bind mounts get removed with network namespaces?

Question

Strongswan daemon puts its .pid and .ctl files in /var/run to detect if it is already running.

I want to run multiple of these daemons on the same machine within different network namespaces. I am trying to achieve this by bind mounting different directories (say /etc/namespace1 to namespace1's /var/run and /etc/namespace2 to namespace2's /var/run). /var/run is a symlink to /run, so I bind mount to /run like below.

I can almost achieve this like this:

""In default namespace""

$:~ sudo echo "red" >> /etc/red/run/pidfile
$:~ sudo echo "blue" >> /etc/blue/run/pidfile
$:~ sudo ip netns exec red

""In red namespace""

$:~ mount --bind /etc/red/run/ /run/
$:~ cat /var/run/pidfile

red

""In blue namespace""

 $:~ mount --bind /etc/blue/run/ /run/
 $:~ cat /var/run/pidfile

blue

So this works fine. This way the daemon when it creates /var/run/charon.pid while inside red will not confuse with blue namespace's /var/run/charon.pid and two instances may start.

However, here's the issue: if I "exit" from red namespace and then re-enter via "ip netns exec red bash", then the mount is no longer present. That is there is no /var/run/redfile at all.

So, the question is how can I make this sticky? Do I need /etc/fstab changes? But it doesn't work. If asked, I can provide details of "it doesn't work".

I am lost. Will appreciate some help.

Thanks!

Answer 1

The simple solution would be to instruct each instance of strongswan to use a different directory to store the PID file by means of setting the correct value of the IPSEC_PIDDIR environment variable in your start and stop script.

Answer 2

ip netns exec already bind mounts /etc/netns/<netns name>/* over the corresponding file/directory in /etc. So you may compile strongSwan with e.g. --with-piddir=/etc/ipsec.d/run and then create the required directories so each instance creates its PID files in separate directories:

# mkdir -p /etc/ipsec.d/run
# mkdir -p /etc/netns/<netns name 1>/ipsec.d/run
# mkdir -p /etc/netns/<netns name 2>/ipsec.d/run

More details can be found on the strongSwan wiki.