- 03 Dec, 2015 5 commits
-
-
fli authored
The commit: e5848d39 <netdev_move_by_index: support wlan> only made netdev_move_by_name support wlan, instead of netdev_move_by_index. Given netdev_move_by_name is a wrapper of netdev_move_by_index, so here replacing all of the call to lxc_netdev_move_by_index with lxc_netdev_move_by_name to let lxc-start support wlan phys. Signed-off-by:
fupan li <fupan.li@windriver.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Wolfgang Bumiller authored
Signed-off-by:
Wolfgang Bumiller <w.bumiller@proxmox.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Wolfgang Bumiller authored
If manual mounting with elevated permissions is required this can currently only be done in pre-start hooks or before starting LXC. In both cases the mounts would appear in the host's namespace. With this flag the namespace is unshared before the startup sequence, so that mounts performed in the pre-start hook don't show up on the host. Signed-off-by:
Wolfgang Bumiller <w.bumiller@proxmox.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Tycho Andersen authored
v2: get rid of extra debug crap Signed-off-by:
Tycho Andersen <tycho.andersen@canonical.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Stéphane Graber authored
Signed-off-by:
Stéphane Graber <stgraber@ubuntu.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
- 20 Nov, 2015 1 commit
-
-
Stéphane Graber authored
This is currently breaking our daily image builds which happen in a perfectly clean environment without a Debian keyring and without anything in /var/cache/lxc Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
- 18 Nov, 2015 4 commits
-
-
Stéphane Graber authored
lxc_container struct: add comment about moving member fns
-
Stéphane Graber authored
Better handle preserve_ns behavior
-
Serge Hallyn authored
Signed-off-by:Serge Hallyn <serge.hallyn@ubuntu.com>
-
Stéphane Graber authored
Signed-off-by:
Stéphane Graber <stgraber@ubuntu.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
- 17 Nov, 2015 14 commits
-
-
Stéphane Graber authored
lxcapi_clone: restore the unexpanded config len
-
Serge Hallyn authored
Otherwise it gets shortened with the temporary len but never restored - which will only break API users which do a clone then continue to use the original container, meaning this is a hard one to detect. Signed-off-by:Serge Hallyn <serge.hallyn@ubuntu.com>
-
Serge Hallyn authored
It breaks container starts. This reverts commit 473ebc77.
-
Serge Hallyn authored
Commit b6b2b194 preserves the container's namespaces for possible later use in stop hook. But some kernels don't have /proc/pid/ns/ns for all the namespaces we may be interested in. So warn but continue if this is the case. Implement stgraber's suggested semantics. - User requests some namespaces be preserved: - If /proc/self/ns is missing => fail (saying kernel misses setns) - If /proc/self/ns/<namespace> entry is missing => fail (saying kernel misses setns for <namespace>) - User doesn't request some namespaces be preserved: - If /proc/self/ns is missing => log an INFO message (kernel misses setns) and continue - If /proc/self/ns/<namespace> entry is missing => log an INFO message (kernel misses setns for <namespace>) and continue Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com>
-
Stéphane Graber authored
lxc-ls: use /usr/bin/env to find an appropriate python3 to run
-
Stéphane Graber authored
Fetch Debian archive GPG keyrings when they're not available
-
Stéphane Graber authored
seccomp: handle inverted arch
-
Serge Hallyn authored
Closes #694 When we start cloning container c1 to c2, we first save c1's configuration in c2's as a starting point. We long ago cleared out the lxc.rootfs entry before saving it, so that if we are killed before we update the rootfs, c2's rootfs doesn't point to c1's. Because then lxc-destroy -n c2 would delete c1's rootfs. But when we introduced the unexpanded_config, we didn't update this code to clear the rootfs out of the unexpanded_config, which is what now actually gets saved in write_config(). Do so. Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Christian Brauner authored
Local variables should not have the same name as global variables to avoid confusion. Signed-off-by:
Christian Brauner <christian.brauner@mailbox.org> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Christian Brauner authored
When we create a random container directory with mkdtemp() we set the mode to 0770 otherwise do_lxcapi_clone() will complain about not being able to create the config. Signed-off-by:
Christian Brauner <christianvanbrauner@gmail.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Christian Brauner authored
When the clone failed we tried to destroy the container. This will lead to a segfault. Instead simply return -1. Also move the call to free_mnts() after the put label to free the user specified mounts even when we just goto put. Signed-off-by:
Christian Brauner <christianvanbrauner@gmail.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Christian Brauner authored
(A trivial fix for lxc-copy is included.) Signed-off-by:Christian Brauner <christian.brauner@mailbox.org>
-
Christian Brauner authored
This is a complete reimplementation of lxc-clone and lxc-start-ephemeral. lxc-copy merges the functionalities of lxc-clone + lxc-start-ephemeral. (1) Cloning containers: (a) as copy: lxc-copy -n aa -N bb (b) as snapshot: lxc-copy -n aa -N bb -s (2) Renaming containers: lxc-copy -n aa -N bb -R (3) Starting ephemeral containers: Ephemeral containers are created and started by passing the flag -e / --ephemeral. Whenever this flag is missing a copy of the container is created. The flag -e / --ephemeral implies -s / --snapshot. (a) start ephemeral container daemonized with random name: lxc-copy -n aa -e (b) start ephemeral container in foreground mode with random name: lxc-copy -n aa -e -F (c) start ephemeral container with specified name in daemonized mode: Analogous to lxc-start ephemeral containers start in daemonized mode per default: lxc-copy -n aa -N bb -e One can however also explicitly pass -d / --daemon: lxc-copy -n aa -N bb -e -d but both commands are equivalent. (d) start non-ephemeral container in daemonized mode: lxc-copy -n aa -D -e (e) start ephemeral container in daemonized mode and keep the original hostname: lxc-copy -n aa -K -e (f) start ephemeral container in daemonized mode and keep the MAC-address of the original container: lxc-copy -n aa -M -e (g) start ephemeral container with custom mounts (additional mounts can be of type {bind,aufs,overlay}) in daemonized mode: lxc-copy -n aa -e -m bind=/src:/dest:ro,aufs=/src:/dest,overlay=/src:/dest (4) Other options: lxc-copy --help In order to create a random containername and random upper- and workdirs for custom mounts we use mkdtemp() to not just create the names but also directly create the corresponding directories. This will be safer and make the code considerably shorter. Signed-off-by:Christian Brauner <christianvanbrauner@gmail.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Tycho Andersen authored
Instead, let's just allocate new space for the proctitle to live and point the kernel at that. v2: take out testing hunk v3: check return from realloc Signed-off-by:
Tycho Andersen <tycho.andersen@canonical.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
- 12 Nov, 2015 2 commits
-
-
Serge Hallyn authored
lxc uses uname to check the kernel version. Seccomp respects userspace. In the case of 32-bit userspace on 64-bit kernel, this was a bad combination. When we run into that case, make sure that the compat seccomp context is 32-bit, and the lxc->seccomp_ctx is the 64-bit. Closes #654 Signed-off-by:Serge Hallyn <serge.hallyn@ubuntu.com>
-
Stéphane Graber authored
- Update list of supported releases - Make the fallback release trusty - Don't specify the compression algorithm (use auto-detection) so that people passing tarballs to the template don't see regressions. Signed-off-by:
Stéphane Graber <stgraber@ubuntu.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
- 10 Nov, 2015 2 commits
-
-
Virgil Dupras authored
When running the debian template on a non-debian host, it's usual not to have debian-archive-keyring.gpg. When that happens, we skip the signature checking of the release, which is dangerous because it's made over HTTP. This commit adds automatic fetching of Debian release keys. Strongly related to #409 Signed-off-by:Virgil Dupras <hsoft@hardcoded.net>
-
Fox Wilson authored
This fixes invocations of certain commands when python3 is installed in a nonstandard path (/usr/local/bin, for example). Signed-off-by:Fox Wilson <2016fwilson@tjhsst.edu>
-
- 09 Nov, 2015 2 commits
-
-
Tycho Andersen authored
This isn't in any way fatal, so let's only warn about it with INFO, not ERROR. Signed-off-by:
Tycho Andersen <tycho.andersen@canonical.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Serge Hallyn authored
Signed-off-by:Serge Hallyn <serge.hallyn@ubuntu.com>
-
- 07 Nov, 2015 1 commit
-
-
Tycho Andersen authored
Instead of relying on the old ptrace loop, we should instead put all the tasks in the container into the freezer. This will stop them all at the same time, preventing fork bombs from causing criu to infinite loop (and is also simply a lot faster). Note that this uses --freeze-cgroup which isn't in criu 1.7, so it should only go into master. Signed-off-by:
Tycho Andersen <tycho.andersen@canonical.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
- 06 Nov, 2015 9 commits
-
-
Tycho Andersen authored
PR_SET_MM_MAP only went in to the kernel at 3.18 (or 3.19), so we need to define these for kernels before then. If there was an error, the code simply logs the failure and continues on. Also, we can drop the PR_SET_MM_otherstuff contstants since those were dropped in 93525c00. Signed-off-by:
Tycho Andersen <tycho.andersen@canonical.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Tycho Andersen authored
veths can be unconnected in the container's config, and we should handle this case. Signed-off-by:
Tycho Andersen <tycho.andersen@canonical.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Tycho Andersen authored
PR_SET_MM_MAP can be called as non-root, which we are in the unprivileged (or nested) case. Also, let's not do the strcpy() for the new cmdline until after we're sure the prctl succeeded. This means that even if it does fail, we won't mutilate the command line like we did before, it just won't be as pretty. v2: remember to chop off bits of the string that are too long Signed-off-by:
Tycho Andersen <tycho.andersen@canonical.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Christian Brauner authored
Changes v3: (1) Fix typo (q --> p). (1) This commit fixes the calculations when updating paths in lxc.hooks.* entries. We now also update conf->unexpandend_alloced which hasn't been done prior to this commit. (2) Also we use the stricter check: if (p >= lend) continue; This should deal better with invalid config files. (3) Insert some spaces between operators to increase readability. (4) Use gotos to simplify function and increase readability. Signed-off-by:Christian Brauner <christianvanbrauner@gmail.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Christian Brauner authored
When using overlay and aufs mounts with lxc.mount.entry users have to specify absolute paths for upperdir and workdir which will then get created automatically by mount_entry_create_overlay_dirs() and mount_entry_create_aufs_dirs() in conf.c. When we clone a container with overlay or aufs lxc.mount.entry entries we need to update these absolute paths. In order to do this we add the function update_ovl_paths() in lxccontainer.c. The function updates the mounts in two locations: 1) lxc_conf->mount_list and 2) lxc_conf->unexpanded_config (by calling clone_update_unexp_ovl_dir()) If we were to only update 2) we would end up with wrong upperdir and workdir mounts as the absolute paths would still point to the container that serves as the base for the clone. If we were to only update 1) we would end up with wrong upperdir and workdir lxc.mount.entry entries in the clone's config as the absolute paths in upperdir and workdir would still point to the container that serves as the base for the clone. Updating both will get the job done. NOTE: This function does not sanitize paths apart from removing trailing slashes. (So when a user specifies //home//someone/// it will be cleaned to //home//someone. This is the minimal path cleansing which is also done by lxc_container_new().) But the mount_entry_create_overlay_dirs() and mount_entry_create_aufs_dirs() functions both try to be extremely strict about when to create upperdirs and workdirs. They will only accept sanitized paths, i.e. they require /home/someone. I think this is a (safety) virtue and we should consider sanitizing paths in general. In short: update_ovl_paths() does update all absolute paths to the new container but mount_entry_create_overlay_dirs() and mount_entry_create_aufs_dirs() will still refuse to create upperdir and workdir when the updated path is unclean. This happens easily when e.g. a user calls lxc-clone -o OLD -n NEW -P //home//chb///. Signed-off-by:Christian Brauner <christianvanbrauner@gmail.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Christian Brauner authored
This functions updates absolute paths for overlay upper- and workdirs so users can simply clone and start new containers without worrying about absolute paths in lxc.mount.entry overlay entries. Signed-off-by:
Christian Brauner <christianvanbrauner@gmail.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Wolfgang Bumiller authored
Signed-off-by:
Wolfgang Bumiller <w.bumiller@proxmox.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Serge Hallyn authored
Otherwise something like lxc.init_cmd = /sbin/init debug verbose fails trying to execute a file called "/sbin/init debug verbose" Signed-off-by:
Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-
Sungbae Yoo authored
Signed-off-by:
Sungbae Yoo <sungbae.yoo@samsung.com> Acked-by:
Stéphane Graber <stgraber@ubuntu.com>
-