container: T6219: Add support for container sysctl / kernel parameters

[TGNThump]

Change Summary

Adds kernel parameter / sysctl configuration support.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

https://vyos.dev/T6219

Related PR(s)

Component(s) name

container

Proposed changes

Adds support for configuring a container with the sysctl option:

container {
  name test {
    image busybox:stable
    kernel-parameter "net.ipv4.ip_forward" {
      value "1"
    }
  }
}

How to test

Smoketest result

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[c-po]

Please use the already available syntax (example: https://github.com/vyos/vyos-1x/blob/current/interface-definitions/system_sysctl.xml.in)

set container sysctl parameter net.ipv4.ip_forward value 1

<tagNode name="parameter"> can then be moved to interface-definitions/include/sysctl.xml.i and re-used in both container.xml.in and system_sysctl.xml.in to have a common source.

[sever-sever]

@TGNThump any updates?

[TGNThump]

@TGNThump any updates?

Sorry, not had a chance to take another look at this.

[c-po]

According to https://docs.podman.io/en/v4.4/markdown/options/sysctl.html now all options are possible.

For the IPC namespace, the following sysctls are allowed:
Note: <<if using the --ipc=host option|if the ipc namespace is not shared within the pod>>, the above sysctls are not allowed.

For the network namespace, only sysctls beginning with net.* are allowed.
Note: <<if using the --network=host option|if the network namespace is not shared within the pod>>, the above sysctls are not allowed.

So we can use the same CLI style, but having a re-usable CLI definition does not work using this limitation.

@TGNThump can we expect you keep working on this? Or should it be moved back to the pool of open feature requests?

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[c-po]

Superseeded by #3614