attach: try to always drop supplementary groups

rootfs pinning: On NFS, make file hidden but don't delete it

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

attach: always drop supplementary groups

Closes #2248.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Mergeable branch for C0deAi fixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #2262.
Signed-off-by: C0deAi <techsupport@mycode.ai>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #2262.
Signed-off-by: C0deAi <techsupport@mycode.ai>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Value stored is never read.

Closes #2262.
Signed-off-by: C0deAi <techsupport@mycode.ai>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #1704.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fix compilation with static libcap and shared gnutls

Commit c06ed219 has broken
compilation with a static libcap and a shared gnutls.
This results in a build failure on init_lxc_static if gnutls is
a shared library as init_lxc_static is built with -all-static option
(see src/lxc/Makefile.am) and AC_CHECK_LIB adds gnutls to LIBS.

This commit fix the issue by removing default behavior of AC_CHECK_LIB
and handling manually GNUTLS_LIBS and HAVE_LIBGNUTLS

Fixes:
 - http://autobuild.buildroot.net/results/b655d6853c25a195df28d91512b3ffb6c654fc90Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Fix temp file creation

lxc_make_tmpfile() uses mkstemp() internally, and thus expects the
template to contain 'XXXXXX' and be writable.
Signed-off-by: Thomas Moschny <thomas.moschny@gmx.de>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc_make_tmpfile() uses mkstemp() internally, and thus expects the
template to contain 'XXXXXX' and be writable.
Signed-off-by: Thomas Moschny <thomas.moschny@gmx.de>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

On NFS, avoid random names of the root pin file due to "NFS silly renaming" but use a fixed hidden name instead.

fix signal sending in lxc.init

The problem here is that these two clauses were ordered backwards: we first
check if the signal came from not the init pid, and if it did, then we give
a notice and return. The comment notes that this is intended to protect
against SIGCHLD, but we don't in fact know if the signal is a SIGCHLD yet,
because that's tested in the next hunk.

The symptom is that if I e.g. send SIGTERM from the outside world to the
container init, it ignores it and gives this notice. If we re-order these
clauses, it forwards non SIGCHLD signals, and ignores SIGCHLD signals from
things that aren't the real container process.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>

doc: Tweak Japanese translation in lxc.container.conf(5)

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

Signed-off-by: Fengtu Wang <wangfengtu@huawei.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: expand lxc.environment

When a bare environment variable is specified then retrieve the value from the
current environment. For example, setting

lxc.environment = PATH

will cause LXC to inherit the value of PATH from the current environment.
Suggested-by: Jonathan Calmels <jcalmels@nvidia.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bugfixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

If they aren't available fallback to BSD flock()s.

Closes #2245.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxc-oci: cmd parsing and less verbose umoci

Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Don't use the -r option of jq, since it will strip the double quotes.

Fixes: #2195
Signed-off-by: Felix Abecassis <fabecassis@nvidia.com>

Closes #2241.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #2242.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Allow passing action scripts to CRIU

Closes #2236.
Signed-off-by: Eytan Heidingsfeld <eytanh@gmail.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

configure.ac: Support redhatenterpriseserver

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

start: always make us dumpable