- 23 Sep, 2013 6 commits
-
-
Stéphane Graber authored
Signed-off-by:
Stéphane Graber <stgraber@ubuntu.com> Acked-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by:
-
Stéphane Graber authored
Signed-off-by:
-
Stéphane Graber authored
Signed-off-by:
-
Stéphane Graber authored
The API header was included in a variety of ways before, standardize those to "include <lxc/lxccontainer.h>" as this will always work both in tree and on a system with the headers installed. Signed-off-by:
-
Qiang Huang authored
info to help users locate the misconfig. Signed-off-by:
Qiang Huang <h.huangqiang@huawei.com> Acked-by:
-
S.Çağlar Onur authored
Signed-off-by:
S.Çağlar Onur <caglar@10ur.org> Acked-by:
-
- 21 Sep, 2013 1 commit
-
-
S.Çağlar Onur authored
Being able to set close_all_fds via API would be usefull for the situations like running an application (let's say web server) that controls the lifecycle of the container using the LXC API. We don't want forked process to inherit parent's resource (file, socket, ...) Signed-off-by:
-
- 20 Sep, 2013 1 commit
-
-
Serge Hallyn authored
Signed-off-by:
-
- 18 Sep, 2013 4 commits
-
-
Serge Hallyn authored
Signed-off-by:
-
Stéphane Graber authored
Signed-off-by: -
S.Çağlar Onur authored
get_ips accepts an interface name as a parameter but there was no way to get the interfaces names from the container. This patch introduces a new get_interfaces call to the API so that users can obtain the name of the interfaces. Support for python bindings also introduced as a part of this version. Signed-off-by:
-
Serge Hallyn authored
pthread_mutex_lock() will only return an error if it was set to PTHREAD_MUTEX_ERRORCHECK and we are recursively calling it (and would otherwise have deadlocked). If that's the case then log a message for future debugging and exit. Trying to "recover" is nonsense at that point. process_lock() was held over too long a time in lxcapi_start() in the daemonize case. (note the non-daemonized case still needs a check to enforce that it must NOT be called while threaded). Add process_lock() at least across all open/close/socket() calls. Anything done after a fork() doesn't need the locks as it is no longer threaded - so some open/close/dups()s are not locked for that reason. However, some common functions are called from both threaded and non-threaded contexts. So after doing a fork(), do a possibly-extraneous process_unlock() to make sure that, if we were forked while pthread mutex was held, we aren't deadlocked by nobody. Tested that lp:~serge-hallyn/+junk/lxc-test still works with this patch. Signed-off-by:
-
- 16 Sep, 2013 4 commits
-
-
Dwight Engen authored
- add ability to run for multiple iterations - can also run non-threaded for comparison to threaded case Signed-off-by:
Dwight Engen <dwight.engen@oracle.com> Acked-by:
-
Dwight Engen authored
Signed-off-by:
-
Serge Hallyn authored
Signed-off-by: -
Qiang Huang authored
Signed-off-by:
-
- 14 Sep, 2013 3 commits
-
-
Serge Hallyn authored
This should deadlock with daemonized start due to af_unix changes. Do this later, but do it more carefully. This reverts commit 002f3cff.
-
Serge Hallyn authored
Signed-off-by: -
Serge Hallyn authored
Signed-off-by:
-
- 13 Sep, 2013 2 commits
-
-
Serge Hallyn authored
Otherwise user-namespace containers will hang on mountall. Signed-off-by:
-
S.Çağlar Onur authored
use busybox instead of ubuntu to test as it's much more lightweight, also wait containers to enter desired state Signed-off-by:
-
- 12 Sep, 2013 10 commits
-
-
S.Çağlar Onur authored
Signed-off-by:
-
Serge Hallyn authored
Signed-off-by:
-
Christian Seiler authored
Chane pinning mechanism: Use $rootfs/lxc.hold instead of $rootfs.hold (in case $rootfs is a mountpoint itself), but delete the file immediately after creating it (but keep it open). This will keep the root filesystem busy but does not leave any unnecessary files lying around. Signed-off-by:
Christian Seiler <christian@iwakd.de> Signed-off-by:
-
Christian Seiler authored
This patch adds the lxc.mount.auto configuration option that allows the user to specify that certain standard filesystems should be automatically pre-mounted when the container is started. Currently, four things are implemented: - /proc (mounted read-write) - /sys (mounted read-only) - /sys/fs/cgroup (special logic, see mailing list discussions) - /proc/sysrq-trigger (see below) /proc/sysrq-trigger may be used from within a container to trigger a forced host reboot (echo b > /proc/sysrq-trigger) or do other things that a container shouldn't be able to do. The logic here is to bind-mount /dev/null over /proc/sysrq-trigger, so that that cannot happen. This obviously only protects fully if CAP_SYS_ADMIN is not available inside the container (otherwise that bind-mount could be removed). Signed-off-by:
-
Christian Seiler authored
Add funbction to mount cgroup filesystem hierarchy into the container, allowing only access to the parts that the container should have access to, but none else. Signed-off-by:
-
Christian Seiler authored
This patch splits off ns legacy cgroup handling from main cgroup handling. It moves the creation of the cgroups before clone(), so that the child will easily know which cgroups it will later belong to. Since this is not possible for the renaming of the 'ns' cgroup, keep that part after clone. Signed-off-by:
-
Christian Seiler authored
Signed-off-by:
-
S.Çağlar Onur authored
Signed-off-by:
-
Serge Hallyn authored
We may long-term want to instead decide on a convention under /var/log, but for now just ignore it. This will only happen if lxcpath is read-only. Signed-off-by: -
Dwight Engen authored
- Also convert to unix abstract socket - A simple FNV hash is used instead of SHA-1 since we may not HAVE_GNUTLS Signed-off-by:
-
- 11 Sep, 2013 6 commits
-
-
Serge Hallyn authored
three issues raised by Christian Seiler: use pid_t, use snprintf, and use const. Signed-off-by: -
Dwight Engen authored
Moving these files should allow $lxcpath to be a read-only fs. Signed-off-by:
-
Serge Hallyn authored
If a cgroup hierarchy has ns cgroup composed, then we need to treat that differently: 1. The container init will have already been switched to a new cgroup called after its pid. 2. We can't move the container init to new deeper cgroup directories. So, if we detect an ns cgroup, don't bother trying to construct a new name according to the pattern. Just rename the current one to the container name, and save that path for us to later enter and remove. Note I'm not dealing with the subpaths so nested containers probably won't work. However as ns cgroup is very much legacy, that should be ok. Eventually we should be able to drop ns cgroup support altogether, but not just yet. Signed-off-by:
-
Serge Hallyn authored
Otherwise we fail to recognize if we are already unconfined. Then, if we want to *start* unconfined, and /proc is readonly, start fails even though it should be able to proceed. With this patch, that situation works. Signed-off-by:
Andre nathan <andre@digirati.com.br>
-
Stéphane Graber authored
Signed-off-by: KATOH Yasufumi karma@jazz.email.ne.jp Acked-by: -
Serge Hallyn authored
It's a legitimate use case to use read-only $lxcpath. If we can't create the pin file, then we're not worried about marking the fs readonly on exit. Signed-off-by:
-
- 10 Sep, 2013 3 commits
-
-
Serge Hallyn authored
Signed-off-by: -
Serge Hallyn authored
Signed-off-by: -
Christian Seiler authored
This patch rewrites most of the cgroup logic. It creates a set of data structures to store the kernel state of the cgroup hierarchies and their mountpoints. Mainly, everything is now grouped with respect to the hierarchies of the system. Multiple controllers may be mounted together or separately to different hierarchies, the data structures reflect this. Each hierarchy may have multiple mount points (that were created previously using the bind mount method) and each of these mount points may point to a different prefix inside the cgroup tree. The current code does not make any assumptions regarding the mount points, it just parses /proc/self/mountinfo to acquire the relevant information. The only requirement is that the current cgroup of either init (if cgroup.pattern starts with '/' and the tools are executed as root) or the current process (otherwise) are accessible. The root cgroup need not be accessible. The configuration option cgroup.pattern is introduced. For root-executed containers, it specifies which format the cgroups should be in. Example values may include '/lxc/%n', 'lxc/%n', '%n' or '/machine/%n.lxc'. Any occurrence of '%n' is replaced with the name of the container (and if clashes occur in any hierarchy, -1, -2, etc. are appended globally). If the pattern starts with /, new containers' cgroups will be located relative to init's cgroup; if it doesn't, they will be located relative to the current process's cgroup. Some changes to the cgroup.h API have been done to make it more consistent, both with respect to naming and with respect to the parameters. This causes some changes in other parts of the code that are included in the patch. There has been some testing of this functionality, but there are probably still quite a few bugs in there, especially for people with different configurations. Signed-off-by:
-
