- 19 Dec, 2014 4 commits
-
-
Serge Hallyn authored
In contrast to what the comment above the line disabling it said, it seems to work just fine. It also is needed on current kernels (until Eric's patch hits upstream) to prevent unprivileged containers from hosing fuse filesystems they inherit. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
If a container has a bind mount from a host nfs or fuse filesystem, and does 'umount -f', it will disconnect the host's filesystem. This patch adds a seccomp rule to block umount -f from a container. It also adds that rule to the default seccomp profile. Thanks stgraber for the idea :) Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Johannes Kastl authored
lxc-opensuse: Disable building openSUSE containers on 13.2/Tumbleweed only if wrong version of build package is installed Signed-off-by:
Johannes Kastl <git@ojkastl.de> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Johannes Kastl authored
Signed-off-by:
Johannes Kastl <git@ojkastl.de> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
- 05 Dec, 2014 1 commit
-
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
- 04 Dec, 2014 4 commits
-
-
https://github.com/vlajos/misspell_fixerVeres Lajos authored
Signed-off-by:
Veres Lajos <vlajos@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
S.Çağlar Onur authored
Signed-off-by:
S.Çağlar Onur <caglar@10ur.org> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Shuai Zhang authored
There are now two (permitted) ways to add data to netlink message: 1. put_xxx() 2. call nlmsg_reserve() to get a pointer to newly reserved room within the original netlink message, then write or memcpy data to that area. Both of them guarantee adding requested length data do not overflow the pre-allocated message buffer by checking against its cap field first. And there may be no need to access nlmsg_len outside nl module, because both put_xxx() and nlmsg_reserve() have alread did that for us. Signed-off-by:Shuai Zhang <zs.broccoli@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Arjun Sreedharan authored
when waitpid() is interrupted, errno is not set to the negative value -EINTR. It is set to EINTR. check against EINTR. Signed-off-by:
Arjun Sreedharan <arjun024@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
- 03 Dec, 2014 2 commits
-
-
Shuai Zhang authored
Signed-off-by:
Shuai Zhang <zs.broccoli@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Stéphane Graber authored
The previous error message made it look like the host interface name was the concatenation of both the host and guest interface names. Closes #374 Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
- 02 Dec, 2014 10 commits
-
-
KATOH Yasufumi authored
This commit fixes two issues at the time of clone: * unnecessary directory is created when clone between overlayfs/aufs * clone failed when the end of rootfs path is not "/rootfs" Signed-off-by:
KATOH Yasufumi <karma@jazz.email.ne.jp> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
KATOH Yasufumi authored
This patch creates workdir as "olwork", and retry mount with workdir option when mount is failed. It is used to prepare files before atomically swithing with destination, and needs to be on the same filesystem as upperdir. It's OK for it to be empty. Signed-off-by:
KATOH Yasufumi <karma@jazz.email.ne.jp> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Serge Hallyn authored
Currently when we clone a container, bdev_copy passes NULL as dst argument of bdev_init, then sees bdev->dest (as a result) is NULL, and sets bdev->dest to $lxcpath/$name/rootfs. so $ops->clone_paths() can assume that "/rootfs" is at the end of the path. The overlayfs and aufs clonepaths do assume that and index to endofstring-6 and append delta0. Let's be more robust by actually finding the last / in the path. Then, instead of always setting oldbdev->dest to $lxcpath/$name/rootfs, set it to oldbdev->src. Else dir_clonepaths fails when mounting src onto dest bc dest does not exist. We could also fix that by creating bdev->dest if needed, but that addes an empty directory to the old container. This fixes 'lxc-clone -o x1 -n x2' if x1 has lxc.rootfs = /var/lib/lxc/x1/x and makes the overlayfs and aufs paths less fragile should something else change. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Casey Marshall authored
Ran into this when trying to automate stgraber's "GUI in containers" post. Signed-off-by:
Casey Marshall <casey.marshall@canonical.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Johannes Kastl authored
Signed-off-by:
Johannes Kastl <git@ojkastl.de> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Cameron Norman authored
Signed-off-by:
Cameron Norman <camerontnorman@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Cameron Norman authored
Do as much as possible to allow containers switching from non-systemd to systemd to work as intended (but nothing that will cause side effects). Use update-rc.d disable instead of remove so the init scripts are not re-enabled when the package is updated Signed-off-by:
Cameron Norman <camerontnorman@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Antonio Terceiro authored
Containers with systemd need a somewhat special setup, which I borrowed and adapted from lxc-fedora. These changes are required so that Debian 8 (jessie) containers work properly, and are a no-op for previous Debian versions. Signed-off-by:
Antonio Terceiro <terceiro@debian.org> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Gu1 authored
Fix a typo in the lines inserted in the default sources.list. Change the default mirror to http.debian.net which is (supposedly) more accurate and better than cdn.debian.net for a generic configuration. Use security.debian.org directly for the {release}/updates repository. Signed-off-by:Gu1 <gu1@aeroxteam.fr> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Alexander Dreweke authored
- added --mirror, --security-mirror and --package parameters - generate source.list - install packages into final lxc instance Update by Stéphane Graber for stable-1.0: - Drop the addition of --packages (new feature) Signed-off-by:
Alexander Dreweke <alexander@dreweke.net> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
- 01 Dec, 2014 2 commits
-
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Abin Shahab authored
Bind mounts do not honor filesystem mount options. This change will remount filesystems that are bind mounted if there are changes to filesystem mount options, specifically if the mount is readonly. Signed-off-by:
Abin Shahab <ashahab@altiscale.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
- 27 Nov, 2014 4 commits
-
-
Natanael Copa authored
Create a tty so we get login prompt on console by default Signed-off-by:
Natanael Copa <ncopa@alpinelinux.org> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Natanael Copa authored
Signed-off-by:
Natanael Copa <ncopa@alpinelinux.org> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Shuai Zhang authored
nlmsg_len is the length of message including header. Signed-off-by:
Shuai Zhang <zs.broccoli@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Johannes Kastl authored
Disabled building openSUSE containers on openSUSE 13.2 and openSUSE Tumbleweed due to faulty behaviour with newer versions of init_buildsystem. Signed-off-by:
Johannes Kastl <git@ojkastl.de> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
- 25 Nov, 2014 13 commits
-
-
KATOH Yasufumi authored
Update for commit 0dcbd624Signed-off-by:
KATOH Yasufumi <karma@jazz.email.ne.jp> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Silvio Fricke authored
Closes: #355 Signed-off-by:
Silvio Fricke <silvio.fricke@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
謝致邦 authored
Signed-off-by:
謝致邦 <Yeking@Red54.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
謝致邦 authored
Signed-off-by:
謝致邦 <Yeking@Red54.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
Support creation and use of lxc-cirros by unprivileged users. If we detect we are an unprivileged user, then insist that we be in a userns with a id mapping. If we are in a userns, then don't extract /dev when extracting the rootfs. If we are not root, then save the tarball to ~/.cache/lxc/cirros instead of /var/cache/lxc/cirros. If we are not roo, then include entries to auto-mount proc and sys, as well as bind-mount devices. Cc: Scott Moser <smoser@ubuntu.com> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Joel Nider authored
This is a multipart message in MIME format. Fixes a small (but consistent) spelling mistake in conf.c Signed-off-by:
Joel Nider <joeln@il.ibm.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
Otherwise both resulting takss will print what they had flushed when they exit. This fixes https://bugs.launchpad.net/bugs/1389244Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Tested-by:
Tycho Andersen <tycho.andersen@canonical.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Stéphane Graber authored
Signed-off-by:
Stéphane Graber <stgraber@ubuntu.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
TAMUKI Shoichi authored
Do mkdir $rootfs/dev/shm and then mount tmpfs on /dev/shm. Signed-off-by:
TAMUKI Shoichi <tamuki@linet.gr.jp> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Silvio Fricke authored
We allocate a pointer and save this address in a static variable. After this we freed this pointer and return. Here a cuttout of a valgrind report: [...] ==11568== Invalid read of size 1 ==11568== at 0x4C2D524: strlen (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==11568== by 0x5961C9B: puts (in /usr/lib/libc-2.20.so) ==11568== by 0x400890: main (lxc_config.c:73) ==11568== Address 0x6933e21 is 1 bytes inside a block of size 32 free'd ==11568== at 0x4C2B200: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==11568== by 0x4E654F2: lxc_global_config_value (utils.c:415) ==11568== by 0x4E92177: lxc_get_global_config_item (lxccontainer.c:2287) ==11568== by 0x400883: main (lxc_config.c:71) [...] Signed-off-by:Silvio Fricke <silvio.fricke@gmail.com>
-
Serge Hallyn authored
"all" is not a supported keyword for cgmanager's get_pid_cgroup. Pass the first mounted cgroup subsystem instead of passing "all" when getting the container's cgorup to attach to. Also, make sure that the target cgroup is in fact in all identical cgroups before attaching with 'all". If not, then we must attach to each cgroup separately, or else we will not be in all the same cgroups as the target container. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
If attach is being done over passed-in fds, then we shouldn't mess with the caller's signal table to ignore ctrl-c over the fd. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Sergio Jimenez authored
Signed-off-by:
Sergio Jimenez <tripledes@gmail.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-