Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-update-config: Fix bad handling of lxc.logfile

Closes #3369
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

fixes

Closes #3366.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

src/lxc/network: ipvlan comment and code style tweak

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Thomas Parrott <thomas.parrott@canonical.com>

network: Make it possible to set the mode of IPVLAN to L2

Signed-off-by: KUWAZAWA Takuya <albatross0@gmail.com>

lxc_user_nic: fixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #3361.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: ensure all file descriptors are closed during exec

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes https://github.com/checkpoint-restore/criu/issues/1011.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroup isolation: handle devices cgroup early

Otherwise we cannot use an 'a' entry in devices.deny/allow
as these are not permitted once a subdirectory was created.

Without isolation we initialize the devices cgroup
particularly late, so there are probably cases which cannot
work with isolation.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Cgroup isolation fixes

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

doc: Add lxc.cgroup.dir.{monitor,container,container.inner} to Japanese man

Update for commit a900cbafSigned-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

api-extensions: add and document cgroup_advanced_isolation

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

 introduce lxc.cgroup.dir.{monitor,container,container.inner}

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

This is a new approach to #1302 with a container-side
configuration instead of a global boolean flag.

Contrary to the previous PR using an optional additional
parameter for the get-cgroup command, this introduces two
new additional commands to get the limiting cgroup path and
cgroup2 file descriptor. If the limiting option is not in
use, these behave identical to their full-path counterparts.

If these variables are used the payload will end up in the
concatenation of lxc.cgroup.dir.container and
lxc.cgroup.dir.container.inner (which may be empty), and the
monitor will end up in lxc.cgruop.dir.monitor. The
directories are fixed, no retry count logic is applied,
failing to create these directories will simply be a hard
error.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Revert "start: remove unnecessary check for valid cgroup_ops"

This reverts commit 52520e4f.

This can be NULL when there's a pre-start hook which fails.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

lxccontainer: poll takes millisecond not seconds

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: fix build warning on GCC 7

GCC 7 appears to be clever enough to detect that transient_len is
uninitialised but not that it won't be used despite [1]. Just initialise
it to zero to stop the complaining, and allow LXC to build on openSUSE
Leap.

[1]: 34683042 ("cgroups: fix "uninitialized transient_len" warning")
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

fixes