- 19 May, 2014 20 commits
-
-
Serge Hallyn authored
For years it has been best practice to use a relative path as the mount target. But the manpage hasn't reflect that. Fix it. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Dwight Engen <dwight.engen@oracle.com>
-
Edvinas Klovas authored
when using btrfs backend lxc-create first creates rootfs in /usr/lib/lxc/rootfs directory before moving it to /var/lib/lxc or other directory supplied by the command line. Archlinux template relied in $rootfs_path which made containers created with btrfs backend have lxc.rootfs set to /usr/lib/lxc/rootfs. By using $path instead of $rootfs_path we make sure that lxc.rootfs is always correct. Signed-off-by:
Edvinas Klovas <edvinas@pnd.io> Acked-by:
-
S.Çağlar Onur authored
Signed-off-by:
S.Çağlar Onur <caglar@10ur.org> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
On older cgmanager the support was broken. So rather than fail container starts altogether, just keep the old lxc behavior in this case by not using name= subsystems. Signed-off-by:
-
KATOH Yasufumi authored
commit aafea1f7 was incomplete. Signed-off-by:
KATOH Yasufumi <karma@jazz.email.ne.jp> Acked-by:
-
Dwight Engen authored
Signed-off-by:
-
Dwight Engen authored
Signed-off-by:
-
Edvinas Klovas authored
archlinux is using systemd and systemd's configuration does not have any services setup to handle sigpwr hook which is sent by lxc-stop command. By enabling sigpwr service we make sure that lxc-stop will work. Signed-off-by:
-
Serge Hallyn authored
If an unprivileged user does 'lxc-start -n u1' in one login session, followed by 'lxc-attach -n u1' in another session, the attach will fail if the sessions are in different cgroups. The same is true of lxc-cgroup commands. Address this by using the GetPidCgroupAbs and MovePidAbs which work with the containers' cgroup path relative to the cgproxy. Since GetPidCgroupAbs is new to api version 3 in cgmanager, use the old method if we are on an older cgmanager. Signed-off-by:
-
Serge Hallyn authored
Read /proc/self/cgroup instead of /proc/cgroups, so as to catch named subsystems. Otherwise the contaienrs will not be fully moved into the container cgroups. Also free line which was being leaked. Signed-off-by:
-
Serge Hallyn authored
Do this by calling the bdev->destroy() hook from a user namespace configured as the container's. Signed-off-by:
-
Serge Hallyn authored
btrfs subvolume ioctls are usable by unprivileged users, so allow unprivileged containers to reside on btrfs. This patch does not yet enable destroy. Signed-off-by:
-
Dwight Engen authored
Signed-off-by:
-
KATOH Yasufumi authored
Update for commit 0769b82aSigned-off-by:
-
KATOH Yasufumi authored
Update for commit b46f0553Signed-off-by:
-
Christian Seiler authored
If the user specifies cgroup or cgroup-full without a specifier (:ro, :rw or :mixed), this changes the behavior. Previously, these were simple aliases for the :mixed variants; now they depend on whether the container also has CAP_SYS_ADMIN; if it does they resolve to the :rw variants, if it doesn't to the :mixed variants (as before). If a container has CAP_SYS_ADMIN privileges, any filesystem can be remounted read-write from within, so initially mounting the cgroup filesystems partially read-only as a default creates a false sense of security. It is better to default to full read-write mounts to show the administrator what keeping CAP_SYS_ADMIN entails. If an administrator really wants both CAP_SYS_ADMIN and the :mixed variant of cgroup or cgroup-full automatic mounts, they can still specify that explicitly; this commit just changes the default without specifier. Signed-off-by:
Christian Seiler <christian@iwakd.de> Cc: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by:
-
Christian Seiler authored
Currently, setup_caps and dropcaps_except both use the same parsing logic for parsing capabilities (try to identify by name, but allow numerical specification). Since this is a common routine, separate it out to improve maintainability and reuseability. Signed-off-by:
-
Christian Seiler authored
Ubuntu containers have had trouble with automatic cgroup mounting that was not read-write (i.e. lxc.mount.auto = cgroup{,-full}:{ro,mixed}) in containers without CAP_SYS_ADMIN. Ubuntu's mountall program reads /lib/init/fstab, which contains an entry for /sys/fs/cgroup. Since there is no ro option specified for that filesystem, mountall will try to remount it readwrite if it is already mounted. Without CAP_SYS_ADMIN, that fails and mountall will interrupt boot and wait for user input on whether to proceed anyway or to manually fix it, effectively hanging container bootup. This patch makes sure that /sys/fs/cgroup is always a readwrite tmpfs, but that the actual cgroup hierarchy paths (/sys/fs/cgroup/$subsystem) are readonly if :ro or :mixed is used. This still has the desired effect within the container (no cgroup escalation possible and programs get errors if they try to do so anyway), while keeping Ubuntu containers happy. Signed-off-by: -
Stéphane Graber authored
Set a base class for the network object and set the encoding in the header. Neither of those changes are required for python3 but they do make it easier for anyone trying to make a python2 binding. Signed-off-by: -
Serge Hallyn authored
Corrected a small oversight when locking related code was moved from src/lxc/utils.c to src/lxc/lxclock.c. Signed-off-by:
Stephen M Bennett <stephen_m_bennett@hotmail.com> Signed-off-by:
-
- 05 May, 2014 1 commit
-
-
Stéphane Graber authored
When using --nesting, we exec ourselves in the container context, if we somehow need to dynamically-load modules from there, things break. So make sure we pre-load everything we may need. Signed-off-by:
-
- 02 May, 2014 5 commits
-
-
Stéphane Graber authored
This reverts commit 5cfc06fa.
-
Serge Hallyn authored
/sys/fs/cgroup is just a size-limited tmpfs, and making it ro does nothing to affect our ability alter mount settings of its subdirs. OTOH making it ro can upset mountall in the container which tries to remount it rw, which may be refused. So just don't do it. Signed-off-by:
-
KATOH Yasufumi authored
Update for commit 0e98b3bdSigned-off-by:
-
Stéphane Graber authored
Signed-off-by: -
KATOH Yasufumi authored
Update for commit 860f5355Signed-off-by:
-
- 01 May, 2014 3 commits
-
-
Serge Hallyn authored
This should address https://github.com/lxc/lxc/issues/199Signed-off-by:
-
Nikolay Martynov authored
lxc-init got moved into SBINDIR/init.lxc recently. This broke sshd template because path wasn't updated there. This patch should fix this issue. Signed-off-by:
Nikolay Martynov <mar.kolya@gmail.com> Acked-by:
-
Dwight Engen authored
- Some scriptlets expect fstab to exist so create it before doing the yum install - Set the rootfs selinux label same as the hosts or else the PREIN script from initscripts will fail when running groupadd utmp, which prevents creation of OL4.x containers on hosts > OL6.x. - Move creation of devices into a separate function Signed-off-by:
-
- 30 Apr, 2014 11 commits
-
-
Carlo Landmeter authored
Signed-off-by:
Carlo Landmeter <clandmeter@gmail.com> Acked-by:
-
S.Çağlar Onur authored
Signed-off-by:
-
Stéphane Graber authored
Signed-off-by: -
Serge Hallyn authored
/proc/sys/kernel/sem* and /proc/sys/kernel/msg* are ipc sysctls which are properly namespaced. Allow writes to them from containers. Reported-by:
Dan Kegel <dank@kegel.com> Signed-off-by:
-
S.Çağlar Onur authored
According to Serge, we no longer need to keep cgmanager connection open. As long as my tests go it seems to be working fine. Signed-off-by:
-
Dwight Engen authored
This change accepts all the same strings for lxc.arch that setarch(8) does. Note that we continue to parse plain x86 as PER_LINUX32 so as not to break existing lxc configuration files. Signed-off-by:
-
Serge Hallyn authored
Failures were being ignored, leading up to an eventual segfault. Signed-off-by:
-
KATOH Yasufumi authored
This only converts punctuation marks from FULLWIDTH COMMA/FULL STOP to IDEOGRAPHIC COMMA/FULL STOP in Japanese man pages. The contents of man pages do not change at all. Signed-off-by:
-
Dwight Engen authored
I inadvertently introduced this with commit 8bf1e61e. Signed-off-by:
-
Michael H. Warfield authored
Check for symlinks before attempting create. When attempting to create the compulsory symlinks in /dev, check for the existence of the link using stat first before blindly attempting to create the link. This works around an apparent quirk in the kernel VFS on read-only file systems where the returned error code might be EEXIST or EROFS depending on previous access to the /dev directory and its entries. Reported-by:
William Dauchy <william@gandi.net> Signed-off-by:
Michael H. Warfield <mhw@WittsEnd.com> Tested-by:
-
Serge Hallyn authored
If you 'ip netns add x1', this creates /run/netns and /run/netns/x1 as shared mounts. When a container starts, it umounts these after pivot_root, and the umount is propagated to the host. Worse, doing mount("", "/", NULL, MS_SLAVE|MS_REC, NULL) does not suffice to change those, even after binding /proc/mounts onto /etc/mtab. So, I give up. Do this manually, walking over /proc/self/mountinfo and changing the mount propagation on everything marked as shared. With this patch, lxc-start no longer unmounts /run/netns/* on the host. Signed-off-by:
-
