Add a test to see if we can start daemonized containers that have a very
short-lived init process. The point of this is to see whether we can correctly
retrieve the state.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Since we killed lxc-monitord we rely on the container's command socket to wait
for the container. This doesn't work nicely on daemonized startup since a
container's init process might be something that is so short-lived that we
won't even be able to add a state client before the mainloop closes. But the
container might still have been RUNNING and executed the init binary correctly.
In this case we would erroneously report that the container failed to start
when it actually started just fine.
This commit ensures that we really all cases where the container successfully
ran by switching to a short-lived per-container anonymous unix socket pair that
uses credentials to pass container states around. It is immediately closed once
the container has started successfully.
This should also make daemonized container start way more robust since we don't
rely on the command socket handler to be running.

For the experienced developer: Yes, I did think about utilizing the command
socket directly for this. The problem is that when the mainloop starts it may
end up end accept()ing the connection that we want
do_wait_on_daemonized_start() to accept() so this won't work and might cause us
to hang indefinitely. The same problem arises when the container fails to start
before the mainloop is created. In this case we would hang indefinitely as
well.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Long Wang <w@laoqinren.net>

commit bdb3f441 says that we may undo
the change in august 2014.

I think that it is time to do that.
Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

It is not necessary to unlink the abstract socket pathname when
we have finished using the socket. The abstract name is automatically
removed when the socket is closed.
Signed-off-by: Long Wang <w@laoqinren.net>

This patch allows users to start containers in AppArmor namespaces.
Users can define their own profiles for their containers, but
lxc-start must be allowed to change to a namespace.

A container configuration file can wrap a container in an AppArmor
profile using lxc.aa_profile.

A process in an AppArmor namespace is restricted to view
or manage only the profiles belonging to this namespace, as if no
other profiles existed. A namespace can be created as follow:
sudo mkdir /sys/kernel/security/apparmor/policy/namespaces/$NAMESPACE

AppArmor can stack profiles so that the contained process is bound
by the intersection of all profiles of the stack. This is achieved
using the '//&' operator as follow:

lxc.aa_profile = $PROFILE//&:$NAMESPACE://unconfined

In this case, even the guest process appears unconfined in the
namespace, it is still confined by $PROFILE.

A guest allowed to access "/sys/kernel/security/apparmor/** rwklix,"
will be able to manage its own profile set, while still being
enclosed in the topmost profile $PROFILE:

Different guests can be assigned the same namespace or different
namespaces. In the first case, they will share their profiles.
In the second case, they will have distinct sets of profiles.

This is validated on privileged containers.
Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

* Use `#include <lxc/lxccontaienr.h>` style for exported haeders.
* remove used header `caps.h`
Signed-off-by: Long Wang <w@laoqinren.net>

This patch mainly update the message format to:

* upper the first letter
* end without a dot

all changes are relate to `lxc-init`
Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

This patch mainly updates comments based on the current code.
Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

This pr https://github.com/lxc/lxc/pull/1618 kill lxc-monitord, for backwards compatibility,
we also send state to legacy lxc-monitord state server in function `lxc_set_state`.

we should also send state if there is no state clients registered, otherwise `lxc-monitor` client will
not get state change event if container changed state to `STARTING` or `RUNNING`.
Signed-off-by: 0x0916 <w@laoqinren.net>

lxc-monitor has an option to tell lxc-monitord to quit.

```
~/lxc (master) # lxc-monitor --help
lxc-monitor monitors the state of the NAME container

Options :
  -n, --name=NAME   NAME of the container
                    NAME may be a regular expression
  -Q, --quit        tell lxc-monitord to quit
```
But it does not work. This patch fix that.
Signed-off-by: 0x0916 <w@laoqinren.net>

Our logging function will always spew out the function name.
Signed-off-by: 0x0916 <w@laoqinren.net>

Fix issue: https://github.com/lxc/lxc/issues/505Signed-off-by: 0x0916 <w@laoqinren.net>

CentOS only has i386 and x86_64 listed in mirrorlist.centos.org,
use http://mirror.centos.org/altarch/ for all other arches instead

See: https://bugs.centos.org/view.php?id=11250Signed-off-by: Evgeni Golov <evgeni@debian.org>

uname -m reports aarch64, but Debian calls the arch arm64
Signed-off-by: Evgeni Golov <evgeni@debian.org>

Signed-off-by: 0x0916 <w@laoqinren.net>

Signed-off-by: 0x0916 <w@laoqinren.net>

Signed-off-by: 0x0916 <w@laoqinren.net>

This reverts commit 758243d8.
Signed-off-by: 0x0916 <w@laoqinren.net>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Li Feng <lifeng68@huawei.com>

Add description of new network configuration, and tweak.

Update for commit b9986e43Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Yifeng Tan <tanyifeng1@huawei.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

This logs the configured networks on the trace level to support debugging.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>