- 21 Sep, 2015 5 commits
-
-
Tycho Andersen authored
Here's some more config options that we do actually require to be able to boot containers. Signed-off-by:
Tycho Andersen <tycho.andersen@canonical.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Serge Hallyn authored
Closes #655 We can't rsync the delta as unpriv user because we can't create the chardevs representing a whiteout. We can however rsync the rootfs and have the kernel create the whiteouts for us. do_rsync: pass --delete Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Christian Brauner authored
Signed-off-by:
Christian Brauner <christianvanbrauner@gmail.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Serge Hallyn authored
Newer kernels have added a new restriction: if /proc or /sys on the host has files or non-empty directories which are over-mounted, and there is no /proc which fully visible, then it assumes there is a "security" reason for this. It prevents anyone in a non-initial user namespace from creating a new proc or sysfs mount. To work around this, this patch adds a new 'nesting.conf' which can be lxc.include'd from a container configuration file. It adds a non-overmounted mount of /proc and /sys under /dev/.lxc, so that the kernel can see that we're not trying to *hide* things like /proc/uptime. and /sys/devices/virtual/net. If the host adds this to the config file for container w1, then container w1 will support unprivileged child containers. The nesting.conf file also sets the apparmor profile to the with-nesting variant, since that is required anyway. This actually means that supporting nesting isn't really more work than it used to be, just different. Instead of adding lxc.aa_profile = lxc-container-default-with-nesting you now just need to lxc.include = /usr/share/lxc/config/nesting.conf (Look, fewer characters :) Finally, in order to maintain the current apparmor protections on proc and sys, we make /dev/.lxc/{proc,sys} non-read/writeable. We don't need to be able to use them, we're just showing the kernel what's what. Signed-off-by:Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
KATOH Yasufumi authored
Add the description of optional, create=file/dir for lxc.mount.entry. This is update for commit f5b67b36. Signed-off-by:
KATOH Yasufumi <karma@jazz.email.ne.jp> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
- 15 Sep, 2015 3 commits
-
-
Serge Hallyn authored
First, fix use of uninitialized variable 'ret'. Then, actually use the value it returned in its caller. Signed-off-by:Serge Hallyn <serge.hallyn@ubuntu.com>
-
Major Hayden authored
On very busy systems, some virtual network devices won't be destroyed after a container halts. This patch uses the lxc_delete_network() method to ensure that network devices attached to the container are destroyed when the container halts. Without the patch, some virtual network devices are left over on the system and must be removed with `ip link del <device>`. This caused containers with lxc.network.veth.pair to not be able to start. For containers using randomly generated virtual network device names, the old devices will hang around on the bridge with their original MAC address. Signed-off-by:Major Hayden <major@mhtx.net>
-
Stéphane Graber authored
Signed-off-by:
Stéphane Graber <stgraber@ubuntu.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
- 28 Aug, 2015 32 commits
-
-
Christian Brauner authored
"NAME for name of the container" becomes "NAME of the container" Signed-off-by:
Christian Brauner <christianvanbrauner@gmail.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Christian Brauner authored
- Passing the LXC_CLONE_KEEPNAME flag to do_lxcapi_clone() was not respected and let to unexpected behaviour for e.g. lxc-clone. We wrap clear_unexp_config_line() and set_config_item_line() in an appropriate if-condition. Signed-off-by:
Christian Brauner <christianvanbrauner@gmail.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Nicolas Cornu authored
Signed-off-by:Nicolas Cornu <nicolac76@yahoo.fr>
-
Nicolas Cornu authored
Signed-off-by:Nicolas Cornu <ncornu@aldebaran.com>
-
Nicolas Cornu authored
Signed-off-by:Nicolas Cornu <ncornu@aldebaran.com>
-
Michal Grzedzicki authored
Signed-off-by:Michał Grzędzicki <lazy404@gmail.com>
-
Wolfgang Bumiller authored
When setting lxc.network.veth.pair to get a fixed interface name the recreation of it after a reboot caused an EEXIST. -) The reboot flag is now a three-state value. It's set to 1 to request a reboot, and 2 during a reboot until after lxc_spawn where it is reset to 0. -) If the reboot is set (!= 0) within instantiate_veth and a fixed name is used, the interface is now deleted before being recreated. Signed-off-by:
Wolfgang Bumiller <w.bumiller@proxmox.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Stéphane Graber authored
This fixes some typos, missing newlines and unflushed output leading to duplicate entries when piped (similar to what we had in lxc-info). Reported-by: Marc Gariépy Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
When starting a daemonized container, only the original parent thread should return to the caller. The first forked child immediately exits after forking, but the grandparent child was in some places returning on error - causing a second instance of the calling function. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Tycho Andersen <tycho.andersen@canonical.com>
-
Dennis Schridde authored
The dev/mqueue and dev/shm directories do not exist when using lxc.autodev, thus they have to be created upon mount. Signed-off-by:Dennis Schridde <devurandom@gmx.net>
-
有张纸 authored
-
Tycho Andersen authored
In various places throughout the code, we want to "nullify" the std fds, opening them to /dev/null or zero or so. Instead, let's unify this code and do it in such a way that Coverity (probably) won't complain. v2: use /dev/null for stdin as well v3: add a comment about use of C's short circuiting v4: axe comment, check errors on dup2, s/quiet/need_null_stdfds Reported-by: Coverity Signed-off-by:
Tycho Andersen <tycho.andersen@canonical.com> Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Serge Hallyn authored
and don't use it if not. This fixes failure to build with older cgmanager. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
Doing this requires some btrfs functions from bdev to be used in utils.c Because utils.h is imported by lxc_init.c, I had to create a new initutils.[ch] which are used by both lxc_init.c and utils.c We could instead put the btrfs functions into utils.c, which would be a shorter patch, but it really doesn't belong there. So I went the other way figuring there may be more such cases coming up of fns in utils.c needing code from bdev.c which can't go into lxc_init. Currently, if we detect a btrfs subvolume we just remove it. The st_dev on that dir is different, so we cannot detect if this is bound in from another fs easily. If we care, we should check whether this is a mountpoint, this patch doesn't do that. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
Signed-off-by:Serge Hallyn <serge.hallyn@ubuntu.com>
-
Kien Truong authored
We need to use lxc_list_for_each_safe, otherwise de-allocation will fail with a list size bigger than 2. The pointer to the head of the list also need freeing after we've freed all other elements of the list. Signed-off-by:Kien Truong <duckientruong@gmail.com>
-
Kien Truong authored
Signed-off-by:Kien Truong <duckientruong@gmail.com>
-
Kien Truong authored
Add a function to sort the cgroup settings before applying. Currently, the function will put memory.memsw.limit_in_bytes after memory.limit_in_bytes setting so the container will start regardless of the order specified in the input. Fix #453 Signed-off-by:Kien Truong <duckientruong@gmail.com>
-
Natanael Copa authored
This is needed for lxc.autodev=1 to work. Signed-off-by:
Natanael Copa <ncopa@alpinelinux.org> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Stéphane Graber authored
If an unprivileged ephemeral container is started as follows, lxc-start-ephemeral -o trusty -n test_ephemeral Then an empty directory remains upon exit from the container, ~/.local/share/lxc/test_ephemeral/tmpfs/delta0 (The tmpfs filesystem is successfully unmounted, but we seem to lack permission to delete the delta0 directory). This issue arose following commits 4799a1e7 and dd2271e6 . The following patch resolves the issue. It has been tested on ubuntu 14.04 with the lxc-daily ppa. Since gmail screws up the formatting of the patch via line-wrapping etc, please copy the patch from the issue-tracker rather than from this email. Signed-off by: Oleg Freedholm <overlayfs@gmail.com> Acked-by:Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
One of the 'features' of overlayfs is that depending on whether a file is on the upper or lower dir you get back a different device from stat. That breaks our lxc_rmdir_onedev. So at lxc_rmdir_ondev check the device of the directory being deleted. If it is overlayfs, then skip the device check. Note this is unrelated to overlayfs snapshots - in those cases when you delete a container, /var/lib/lxc/$container/ does not actually have an overlayfs under it. Rather, to reproduce this you would sudo mkdir /opt/{lower,upper,workdir} sudo mount -t overlayfs -o lower=/opt/lower,upper=/opt/upper,workdir=/opt/workdir \ lxc /var/lib/lxc sudo lxc-create -t download -n c1 -- -d ubuntu -r trusty -a amd64 sudo lxc-destroy -n c1 Signed-off-by:Serge Hallyn <serge.hallyn@ubuntu.com> Tested-by:
Marko Ratkaj <marko.ratkaj@sartura.hr> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Markos Chandras authored
/dev/shm needs to be mounted as tmpfs. It's needed by python and possibly other packages. Signed-off-by:Markos Chandras <hwoarang@gentoo.org>
-
Stéphane Graber authored
Close #421 Signed-off-by:
Stéphane Graber <stgraber@ubuntu.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Tomas Pospisek authored
- document environment variables - add missing --packages switch to command line - describe how to pass template options to lxc-create (since lxc-create -h doesn't tell you) - render help text in the same pretty format as lxc-create does Signed-off-by:
Tomáš Posíšek <tpo_deb@sourcepole.ch> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Johannes Kastl authored
Ensures matching versions of lxc and lxc-libs being installed Signed-off-by:
Johannes Kastl <mail@ojkastl.de> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Markus Elfring authored
The following functions return immediately if a null pointer was passed. * container_destroy * lxc_cgroup_process_info_free_and_remove * lxc_cgroup_put_meta * toss_list It is therefore not needed that a function caller repeats a corresponding check. This issue was fixed by using the software Coccinelle 1.0.0-rc23. Signed-off-by:
Markus Elfring <elfring@users.sourceforge.net> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Markus Elfring authored
The function "free" is documented in the way that no action shall occur for a passed null pointer. It is therefore not needed that a function caller repeats a corresponding check. http://stackoverflow.com/questions/18775608/free-a-null-pointer-anyway-or-check-first This issue was fixed by using the software Coccinelle 1.0.0-rc23. Signed-off-by:
Markus Elfring <elfring@users.sourceforge.net> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Stéphane Graber authored
This defines a missing variable and re-indents the code a bit. Signed-off-by:
Stéphane Graber <stgraber@ubuntu.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Serge Hallyn authored
It turns out that the new upstream overlay fs requires that the delta and work dirs be under the same mount. So create a $lxcpath/tmpfs and create delta0 and work0 under that. If the user asks for a tmpfs that'll be mounted under $lxcpath/tmpfs and workdir and delta0 both created under that. This isn't heavily tested. But if fixes mounting of 'overlay' fs for me. It's "not backward compatible", since it moves delta0, but that shouldn't matter since ephemeral containers are either destroyed on exit, or re-started with lxc-start. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
We fixed this some time ago for basic lxc-start, but never did lxc-start-ephemeral. Since the lxc-start patches were pushed, Miklos has given us a way to detect whether we need the workdir= option. So the bdev.c code could be simplified to check for "overlay\n" in /proc/filesystems just as lxc-start-ephemeral does. This patch doesn't do that. Changelog (v2): 1. use 'overlay' fstype for new overlay upstream module 2. avoid using unneeded readlines(). Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
David Noyes authored
Signed-off-by:David Noyes <david.j.noyes@gmail.com>
-
David Noyes authored
Signed-off-by:David Noyes <david.j.noyes@gmail.com>
-