Skip to content

L
lxc
Switch branch/tag
  1. 07 Mar, 2014 8 commits
  3. 05 Mar, 2014 8 commits
    • snapshot: fix overlayfs restore · 0faa844c
      Serge Hallyn authored 
      And add a testcase to catch regressions.

Without this patch, restoring a snapshot of an overlayfs based
container fails, because we do not pass in LXC_CLONE_SNAPSHOT,
and overlayfs does not support clone without snapshot.
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • Update gitignore for lxc-ls · 94f835fc
      Stéphane Graber authored 
      Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • cgmanager: switch to TLS · 3c43b7a8
      Serge Hallyn authored 
      Drop the thread mutex.  Set a (TLS) boolean at container start to
indicate that the connection should be kept open;  set it back to false
only when container start is complete.  Every cgm_ method opens the
connection if not already open, and closes it if cgm_keep_connection
is false.
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • cgmanager updates · b0aedacb
      Serge Hallyn authored 
      1. remove the cgm_dbus_disconnected handler.  We're using a proxy
   anyway, and not keeping it around.

2. comment most of the cgm functions to describe when they are called, to
   ease locking review

3. the cgmanager mutex is now held for the duration of a connection, from
   cgm_dbus_connect to cgm_dbus_disconnect.

3b. so remove the mutex lock/unlock from functions which are called during
   container startup with the cgmanager connection already up

4. remove the cgroup_restart().  It's no longer needed since we don't
   daemonize while we have the cgmanager socket open.

5. report errors and return early if cgm_dbus_connect() fails

6. don't keep the cgm connection open after cgm_ops_init.  I'm a bit torn
   on this one as it means that things like lxc-start will always connect
   twice.  But if we do this there is no good answer, given threaded API
   users, on when to drop that initial connection.

7. cgm_unfreeze and nrtasks: grab the dbus connection, as we'll never
   have it at that point.  (technically i doubt anyone will use
   cgmanager and utmp helper on the same host :)

8. lxc_spawn: make sure we only disconnect cgroups if they were already
   connected.
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • lxc-ls: Fix support of --nesting for unpriv · f52d6fb5
      Stéphane Graber authored 
      This reworks the way lxc-ls works in nesting mode. In the past it'd use
attach_wait's subprocess function to call itself in the container's
namespace, carefully only attaching to the namespaces it needed.

This works great for system containers but not so much as soon as you
also need to attach to userns. Instead this fix moves all of the
container listing code into a get_containers function (hence the massive
diff, sorry), this function is then called recursively.

For running containers, the function is called through attach_wait
inside the container's namespace, for stopped container, the function is
simply called recursively with a base path (container's rootfs) in an
attempt to find containers that way.
Communication between the parent lxc-ls and the child lxc-ls is done
through a temporary fd and serialized state using json (similar to what
was done using stdout in the previous implementation).

As get_global_config_item unfortunately caches the values, there's no
easy way to figure out what the lxcpath should be for a root container
when running as non-root, so just use @LXCPATH@ for now and have
python do the parsing itself.

As a result, the following things now work as expected:
 - listing nested unprivileged containers (root containers inside unpriv)
 - listing nested containers when they're not running
 - filtering containers in nesting mode (only the first level is filtered)
 - copy with invalid config (used to traceback)
Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
    • python3: Export get_global_config_item · 9626da7f
      Stéphane Graber authored 
      get_global_config_item was added in _lxc but not mapped into lxc itself,
this resolves this oversight.
Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
    • chown_mapped_rootid: don't double-map root id · 7faf057b
      Serge Hallyn authored 
      If the user maps container root to his host uid, chown_mapped_rootid
tries to make the same mapping twice and gets -EINVAL.
Reported-by: 's avatarAndy Whitcroft <apw@canonical.com>
Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • lua: respect configure's --prefix · b71f50dc
      Natanael Copa authored 
      Install lua files under the confiugred --prefix rather than use the
pkg-config's variables LUA_INSTALL_[CL]MOD.

Users will likely want user --prefix while packagers will use DESTDIR.
Set the default to $datadir/lua/$LUA_VERSION for arch independent
lua modules and $libdir/lua/$LUA_VERSION for arch dependant .so module.

This should work for most distros. If it does not, then packagers
can still do:

  make install lualibdir=$(pkg-config lua --variable=INSTALL_CMOD) ...

This fixes #169
Signed-off-by: 's avatarNatanael Copa <ncopa@alpinelinux.org>
Acked-by: 's avatarDwight Engen <dwight.engen@oracle.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
  5. 03 Mar, 2014 9 commits
  7. 01 Mar, 2014 2 commits
  9. 27 Feb, 2014 7 commits
    • Fix unprivileged containers started by root · 993625a0
      Stéphane Graber authored 
      This change makes it possible to create unprivileged containers as root.
They will be stored in the usual system wide location, use the usual
system wide cache but will be running using a uid/gid map.

This also updates lxc_usernsexec to use the same function as the rest of
LXC, centralizing all the userns switch in a single function.

That function now detects the presence of newuidmap and newgidmap on the
system, if they are present, they will be used for containers created as
either user or root. If they're not and the user isn't root, an error is
shown. If they're not and the user is root, LXC will directly set the
uid_map and gid_map values.

All that should allow for a consistent experience as well as supporting
distributions that don't yet ship newuidmap/newgidmap.

To make things simpler in the future, an helper function "on_path" is
also introduced and used to detect the presence of newuidmap and
newgidmap.
Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
    • start: Fix print_top_failing_dir for /var/lib/lxc · ef325ba0
      Stéphane Graber authored 
      In the case where /var/lib/lxc itself was not accessible,
print_top_failing_dir would fail to print the error message.

This fixes it and also change the initial access check for X_OK instead
of R_OK (to match what we actually need and print_top_failing_dir's own
check).
Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
Acked-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
    • lxc-download: Ignore return code from subshell · 969b7d7e
      Stéphane Graber authored 
      The previous change fixed parsing of multiple uid/gid ranges by using a
while loop, however a failure in that loop will cause the script to exit
(due to -e), so we need to ignore the return value of the commands
inside that loop.
Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • bdev: do not crash if specs is NULL · ead15156
      S.Çağlar Onur authored 
      Signed-off-by: 's avatarS.Çağlar Onur <caglar@10ur.org>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • fix realloc() error on reboot container · 469b6a66
      Vitaly Lavrov authored 
      The container with "lxc.network.type=phys" halted with error on reboot.

Error message:
*** glibc detected *** lxc-start: realloc(): invalid pointer: 0x0948eed0 ***

We have a sequence:

1) conf->saved_nic = relloc(NULL) on start start.c:container save_phys_nics()
2) free(conf->saved_nics) after stop container
   conf.c:lxc_rename_phys_nics_on_shutdown()
3) conf->saved_nic = relloc(conf->saved_nics) on restart container
   start.c:save_phys_nics() -> error relloc()

free(conf->saved_nics) in lxc_rename_phys_nics_on_shutdown()
unnecessary, it will be called later in lxc_clear_saved_nics().
Signed-off-by: 's avatarVitaly Lavrov <vel21ripn@gmail.com>
Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
    • fix attach when cgroups mounted after container start · 3efa3bad
      Dwight Engen authored 
      When booting an OL7 container on OL6, systemd in the OL7 container mounted
some extra cgroup controllers, which are then present in /proc/self/cgroups
of every task on the host. This is the list used by attach to determine
which cgroups to move the attached task into, but when it asks the container
over the command interface for the path to the subsystem this will fail
since the controller didn't exist when the container was first started.

Instead of failing, this change allows the attach to continue, warning that
those cgroups that could not be found won't be attached to.

The problem can be more simply reproduced by starting a busybox container,
mounting a cgroup that was not previously mounted, and then attempting
to attach to to the busybox container.

The problem will likely not manifest with cgmanager since it only requests
the path for the first controller, which is likely to always be mounted.
Signed-off-by: 's avatarDwight Engen <dwight.engen@oracle.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
    • lxc-download: Detect unpriv created by real root · 4eac9913
      Stéphane Graber authored 
      This adds yet another case in the in_userns function detecting the case
where an unprivileged container is created by the real uid 0, in which
case we want to share the system wide cache but still use the
unprivileged templates and unpack method.
Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
  11. 26 Feb, 2014 1 commit
  13. 25 Feb, 2014 5 commits