Skip to content

Commit

Permalink
Add a link to the main document in README
Browse files Browse the repository at this point in the history
Signed-off-by: Nino Kodabande <nkodabande@suse.com>
  • Loading branch information
Nino-K committed Aug 23, 2024
1 parent 8e05e03 commit ece9feb
Showing 1 changed file with 1 addition and 47 deletions.
48 changes: 1 addition & 47 deletions src/go/guestagent/README.md
Original file line number Diff line number Diff line change
@@ -1,47 +1 @@
# Rancher Desktop Agent

The Rancher Desktop guest agent runs in Rancher Desktop VMs providing helper
services. It currently has the following functionality:

## Port forwarding with privileged helper:

When the Rancher Desktop Privileged Service is enabled on the host Windows machine via an admin installation of Rancher Desktop, the guest agent watches for port binding events from corresponding backend's API and emits them to the host via a virtual tunnel.

```mermaid
flowchart LR;
subgraph Host["HOST"]
rd{"Rancher Desktop"}
ps(("Privileged Service"))
rd <-.-> ps
end
subgraph VM["WSL VM"]
rdagent(("Guest Agent"))
api(("moby/containerd \n events API"))
rdagent <-.-> api
end
ps <---> |Vtunnel| rdagent
```

### moby port forwarding (WSL)

Rancher Desktop Guest Agent subscribes to [docker event API](https://docs.docker.com/engine/api/v1.41/#tag/System/operation/SystemEvents) to monitor the newly created published ports. It will then forwards the newly published ports over a `AF_VSOCK` tunnel (Rancher Desktop's `vtunnel`) to [Rancher Desktop Privileged Service](https://github.com/rancher-sandbox/rancher-desktop/tree/main/src/go/privileged-service) that runs on the host machine.

### containerd port forwarding (WSL)

When using the containerd backend, the behaviour of Rancher Desktop Guest Agent is very similar to when the moby backend is enabled. It monitors containerd's event API for the newly created published ports. It will then forwards the newly published ports over a `AF_VSOCK` tunnel (Rancher Desktop's `vtunnel`) to Rancher Desktop Privileged Service that runs on the host machine.

## When Privileged Service is disabled:

When the Rancher Desktop Privileged Service is not enabled on the host Windows machine via a non admin installation of Rancher Desktop, the guest agent watches the iptables for newly added rules.

### containerd port forwarding (WSL) when no privileged service is enabled

When Rancher Desktop Privileged Service is not enabled (non-admin installation), Rancher Desktop Agent falls back to the following behaviour.
In Windows Subsystem for Linux, WSL automatically forwards ports opened on `127.0.0.1` or `0.0.0.0` by opening the corresponding port on `127.0.0.1` on the host (running Windows). However, `containerd` (as configured by `nerdctl`) just sets up `iptables` rules rather than actually listening, meaning this isn't caught by the normal mechanisms. Rancher Desktop Agent therefore creates the listeners so that they get picked up and forwarded automatically. Note that the listeners will never receive any traffic, as the `iptables` rules are in place to forward the traffic before it reaches the application. This is not necessary
for Lima, as that already does the `iptables` scanning (the core of the code has been lifted from Lima).

## Kubernetes NodePort forwarding

In newer versions of Kubernetes†, `kubelet` no longer creates a listener for NodePort services. We therefore need to create those listeners manually, so that port forward works correctly as in the container port forwarding above.

† 1.21.12+, 1.22.10+, 1.23.7+, 1.24+
[Rancher Desktop Guest Agent](/docs/networking/windows/rancher-desktop-guest-agent.md)

0 comments on commit ece9feb

Please sign in to comment.