Merge pull request #1398 from geaaru/lxc-sabayon

config/templates/Makefile.am

@@ -40,4 +40,6 @@ templatesconfig_DATA = \
 	sparclinux.userns.conf \
 	voidlinux.common.conf \
 	voidlinux.userns.conf \
+	sabayon.common.conf \
+	sabayon.userns.conf \
 	userns.conf

config/templates/sabayon.common.conf.in

+# Default configuration for Sabayon containers
+
+# Setup the default mounts
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
+
+# Allow for 1024 pseudo terminals
+lxc.pts = 1024
+
+# Setup 1 tty devices for lxc-console command
+lxc.tty = 1
+
+# Needed for systemd distro
+lxc.autodev = 1
+
+# Doesn't support consoles in /dev/lxc/
+lxc.devttydir =
+
+# CGroup whitelist
+lxc.cgroup.devices.deny = a
+
+## Allow any mknod (but not reading/writing the node)
+#lxc.cgroup.devices.allow = c *:* m
+#lxc.cgroup.devices.allow = b *:* m
+
+## Allow specific devices
+### /dev/null
+lxc.cgroup.devices.allow = c 1:3 rwm
+### /dev/zero
+lxc.cgroup.devices.allow = c 1:5 rwm
+### /dev/full
+lxc.cgroup.devices.allow = c 1:7 rwm
+### /dev/random
+lxc.cgroup.devices.allow = c 1:8 rwm
+### /dev/urandom
+lxc.cgroup.devices.allow = c 1:9 rwm
+### /dev/pts/*
+#lxc.cgroup.devices.allow = c 136:* rwm
+### /dev/tty
+#lxc.cgroup.devices.allow = c 5:0 rwm
+### /dev/console
+#lxc.cgroup.devices.allow = c 5:1 rwm
+### /dev/ptmx
+#lxc.cgroup.devices.allow = c 5:2 rwm
+### fuse
+#lxc.cgroup.devices.allow = c 10:229 rwm
+## To use loop devices, copy the following line to the container's
+## configuration file (uncommented).
+#lxc.cgroup.devices.allow = b 7:* rwm
+## rtc
+#lxc.cgroup.devices.allow = c 254:0 rm
+## tun
+#lxc.cgroup.devices.allow = c 10:200 rwm
+## hpet
+#lxc.cgroup.devices.allow = c 10:228 rwm
+## kvm
+#lxc.cgroup.devices.allow = c 10:232 rwm
+
+# If something doesn't work, try to comment this out.
+# Dropping sys_admin disables container root from doing a lot of things
+# that could be bad like re-mounting lxc fstab entries rw for example,
+# but also disables some useful things like being able to nfs mount, and
+# things that are already namespaced with ns_capable() kernel checks, like
+# hostname(1).
+lxc.cap.drop = sys_time sys_module sys_rawio mac_admin mac_override
+#lxc.cap.drop = sys_admin
+
+
+# /dev/shm needs to be mounted as tmpfs. It's needed by python (bug #496328)
+# and possibly other packages.
+lxc.mount.entry = none dev/shm tmpfs rw,nosuid,nodev,create=dir
+
+# Blacklist some syscalls which are not safe in privileged
+# containers
+lxc.seccomp = @LXCTEMPLATECONFIG@/common.seccomp
+
+# Customize lxc options through common directory
+lxc.include = @LXCTEMPLATECONFIG@/common.conf.d/

config/templates/sabayon.userns.conf.in

+# This derives from the global userns config
+lxc.include = @LXCTEMPLATECONFIG@/userns.conf

configure.ac

@@ -745,6 +745,8 @@ AC_CONFIG_FILES([
 	config/templates/sparclinux.userns.conf
 	config/templates/voidlinux.common.conf
 	config/templates/voidlinux.userns.conf
+	config/templates/sabayon.common.conf
+	config/templates/sabayon.userns.conf
 	config/templates/userns.conf
 	config/yum/Makefile
 	config/sysconfig/Makefile
@@ -897,6 +899,7 @@ AC_CONFIG_FILES([
 	templates/lxc-ubuntu-cloud
 	templates/lxc-sparclinux
 	templates/lxc-voidlinux
+	templates/lxc-sabayon
 
 	src/Makefile
 	src/lxc/Makefile

templates/Makefile.am

@@ -21,4 +21,5 @@ templates_SCRIPTS = \
 	lxc-ubuntu \
 	lxc-ubuntu-cloud \
 	lxc-sparclinux \
-	lxc-voidlinux
+	lxc-voidlinux \
+	lxc-sabayon