- 28 Jun, 2016 5 commits
-
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Preetam D'Souza authored
Newer versions of Android (5.0+, aka API Level 21+) include mntent.h, which declares setmntent and endmntent. This hits an edge case with the preprocessor checks in lxcmntent.h because HAVE_SETMNTENT and HAVE_ENDMNTENT are both defined (in Bionic's mntent.h), but conf.c always includes lxcmntent.h on Bionic! As a result, we get compiler warnings of implicit function declarations for setmntent endmntent. This patch always includes setmntent/endmntent/hasmntopt function declarations on Bionic, which gets rid of these warnings. Signed-off-by:Preetam D'Souza <preetamjdsouza@gmail.com>
-
Tycho Andersen authored
A while ago cgroup modes were introduced to CRIU, which slightly changed the behavior w.r.t. cgroups under the hood. What we're really after is criu's --full mode, i.e. even if a particular cgroup directory exists (in particular /lxc/$container[-$number] will, since we create it), we should restore perms on that cgroup. Things worked just fine for actual properties (except "special" properties as criu refers to them, which I've just sent a patch for) because liblxc creates no subdirectories, just the TLD. Signed-off-by:Tycho Andersen <tycho.andersen@canonical.com>
-
- 27 Jun, 2016 7 commits
-
-
Wolfgang Bumiller authored
The profile already contains mount options=(rw, make-slave) -> **, Which allows going through all mountpoints with make-slave, so it seems to make sense to also allow the directly recursive variant with "make-rslave". Signed-off-by:
Wolfgang Bumiller <w.bumiller@proxmox.com> Acked-by:
Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
Stéphane Graber authored
Properly list all of the states and the right apparmor stanza for them, then comment them all as actually enabling this would currently let the user bypass apparmor entirely. Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
AnrDaemon authored
Remove unnecessary shell wrap around job start. Force foreground execution to allow job monitoring and control. Signed-off-by Andrey Repin <anrdaemon@yandex.ru>
-
Stéphane Graber authored
Bind-mounts aren't harmful in containers, so long as they're not used to bypass MAC policies. This change allows bind-mounting of any path which isn't a dangerous filesystem that's otherwise blocked by apparmor. This also allows switching paths {r}shared or {r}private. Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
KATOH Yasufumi authored
* configure to start only the minimum of service * add ntp, kmod to ignore packages Signed-off-by:KATOH Yasufumi <karma@jazz.email.ne.jp>
-
Antonio Terceiro authored
init 1.34 is not "Essential" anymore, in order to make it not required on minimal chroots, docker containers, etc. Because of that we now need to manually include it on systems that are expected to boot. Signed-off-by:Antonio Terceiro <terceiro@debian.org>
-
- 13 Jun, 2016 7 commits
-
-
Thomas Tanaka authored
There is container-getty.service with OL7.2 systemd, it is also used for managing the getty service, use that instead and not manually create it. Signed-off-by:Thomas Tanaka <thomas.tanaka@oracle.com>
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Jesse Pretorius authored
In many environments the preference is to configure containers with apt mirrors that are SSL-secured. When building containers using the download template this can't be done unless an insecure mirror is first used to install the apt-transport-https package, then the sources reconfigured to use the https URL. When building containers without using the download template this can't be done unless the container creator specifically includes this package in the package list at build time. It seems more intuitive to me to have the package installed by default. Commit 396f75ab added the package to the minbase variant, but this variant is not used by the download template build process. The build process instead specifies no variant, so this patch moves the package from the packages_template package list in the minbase variant to the global packages_template package list, ensuring that this package is included in all Ubuntu build images that use the lxc-ubuntu template. Signed-off-by:
Jesse Pretorius <jesse.pretorius@rackspace.co.uk>
-
Evgeni Golov authored
lxc-start started to default to daemonize the container when starting this conflicts with type=simple of the systemd unit call lxc-start with -F and thus force execution in foreground that way we can feed the log to journald properly and keep type=simple Debian-Bug: https://bugs.debian.org/826100Signed-off-by:
Evgeni Golov <evgeni@golov.de>
-
Aleksandr Mezin authored
Signed-off-by:Aleksandr Mezin <mezin.alexander@gmail.com>
-
Aleksandr Mezin authored
It looks like VPATH (split source and build directories) builds are frequently broken. So let's test them on travis-ci. Personally I use VPATH build in my deployment scripts. Signed-off-by:Aleksandr Mezin <mezin.alexander@gmail.com>
-
Jörg Krause authored
struct in6_addr is both defined in the C library header <netinet/in.h> and the Linux kernel header <linux/in6.h>. lxc_user_nic.c includes both <netinet/in.h> and <linux/if_bridge.h>. The later one includes <linux/in6.h>. This breaks build with the musl libc: error: redefinition of ‘struct in6_addr’ As lxc_user_nic.c does not use any references from <linux/if_bridge.h> it is safe to remove this header. Signed-off-by:Jörg Krause <joerg.krause@embedded.rocks>
-
- 16 May, 2016 1 commit
-
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
- 11 May, 2016 20 commits
-
-
Andrey Kostin authored
Signed-off-by:Andrey Kostin <andrey@kostin.email>
-
Jesse Pretorius authored
In many environments the preference is to configure containers with apt mirrors that are SSL-secured. When building containers using the download template this can't be done unless an insecure mirror is first used to install the apt-transport-https package, then the sources reconfigured to use the https URL. When building containers without using the download template this can't be done unless the container creator specifically includes this package in the package list at build time. It seems more intuitive to me to have the package installed by default. This patch includes the required package for the minbase variant only as this is the default. Signed-off-by:Jesse Pretorius <jesse.pretorius@rackspace.co.uk>
-
Stéphane Graber authored
Signed-off-by:Stéphane Graber <stgraber@ubuntu.com>
-
Tycho Andersen authored
The idea here is that criu can use open_by_handle on a configuration which will preserve inodes on moves across hosts, but shouldn't do that on configurations which won't preserve inodes. Before, we forced it to always be slow, but we don't have to do this. Signed-off-by:Tycho Andersen <tycho.andersen@canonical.com>
-
Tycho Andersen authored
If we don't do this, we'll end up changing the function signatures for the internal __criu_* functions each time we add a new parameter, which will get very annoying very quickly. Since we already have the user's arguments struct, let's just pass that all the way down. Signed-off-by:Tycho Andersen <tycho.andersen@canonical.com>
-
Tycho Andersen authored
When writing out the CRIU exec command, we're bumping up against the buffer size limit. Let's increase it so we can avoid: lxc 20160509213229.921 WARN lxc_log - log.c:log_append_logfile:111 - truncated next event from 523 to 512 bytes Signed-off-by:Tycho Andersen <tycho.andersen@canonical.com>
-
Stewart Brodie authored
If the value starts and ends with matching quote characters, those characters are stripped automatically. Quote characters are the single quote (') or double quote ("). The quote removal is done after the whitespace trimming. This is needed particularly in order that lxc.environment values may have trailing spaces. However, the quote removal is done for all values in the parse_line function, as it has non-const access to the value. Signed-off-by:Stewart Brodie <stewart@metahusky.net>
-
Aron Podrigal authored
Signed-off-by:Aron Podrigal <aronp@guaranteedplus.com>
-
Serge Hallyn authored
so that there is a root uid mapping for the /proc/net files. Signed-off-by:Serge Hallyn <serge.hallyn@ubuntu.com>
-
Hartnell Foster authored
Signed-off-by:Hartnell Foster <hartnell.foster@bbc.co.uk>
-
Christian Brauner authored
Signed-off-by:Christian Brauner <christian.brauner@mailbox.org>
-
Karl-Johan Karlsson authored
gentoo.moresecure.conf tries to drop the capability CAP_SYS_RESOURCES. However, that capability doesn't exist, so the container doesn't start. Change it to CAP_SYS_RESOURCE, according to capabilities(7). Also correct the same typo in a comment in slackware.common.conf. Signed-off-by:Karl-Johan Karlsson <creideiki@ferretporn.se>
-
Tycho Andersen authored
I think (?) this may be related to our hanging monitor bug. Let's do this anyway, as it's probably a good idea. Signed-off-by:Tycho Andersen <tycho.andersen@canonical.com>
-
Lisio authored
Required for proper applying dnsmasq config entries. Signed-off-by:Andrey Kostin <andrey@kostin.email>
-
Thomas Tanaka authored
Signed-off-by:Thomas Tanaka <thomas.tanaka@oracle.com>
-
Sungbae Yoo authored
Update for commit f43d63bcSigned-off-by:
Sungbae Yoo <sungbae.yoo@samsung.com>
-
Aron Podrigal authored
When container init failed for whatever reason, previously it resulted in a `SystemError: NULL result without error in PyObject_Call` This will now result in a RuntimeError with the error message previously printed to stderr. Signed-off-by:Aron Podrigal <aronp@guaranteedplus.com>
-
walkerning authored
Let lxc-checkconfig write to non-tty stdout without color control characters Signed-off-by:walkerning <foxdoraame@gmail.com>
-
Christian Brauner authored
Signed-off-by:Christian Brauner <christian.brauner@mailbox.org>
-
Christian Brauner authored
Signed-off-by:Christian Brauner <christian.brauner@mailbox.org>
-