Skip to content

L
lxc
Switch branch/tag
  1. 26 Feb, 2012 6 commits
    • Fix several nagging bugs in lxc-destroy · 76e08ff8
      Serge Hallyn authored 
      Don't delete a running container.  If it's running, abort the delete
unless a new '-f' (force) flag is given, in which case, stop it first.

Handle the case where we can't find $rootfs in config

Fix broken detection of lvm backing store
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • Support nested cgroups · d08ba6ec
      Serge Hallyn authored 
      With this patch, I can start a container 'o1' inside another container 'o1'.
(Of course, the containers must be on a different subnet)

Detail:

1. Create cgroups for containers under /lxc.

2. Support nested lxc: respect init's cgroup:

Create cgroups under init's cgroup.  So if we start a container c2
inside a container 'c1', we'll use /sys/fs/cgroup/freezer/lxc/c1/lxc/c2
instead of /sys/fs/cgroup/freezer/c2.  This allows a container c1
to be created inside container c1  It also allow a container's limits
to be enforced on all a container's children (which a MAC policy could
already enforce, in which case current lxc code would be unable to nest
altogether).

3. Finally, if a container's cgroup already exists, rename it rather than
failing to start the container.  Try to WARN the user so they might go
clean the old cgroup up.

Whereas without this patch, container o1's cgroup would be
	/sys/fs/cgroup/<subsys>/o1,
it now becomes
	/sys/fs/cgroup/<subsys>/<initcgroup>/lxc/o1
so if init is in cgroup '/' then o1's freezer cgroup would be:
	/sys/fs/cgroup/freezer/lxc/o1

Changelog:
	. make lxc-ps work with separate mtab.  If cgroups were mounted with -n,
	  and mtab is not linked to /proc/self/mounts, then 'mount -t cgroup' won't
	  show these mounts.  So make lxc-ps not use it, but rather use
	  /proc/self/mounts directly.
	. lxc-ls in the past assumed that a container's cgroup was just '/<name>'.
	  Now it is '/<host-init-cgroup>/lxc/<name>'.  Handle that.
	. first version of this patch was setting clone_children on
	  <path-to-cpusets-cgroup>/<init-cgroup>/lxc, not the parent of that dir.
	  That failed to initialize that cgroup, so tasks could not enter it.
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • lxc-ubuntu: use release-updates and release-security · 2e44ed1e
      Serge Hallyn authored 
      Particularly for LTS releases, which many people will want to use in
their containers, it is not wise to not use -security and -updates.
Furthermore the fix allowing ssh to allow the container to shut down
is in lucid-updates only.

With this patch, after debootstrapping a container, we add -updates
and -security to sources.list and do an apt-get upgrade under chroot.
Unfortunately we need to do this because debootstrap doesn't know how
to.
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • lxc-ubuntu: add /dev/full, /dev/hpet, and /dev/kvm to devices whitelist · 2407e68e
      Serge Hallyn authored 
      Thanks for Scott Moser for these, which allows qemu to run inside a container.
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • drop mac_admin and mac_override · e2268833
      Serge Hallyn authored 
      mac_admin stops the container from loading LSM policy.  Neither
selinux nor apparmor currently will do well with automatic namespacing
of policy (though it's coming in apparmor, after which we can re-enable
this).
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
    • Add new 'precise' release to ubuntu template · fdcde5b6
      Serge Hallyn authored 
      Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
  3. 25 Feb, 2012 1 commit
  5. 23 Feb, 2012 15 commits
  7. 05 Jan, 2012 9 commits
  9. 18 Nov, 2011 1 commit
  11. 10 Nov, 2011 5 commits
  13. 28 Oct, 2011 3 commits