Skip to content

L
lxc
Switch branch/tag
  1. 15 Oct, 2014 4 commits
  3. 13 Oct, 2014 1 commit
  5. 09 Oct, 2014 3 commits
  7. 08 Oct, 2014 8 commits
    • systemd/selinux init scripts fixups · f3b8088d
      Dwight Engen authored 
      - RHEL/OL 7 doesn't have the ifconfig command by default so have the
  lxc-net script check for its existence before use, and fall back
  to using the ip command if ifconfig is not available

- When lxc-net is run from systemd on a system with selinux enabled,
  the mkdir -p ${varrun} will create /run/lxc as init_var_run_t which
  dnsmasq can't write its pid into, so we restorecon it
  after creation (to var_run_t)

- The lxc-net systemd .service file needs an [Install] section so that
  "systemctl enable lxc-net" will work
Signed-off-by: 's avatarDwight Engen <dwight.engen@oracle.com>
    • lxc-checkpoint: close stdout/stdin when daemonizing · 7943ec56
      Tycho Andersen authored 
      If we don't close these running lxc-checkpoint via:

ssh host "sudo lxc-checkpoint ..."

just hangs. We leave stderr open so that subesquent errors will print correctly
(and also because for whatever reason it doesn't break ssh :).

Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
    • restore: create cgroups for criu · 2ba7a429
      Tycho Andersen authored 
      Previously, we let criu create the cgroups for a container as it was restoring
things. In some cases (i.e. migration across hosts), if the container being
migrated was in /lxc/u1-3, it would be migrated to the target host in
/lxc/u1-3, even if there was no /lxc/u1-2 (or worse, if there was already an
alive container in u1-3).

Instead, we use lxc's cgroup_create, and then tell criu where to restore to.
Signed-off-by: 's avatarTycho Andersen <tycho.andersen@canonical.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
    • restore: Hoist handler to function level · dbb51a43
      Tycho Andersen authored 
      On Tue, Oct 07, 2014 at 07:33:07PM +0000, Tycho Andersen wrote:
> This commit is in preparation for the cgroups create work, since we will need
> the handler in both the parent and the child. This commit also re-works how
> errors are propagated to be less verbose.

Here is an updated version:

From 941623498a49551411ccf185146061f3f37d3a67 Mon Sep 17 00:00:00 2001
From: Tycho Andersen <tycho.andersen@canonical.com>
Date: Tue, 7 Oct 2014 19:13:51 +0000
Subject: [PATCH 1/2] restore: Hoist handler to function level

This commit is in preparation for the cgroups create work, since we will need
the handler in both the parent and the child. This commit also re-works how
errors are propagated to be less verbose.

v2: rename error to has_error, handle it correctly, and remove some diff noise
Signed-off-by: 's avatarTycho Andersen <tycho.andersen@canonical.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
    • criu: DECLARE_ARG should check for null arguments · 2566a145
      Tycho Andersen authored 
      This is in preparation for the cgroups creation work, but also probably just a
good idea in general. The ERROR message is handy since we print line nos. it
will to give people an indication of what arg was null.
Signed-off-by: 's avatarTycho Andersen <tycho.andersen@canonical.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
    • lxc-test-unpriv: don't clear out /etc/lxc/lxc-usernet · 9a64d3cf
      Serge Hallyn authored 
      Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
    • lxc: don't call pivot_root if / is on a ramfs · 91e93c71
      Andrey Vagin authored 
      pivot_root can't be called if / is on a ramfs. Currently chroot is
called before pivot_root. In this case the standard well-known
'chroot escape' technique allows to escape a container.

I think the best way to handle this situation is to make following actions:
* clean all mounts, which should not be visible in CT
* move CT's rootfs into /
* make chroot into /

I don't have a host, where / is on a ramfs, so I can't test this patch.
Signed-off-by: 's avatarAndrey Vagin <avagin@openvz.org>
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
    • cgmanager: several fixes · 956f113b
      Serge Hallyn authored 
      These all fix various ways that cgroup actions could fail if an
unprivileged user's cgroup paths were not all the same for all
controllers.

1. in cgm_{g,s}et, use the right controller, not the first in the list,
   to get the cgroup path.

2. when we pass 'all' to cgmanager for a ${METHOD}_abs, make sure that all
   cgroup paths are the same.  That isn't necessary for methods not
   taking an absolute path, so split up the former
   cgm_supports_multiple_controllers() function into two booleans, one
   telling whether cgm supports it, and another telling us whether
   cgm supports it AND all controller cgroup paths are the same.

3. separately, do_cgm_enter with abs=true couldn't work if all
   cgroup paths were not the same.  So just ditch that helper and
   call lxc_cgmanager_enter() where needed, because the special
   cases would be more complicated.
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
  9. 06 Oct, 2014 1 commit
  11. 02 Oct, 2014 1 commit
  13. 01 Oct, 2014 1 commit
  15. 29 Sep, 2014 5 commits
  17. 26 Sep, 2014 1 commit
    • Rework init scripts · 0af99319
      Michael H. Warfield authored 
      This commit is based on the work of:
Signed-off-by: 's avatarMichael H. Warfield <mhw@WittsEnd.com>

A generic changelog would be:
 - Bring support for lxcbr0 to all distributions
 - Share the container startup and network configuration logic across
   distributions and init systems.
 - Have all the init scripts call the helper script.
 - Support for the various different distro-specific configuration
   locations to configure lxc-net and container startup.

Changes on top of Mike's original version:
 - Remove sysconfig/lxc-net as it's apparently only there as a
   workaround for an RPM limitation and is breaking Debian systems by
   including a useless file which will get registered as a package provided
   conffile in the dpkg database and will therefore cause conffile prompts
   on upgrades...
 - Go with a consistant coding style in the various init scripts.
 - Split out the common logic from the sysvinit scripts and ship both in
   their respective location rather than have them be copies.
 - Fix the upstart jobs so they actually work (there's no such thing as
   libexec on Debian systems).
Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
  19. 25 Sep, 2014 2 commits
  21. 24 Sep, 2014 7 commits
  23. 23 Sep, 2014 4 commits
  25. 22 Sep, 2014 2 commits