Being able to create `testing` containers, regardless of what's the name
of the next stable, is useful in several contexts, included but not
limited to testing purposes. i.e. one won't need to explicitly switch to
`bullseye` once `buster` is released to be able to continue tracking
`testing`. While we are at it, let's also enable `unstable`, which is
exactly the same as `sid`, but there is no reason for not being able to.
Signed-off-by: Antonio Terceiro <terceiro@debian.org>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

This template would always add "en-US.UTF-8" to the end of the container's locale.gen, which in turn confused locale-gen.
Signed-off-by: Fridtjof Mund <fridtjofmund@gmail.com>

mem and kmem are really in /dev, so this does us no good.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>

Update for commit e3dd06efSigned-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

- rework and fix pipe fd leak
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

To match names beginning with the letters "f" or "b" one can use
the regular expression "[fb].*" or "(f|b).*", but not "[f|b].*",
which would match strings beginning with "f", "|", or "b".
Signed-off-by: Christian von Roques <roques@z12.ch>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Remove executable bit.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Mimic the code from the debian template.
Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

The httpredir.debian.org service has been discontinued in favour of
deb.debian.org and httpredir.debian.org now redirects to deb.debian.org.

https://lists.debian.org/debian-mirrors/2017/02/msg00000.html
https://wiki.debian.org/DebianGeoMirror#httpredir.debian.org_.2F_http.debian.net

Cf. https://bugs.debian.org/872719Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>

Somehow "type" doesn't really work.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Shukui Yang <yangshukui@huawei.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

(updated by Serge to also handle hte new lxc-fedora{-legacy{.in
templates)
Signed-off-by: Harald Dunkel <harri@afaics.de>
Signed-off-by: Serge Hallyn <serge@hallyn.com>
Acked-by: Serge Hallyn <serge@hallyn.com>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

It is not necessary to unlink the abstract socket pathname when
we have finished using the socket. The abstract name is automatically
removed when the socket is closed.
Signed-off-by: Long Wang <w@laoqinren.net>

This patch allows users to start containers in AppArmor namespaces.
Users can define their own profiles for their containers, but
lxc-start must be allowed to change to a namespace.

A container configuration file can wrap a container in an AppArmor
profile using lxc.aa_profile.

A process in an AppArmor namespace is restricted to view
or manage only the profiles belonging to this namespace, as if no
other profiles existed. A namespace can be created as follow:
sudo mkdir /sys/kernel/security/apparmor/policy/namespaces/$NAMESPACE

AppArmor can stack profiles so that the contained process is bound
by the intersection of all profiles of the stack. This is achieved
using the '//&' operator as follow:

lxc.aa_profile = $PROFILE//&:$NAMESPACE://unconfined

In this case, even the guest process appears unconfined in the
namespace, it is still confined by $PROFILE.

A guest allowed to access "/sys/kernel/security/apparmor/** rwklix,"
will be able to manage its own profile set, while still being
enclosed in the topmost profile $PROFILE:

Different guests can be assigned the same namespace or different
namespaces. In the first case, they will share their profiles.
In the second case, they will have distinct sets of profiles.

This is validated on privileged containers.
Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

This patch mainly updates comments based on the current code.
Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: Long Wang <w@laoqinren.net>

use cppcheck tools `cppcheck --enable=warning  .` on lxc source directory.

This patch fix the following warnning

```
[src/lxc/cgroups/cgfs.c:794]: (warning) %ld in format string (no. 3) requires 'long' but the argument type is 'unsigned long'.
[src/lxc/confile.c:4441]: (warning) %d in format string (no. 2) requires 'int' but the argument type is 'unsigned int'.
[src/lxc/confile.c:4502]: (warning) %d in format string (no. 2) requires 'int' but the argument type is 'unsigned int'.
[src/lxc/confile_legacy.c:921]: (warning) %d in format string (no. 2) requires 'int' but the argument type is 'unsigned int'.
[src/lxc/confile_legacy.c:938]: (warning) %d in format string (no. 2) requires 'int' but the argument type is 'unsigned int'.
[src/lxc/lxclock.c:63]: (warning) %zd in format string (no. 1) requires 'ssize_t' but the argument type is 'size_t {aka unsigned long}'.
[src/lxc/tools/lxc_info.c:118]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_info.c:118]: (warning) %u in format string (no. 2) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_info.c:123]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_info.c:127]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_info.c:130]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_top.c:212]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_top.c:212]: (warning) %u in format string (no. 2) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_top.c:217]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_top.c:221]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
[src/lxc/tools/lxc_top.c:224]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'.
```
Signed-off-by: Long Wang <w@laoqinren.net>

Signed-off-by: 0x0916 <w@laoqinren.net>

Our logging function will always spew out the function name.
Signed-off-by: 0x0916 <w@laoqinren.net>

Fix issue: https://github.com/lxc/lxc/issues/505Signed-off-by: 0x0916 <w@laoqinren.net>

CentOS only has i386 and x86_64 listed in mirrorlist.centos.org,
use http://mirror.centos.org/altarch/ for all other arches instead

See: https://bugs.centos.org/view.php?id=11250Signed-off-by: Evgeni Golov <evgeni@debian.org>

uname -m reports aarch64, but Debian calls the arch arm64
Signed-off-by: Evgeni Golov <evgeni@debian.org>