github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74: Get, New, None

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/github.com/vishvananda/netns@v0.0.0-20211101163701-50045581ed74
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/vishvananda/netns@v0.0.0-20211101163701-50045581ed74
Demonstrate these symbols/APIs:
  - netns.Get
  - netns.New
  - netns.None
  - netns.Set

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:e5bb2c6f78a228706a7906206eea734d815178860c42080a747fc16d911bffc2","contract":["netns.None returns a sentinel NsHandle whose IsOpen method reports false","netns.Get retrieves an open NsHandle representing the current thread network namespace","NsHandle.Equal detects matching namespace handles and distinguishes distinct handles from netns.None","NsHandle.Close closes the file descriptor and marks the handle as not open","netns.Set rejects an invalid handle such as netns.None with an error","netns.New creates an isolated namespace when privileged or returns a permission error when unprivileged"],"goal":"verify pkg:golang/github.com/vishvananda/netns@v0.0.0-20211101163701-50045581ed74","kind":"HOW","packages":["pkg:golang/github.com/vishvananda/netns@v0.0.0-20211101163701-50045581ed74"],"schemaVersion":1,"symbols":["netns.Get","netns.New","netns.None","netns.Set"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/vishvananda/netns@v0.0.0-20211101163701-50045581ed74"],"schemaVersion":1,"subject":"pkg:golang/github.com/vishvananda/netns@v0.0.0-20211101163701-50045581ed74","symbols":["netns.Get","netns.New","netns.None","netns.Set"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74

require golang.org/x/sys v0.2.0 // indirect

github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74 h1:gga7acRE695APm9hlsSMoOoE65U4/TcqNj90mc69Rlg=
github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.2.0 h1:ljd4t30dBnAvMZaQCevtY0xLLD0A+bRZXbgLMLU1F/A=
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

package main

import (
	"errors"
	"fmt"
	"os"
	"runtime"
	"syscall"

	"github.com/vishvananda/netns"
)

// InspectCurrentNamespace retrieves and displays information about the current thread network namespace.
func InspectCurrentNamespace() (netns.NsHandle, error) {
	runtime.LockOSThread()
	defer runtime.UnlockOSThread()

	handle, err := netns.Get()
	if err != nil {
		return netns.None(), fmt.Errorf("failed to get current network namespace: %w", err)
	}
	return handle, nil
}

// CompareNamespaces checks if two namespace handles point to the same underlying namespace.
func CompareNamespaces(h1, h2 netns.NsHandle) bool {
	return h1.Equal(h2)
}

// TryCreateNamespace attempts to create a new network namespace, returning the handle or the permission error.
func TryCreateNamespace() (netns.NsHandle, error) {
	runtime.LockOSThread()
	defer runtime.UnlockOSThread()

	ns, err := netns.New()
	if err != nil {
		if errors.Is(err, syscall.EPERM) || os.IsPermission(err) {
			return netns.None(), fmt.Errorf("unprivileged: cannot create new namespace: %w", err)
		}
		return netns.None(), fmt.Errorf("failed to create network namespace: %w", err)
	}
	return ns, nil
}

func main() {
	noneHandle := netns.None()
	fmt.Printf("Sentinel none handle open: %v\n", noneHandle.IsOpen())

	currentNs, err := InspectCurrentNamespace()
	if err != nil {
		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
		os.Exit(1)
	}
	defer currentNs.Close()

	fmt.Printf("Current namespace handle: %v, Unique ID: %s, IsOpen: %v\n",
		currentNs, currentNs.UniqueId(), currentNs.IsOpen())

	sameCheck := CompareNamespaces(currentNs, currentNs)
	fmt.Printf("Self comparison equal: %v\n", sameCheck)

	newNs, err := TryCreateNamespace()
	if err != nil {
		fmt.Printf("Note on namespace creation: %v\n", err)
	} else {
		defer newNs.Close()
		fmt.Printf("Created new namespace: %s\n", newNs.UniqueId())
	}
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/github.com/vishvananda/netns@v0.0.0-20211101163701-50045581ed74",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/vishvananda/netns@v0.0.0-20211101163701-50045581ed74"
  ],
  "symbols": [
    "netns.Get",
    "netns.New",
    "netns.None",
    "netns.Set"
  ]
}

package main

import (
	"errors"
	"fmt"
	"os"
	"runtime"
	"strings"
	"syscall"

	"github.com/vishvananda/netns"
)

func main() {
	// Assertion 1: netns.None returns a sentinel NsHandle whose IsOpen method reports false
	noneHandle := netns.None()
	if noneHandle.IsOpen() {
		fmt.Fprintf(os.Stderr, "FAIL: expected netns.None().IsOpen() to be false, got true\n")
		os.Exit(1)
	}
	if int(noneHandle) != -1 {
		fmt.Fprintf(os.Stderr, "FAIL: expected netns.None() integer descriptor to be -1, got %d\n", int(noneHandle))
		os.Exit(1)
	}

	// Assertion 2: netns.Get retrieves an open NsHandle representing the current thread network namespace
	curNs, err := netns.Get()
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: netns.Get() returned error: %v\n", err)
		os.Exit(1)
	}
	if !curNs.IsOpen() {
		fmt.Fprintf(os.Stderr, "FAIL: netns.Get() handle is not open\n")
		os.Exit(1)
	}
	uniqueID := curNs.UniqueId()
	if uniqueID == "" || !strings.HasPrefix(uniqueID, "NS(") {
		fmt.Fprintf(os.Stderr, "FAIL: netns.Get() returned unexpected unique ID format: %q\n", uniqueID)
		os.Exit(1)
	}

	// Assertion 3: NsHandle.Equal detects matching namespace handles and distinguishes distinct handles from netns.None
	secondNs, err := netns.Get()
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: second netns.Get() returned error: %v\n", err)
		os.Exit(1)
	}
	if !curNs.Equal(secondNs) {
		fmt.Fprintf(os.Stderr, "FAIL: expected two handles for current namespace to be Equal\n")
		os.Exit(1)
	}
	if curNs.Equal(noneHandle) {
		fmt.Fprintf(os.Stderr, "FAIL: expected valid namespace handle to not equal netns.None()\n")
		os.Exit(1)
	}
	_ = secondNs.Close()

	// Assertion 4: NsHandle.Close closes the file descriptor and marks the handle as not open
	probeNs, err := netns.Get()
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: probe netns.Get() returned error: %v\n", err)
		os.Exit(1)
	}
	if err := probeNs.Close(); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: NsHandle.Close() returned error: %v\n", err)
		os.Exit(1)
	}
	if probeNs.IsOpen() {
		fmt.Fprintf(os.Stderr, "FAIL: expected closed handle IsOpen() to be false, got true\n")
		os.Exit(1)
	}

	// Assertion 5: netns.Set rejects an invalid handle such as netns.None with an error
	setErr := netns.Set(noneHandle)
	if setErr == nil {
		fmt.Fprintf(os.Stderr, "FAIL: expected netns.Set(netns.None()) to fail, but succeeded\n")
		os.Exit(1)
	}

	// Assertion 6: netns.New creates an isolated namespace when privileged or returns a permission error when unprivileged
	runtime.LockOSThread()
	defer runtime.UnlockOSThread()

	newNs, newErr := netns.New()
	if newErr == nil {
		if !newNs.IsOpen() {
			fmt.Fprintf(os.Stderr, "FAIL: netns.New() succeeded but returned closed handle\n")
			os.Exit(1)
		}
		_ = newNs.Close()
		// Restore to current namespace if we have permissions
		_ = netns.Set(curNs)
	} else {
		if !errors.Is(newErr, syscall.EPERM) && !errors.Is(newErr, syscall.EACCES) && !os.IsPermission(newErr) && !strings.Contains(newErr.Error(), "operation not permitted") {
			fmt.Fprintf(os.Stderr, "FAIL: unexpected error type from netns.New(): %v\n", newErr)
			os.Exit(1)
		}
	}

	_ = curNs.Close()
	fmt.Println("PASS: netns contract passed")
}