Skip to content

L
lxc
Switch branch/tag
  1. 19 Feb, 2013 2 commits
  3. 18 Feb, 2013 4 commits
  5. 13 Feb, 2013 1 commit
  7. 11 Feb, 2013 6 commits
    • Update Lua API · 83c98d82
      Dwight Engen authored 
      Add [gs]et_config_path from API to Lua binding. Add additional optional
parameter to container_new(). Add tests for these new Lua API bindings.
Commit 2a59a681 changed the meaning of lxc_path_get() in the binding,
causing lua script breakage. Reinstate original behavior of
lxc_path_get() and rename it to lxc_default_config_path_get() to make
its intent clearer.
Signed-off-by: 's avatarDwight Engen <dwight.engen@oracle.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • pass lxcpath to lxc_command · 13f5be62
      Serge Hallyn authored 
      The previous lxcpath patches added support for a custom LXCPATH set
through a system-wide configuration file.

This was also exposed through the C api, so that a custom lxcpath could
be set at the container object instanciation time, or set at runtime.

However the command sock filename was always located under the global
lxcpath, which could be confusing, and would be a problem for users
with insufficient perms to the system-wide lxc path (i.e. if setting
lxcpath to $HOME/lxcbase).  This patch changes that by passing the
lxcpath to all callers of lxc_command().

It remains to add an lxcpath command line argument to most of the
command line tools (which are not using the C api) - lxc-start,
lxc-info, lxc-stop, etc.

At this point it becomes tempting to do something like

	c = lxc.Container("r1", "/var/lib/lxc")
	c2 = lxc.Container("r1", "$HOME/lxcbase")

However, that's problematic - those two will use the same directory
names for cgroup directories.

What would be the best way to handle this?  One way (which I kind
of like) is to give up on naming the cgroups after the container.
use mkstemp for the cgroup name, let lxc keep track of the cgroup
name based on the command socket, and make users use lxc-cgroup to get
and change settings.

Other ideas?
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • python-lxc: Update for new calls · edb09f8d
      Stéphane Graber authored 
      Add the two new calls to the API and add the new container_path
parameter to the constructor (optional).

This also extends list_containers to support the config_path parameter.
At this point none of the actual tools are changed to make use of those
as we'll probably want to make sure all the tools get the extra option
at once.
Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
Tested-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
    • lxc api: fix some config_path oddities · afeecbba
      Serge Hallyn authored 
      1. When calling c->set_config_path(), update configfile.  I.e. if we
are setting the config_path to /var/lib/lxc, then the configfile should
be changed to /var/lib/lxc/$container/config

2. Add an optional configpath argument to lxc_container_new.  If NULL,
then the default will be used (as before).  If set, then the passed-in
path will be used.  This way you can do

	c1 = lxc.Container("r1", "/var/lib/lxc");
	c2 = lxc.Container("r2", "/home/user/lxcbase");

(Note I did *not* implement the python or lua binding to pass that
argument along)
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • lxc-create: Improve the layout of the config · 35fef4e6
      Stéphane Graber authored 
      This simply adds an extra blank line between the original lxc config
and the template generated options.

In typical use cases, this means that we'll now get the header, then
a blank line, then default.conf content, then a blank line and finally
the template generated config.

The wording of the header is also changed slightly so that it fits in
the usual 80 columns.
Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
    • Add missing manpages · 4019712d
      Stéphane Graber authored 
      This introduces manpages for:
 - lxc-checkconfig
 - lxc-device
 - lxc-info
 - lxc-netstat
 - lxc-shutdown (wasn't in Makefile)
 - lxc-start-ephemeral
 - lxc-version

This commit also sorts configure.ac and Makefile.am.
Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
  9. 08 Feb, 2013 6 commits
  11. 06 Feb, 2013 2 commits
  13. 28 Jan, 2013 5 commits
    • Add missing option -t/--fstype. · c9f8b985
      Tomohiro Matsuyama authored 
      Signed-off-by: 's avatarTomohiro Matsuyama <tomo@cx4a.org>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • add lua binding for the lxc API · f080ffd7
      Dwight Engen authored 
      The lua binding is based closely on the python binding. Also included are
a test program for excercising the binding, and an lxc-top utility for
showing statistics on running containers.
Signed-off-by: 's avatarDwight Engen <dwight.engen@oracle.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • setup_mount_entries: ignore mount failure if 'optional' · 68c152ef
      Serge Hallyn authored 
      If 'optional' is in the mount options, then avoid failure in
mount().

Experiments suggest we could just do this checking data at
mount_entry(), but that feels less proper than using
hasmntopt() against the mntent.
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • use a default per-container logfile · 5e1e7aaf
      Serge Hallyn authored 
      Until now, if a lxc-* (i.e. lxc-start) command did not specify a logfile
(with -o logfile), the default was effectively 'none'.  With this patch,
the default becomes a per-container log file.

If a container config file specifies 'lxc.logfile', that will override
the default.  If a '-o logfile' argument is specifed at lxc-start,
then that will override both the default and the configuration file
entry.  Finally, '-o none' can be used to avoid having a logfile at
all (in other words, the previous default), and that will override
a lxc.logfile entry in the container configuration file.

If the user does not have rights to open the default, then 'none' will
be used.  However, in that case an error will show up on console.  (We
can work on removing that if it annoys people, but I think it is
helpful, at least while we're still ironing this set out)  If the user
or container configuration file specified a logfile, and the user does
not have rights to open the default, then the action will fail.

One slight "mis-behavior" which I have not fixed (and may not fix) is
that if a lxc.logfile is specified, the default logfile will still
get created before we read the configuration file to find out there
is a lxc.logfile entry.

changelog:  Jan 24:

 add --enable-configpath-log configure option

 When we log to /var/lib/lxc/$container/$container.log, several things
 need to be done differently than when we log into /var/log/lxc (for
 instance).  So give it a configure option so we know what to do

 When the user specifies a logfile, we bail if we can't open it.  But
 when opening the default logfile, the user may not have rights to
 open it, so in that case ignore it and continue as if using 'none'.

 When using /var/lib/lxc/$c/$c.log, we use $LOGPATH/$name/$name.log.
 Otherwise, we use $LOGPATH/$name.log.

 When using /var/lib/lxc/$c/$c.log, don't try to create the log path
 /var/lib/lxc/$c.  It can only not exist if the container doesn't
 exist.  We don't want to create the directory in that case.  When
 using /var/log/lxc, then we do want to create the path if it does
 not exist.
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • oracle template: fix sudo lxc-create on ubuntu · 1ff8a460
      Dwight Engen authored 
      rpm on ubuntu puts the rpm db under $HOME, which wont be /root if
sudo is used
Signed-off-by: 's avatarDwight Engen <dwight.engen@oracle.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
  15. 23 Jan, 2013 3 commits
  17. 22 Jan, 2013 4 commits
  19. 21 Jan, 2013 1 commit
  21. 15 Jan, 2013 6 commits
    • conf.c: Cast st_uid and st_gid to int · 20087962
      Stéphane Graber authored 
      In eglibc st_uid and st_gid are defined as unsigned integers, in bionic those
are defined as unsigned long (which is inconsistent with the kernel's
defintion that's uint_32).

To workaround this problem, simply cast those two to int.
Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
    • lxc-oracle.in: Clear trailing whitespaces · b3ef6e16
      Stéphane Graber authored 
      A quick scan through the code showed that lxc-oracle.in is the only
file in the branch containing trailing whitespaces, this clears them.
Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • Add Dropbear SSH support for lxc-busybox template · c94e60d1
      Purcareata Bogdan-B43198 authored 
      Dropbear implements lightweight SSH2 server and client functionality and
is likely to be included in embedded Linux distros.
Signed-off-by: 's avatarPurcareata Bogdan <B43198@freescale.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • Implement userid mappings (enable user namespaces) · f6d3e3e4
      Serge Hallyn authored 
      The 3.8 kernel now supporst uid mappings, so I believe it's appropriate
to proceed with this patchset.
The container config supports new entries of the form:
 lxc.id_map = U 100000 0 10000
 lxc.id_map = G 100000 0 10000
meaning map 'virtual' uids (in the container) 0-10000 to uids
100000-110000 on the host, and same for gids.  So long as there are
mappings specified in the container config, then CONFIG_NEWUSER will
be used when the container is cloned.  This means that container
setup is no longer done with root privilege on the host, only root
privilege in the container.  Therefore cgroup setup is moved from the
init task to the monitor task.

To use this patchset, you currently need to either use the raring
kernel at ppa:serge-hallyn/usern-natty, or build your own kernel
from either git://kernel.ubuntu.com/serge/quantal-userns.git.
(Alternatively you can use Eric's tree at the latest userns-always-map-*
branch at
git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git
but you will likely want to at least enable tmpfs mounts in user namespaces)

You also need to chown the files in the container rootfs into the
mapped range.  There is a utility at
https://code.launchpad.net/~serge-hallyn/+junk/nsexec to do this.
uidmapshift does the chowning, while the container-userns-convert
script nicely wraps that program.  So I simply

	sudo lxc-create -t ubuntu -n r1
	sudo container-userns-convert r1 200000

will create a container which is shifted so uid 0 in the container
is uid 200000 on the host.

TODO: when doing setuid(0), need to only do that if 0 is one of the
ids we map to.  Similarly, when dropping capabilities, need to only
not do that if 0 is one of the ids we map to.  However, the question
of what to do for 'weird' containers in private user namespaces is
one I'm punting for later.
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • setup cgroups from parent · 544a48a0
      Serge Hallyn authored 
      This is a first step to enabling user namespaces.  When starting a
container in a new user namespace, the child will not have the
rights to write to the cgroup fs.  (We can give it that right, but
don't always want to have to).

At the parent, we don't want to setup_cgroups() before the child
has set itself up.  But we also don't want to wait until it has
started running it's init, since that is racy.

Therefore introduce a new sync point.  The child will let the
parent know when it is ready to be confined, and wait for the
parent to respond that it has done so.  Then the child will finish
constraining itself with LSM and seccomp and execute init.
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • clean up syncs · c4ea60df
      Serge Hallyn authored 
      Always unblock parent when child setup fails, rather than just
exiting.

Also remove a duplicate call to setup_cgroup().  We'll want it
close to there for userns, but not right there - that's too late,
and could happen after container init has done something bad
without cgroup restrictions.
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>