathFromPID(pid)
    
    // 重点! 将 netns 挂载到 nsPath
		if err = unix.Mount(procNsPath, nsPath, "none", unix.MS_BIND, ""); err != nil {
			return "", fmt.Errorf("failed to bind mount ns src: %v at %s: %w", procNsPath, nsPath, err)
		}
		return nsPath, nil
	}

	var wg sync.WaitGroup
	wg.Add(1)

	// do namespace work in a dedicated goroutine, so that we can safely
	// Lock/Unlock OSThread without upsetting the lock/unlock state of
	// the caller of this function
	go (func() {
		defer wg.Done()
    
    // 1. 锁定goroutine 与 thread
		runtime.LockOSThread()

		var origNS cnins.NetNS
    // 2. getCurrentThreadNetNSPath()获取当前进程的main线程的netNSPath，然后调用 cnins.GetNS() 打开文件句柄
		origNS, err = cnins.GetNS(getCurrentThreadNetNSPath())
		if err != nil {
			return
		}
    // 最后，关闭 netns 打开的file句柄
		defer origNS.Close()

    // 3. 在当前线程创建新一个 netns
		// create a new netns on the current thread
		err = unix.Unshare(unix.CLONE_NEWNET)
		if err != nil {
			return
		}

    // 切换回原来的 netns
		defer origNS.Set()

    // 4. 将当前进程对应的新的 network namespace 挂载到 nsPath, 使命名空间永远存在，即使ns内没有线程
		// bind mount the netns from the current thread (from /proc) onto the
		// mount point. This causes the namespace to persist, even when there
		// are no threads in the ns.
		err = unix.Mount(getCurrentThreadNetNSPath(), nsPath, "none", unix.MS_BIND, "")

	})()
	wg.Wait()

	return nsPath, nil
}

func (ns *netNS) Set() error {
	...

	if err := unix.Setns(int(ns.Fd()), unix.CLONE_NEWNET); err != nil {
		return fmt.Errorf("Error switching to ns %v: %v", ns.file.Name(), err)
	}

	return nil
}