confile: ignore lxc.kmsg and lxc.pivotdir 

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Add OCI container creation template

Closes #1813

This adds preliminary (but working) support for creating application
containers from OCI formats.  Examples:

create a container from a local OCI layout in ../oci:

    sudo lxc-create -t oci -n a1 -- -u oci:../oci:alpine

Or, create a container pulling from the docker hub.

    sudo lxc-create -t oci -n u1 -- -u docker://ubuntu

The url is specified in the same format as for 'skopeo copy'.

Comments appreciated.
Signed-off-by: Serge Hallyn <shallyn@cisco.com>

drop useless apparmor denies

mem and kmem are really in /dev, so this does us no good.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>

Signed-off-by: Serge Hallyn <shallyn@cisco.com>

 network: clear ifindeces

We need to clear any ifindeces we recorded so liblxc won't have cached stale
data which would cause it to fail on reboot we're we don't re-read the on-disk
config file.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

add a pre-start-host hook

This should satisfy several use cases.  The one I tested for was CNI.
I replaced the network configuration in a root owned container with:

lxc.net.0.type = empty
lxc.hook.start-host = /bin/lxc-start-netns

where /bin/lxc-start-netns contained:

=================================

echo "starting" > /tmp/debug
ip link add host1 type veth peer name peer1
ip link set host1 master lxcbr0
ip link set host1 up
ip link set peer1 netns "${LXC_PID}"
=================================

The nic 'peer1' was placed into the container as expected.

For this to work, we pass the container init's pid as LXC_PID in
an environment variable, since lxc-info cannot work at that point.
Signed-off-by: Serge Hallyn <shallyn@cisco.com>

Add support share pid namespace

Signed-off-by: LiFeng <lifeng68@huawei.com>

start: don't close inherited namespace fds

Otherwise we can never share namespaces.
Signed-off-by: LiFeng <lifeng68@huawei.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>

cgfsng: check whether we have a conf

We can't rely in general on the presence of an initialized conf on cgroup init
time. One good example are our criu codepaths.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

doc: Translate lxc-update-config(1) into Japanese

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

lvm: fix thinpool logical volumes

Closes #1827.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

doc: add lxc-update-config manpage

Merge pull request #1821 from brauner/2017-09-19/fail_on_when_setting_limits_on_unavailable_controllers

cgfsng: fail when limits fail to apply

zfs: return error directly when zfs creation fails

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

doc: fix regex-typo in Japanese and Korean lxc-monitor(1)

Update for commit e3dd06efSigned-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>

So far, we silently skipped over limits that failed to be applied which is very
odd. Let's error on when cgroup limits fail to apply.

Closes #1815.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Closes #1818.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fix typo

Change alpine template file check to also check file size (`-f` => `-s`)

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

tests: Support systemd hybrid cgroups

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Because the `fetch` wget wrapper outputs files to stdout we may end up in a
situation where wget fails but the files are still created. This can happen
e.g. when the host date is out of sync leading to a failed certificate
check, resulting in the creation of empty key files.

Once the empty files have been created the template will try to use them which
causes the certificate check to fail.

By using `-s` instead of `-f` the template will re-fetch the files unless they
exist AND have a size greater than zero.
Signed-off-by: Rune Juhl Jacobsen <runejuhl@petardo.dk>

plamo: Delete unnecessary process during container shutdown

start: pass LXC_LOG_LEVEL to hooks