From obnox at samba.org  Fri Jan  2 19:59:24 2015
From: obnox at samba.org (Michael Adam)
Date: Fri, 2 Jan 2015 20:59:24 +0100
Subject: [lxc-devel] [PATCH] fix lxc-fedora template for fedora 21
Message-ID: <20150102195924.GC2958@obnox.de>

Hi,

And a happy new year to everybody!

Is this the correct way to submit a patch?
Or is it also possible to simply create a pull request on github?

Anyhow, here it is:

the fedora template fails for f21 because in
f21, a package fedora-repos has been split out
of the fedora-release package, and fedora-repos
is also required.

Attached patch fixes this for me by adding the
fedora-repos pacakge if the release is >= 21.

Comments / merge appreciated...

Thanks, Michael
-------------- next part --------------
From c8324559061541e16217e1e9da6886677bbf6516 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Fri, 2 Jan 2015 20:28:59 +0100
Subject: [PATCH] lxc-fedora: In fedora21, the fedora-repos package is needed.

fedora-release has been split into fedora-release and fedora-repos.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-fedora.in | 36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index 65e9959..2123e69 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -823,6 +823,13 @@ download_fedora()
         PKG_LIST="${PKG_LIST} db4-utils"
     fi
 
+    if [[ ${release} -ge 21 ]]
+    then
+        # Since Fedora 21, a separate fedora-repos package is needed.
+        # Before, the information was conained in fedora-release.
+        PKG_LIST="${PKG_LIST} fedora-repos"
+    fi
+
     DOWNLOAD_OK=no
 
     # We're splitting the old loop into two loops plus a directory retrival.
@@ -851,7 +858,7 @@ download_fedora()
             RELEASE_URL="$MIRROR_URL/Packages/"
         fi
 
-        echo "Fetching rpm name from $RELEASE_URL..."
+        echo "Fetching release rpm name from $RELEASE_URL..."
         # This code is mildly "brittle" in that it assumes a certain directory
         # page format and parsing HTML.  I've done worse.  :-P
         RELEASE_RPM=$(curl -L -f "$RELEASE_URL" | sed -e "/fedora-release-${release}-/!d" -e 's/.*<a href=\"//' -e 's/\">.*//' )
@@ -867,6 +874,24 @@ download_fedora()
             continue
         fi
 
+        # F21 and newer need fedora-repos in addition to fedora-release.
+        if [ "$release" -ge "21" ]; then
+          echo "Fetching repos rpm name from $RELEASE_URL..."
+          REPOS_RPM=$(curl -L -f "$RELEASE_URL" | sed -e "/fedora-repos-${release}-/!d" -e 's/.*<a href=\"//' -e 's/\">.*//' )
+          if [ $? -ne 0  -o "${REPOS_RPM}" = "" ]; then
+              echo "Failed to identify fedora repos rpm."
+              continue
+          fi
+
+          echo "Fetching fedora repos rpm from ${RELEASE_URL}/${REPOS_RPM}..."
+          curl -L -f "${RELEASE_URL}/${REPOS_RPM}" > ${INSTALL_ROOT}/${REPOS_RPM}
+          if [ $? -ne 0 ]; then
+              echo "Failed to download fedora repos rpm ${RELEASE_RPM}."
+              continue
+          fi
+        fi
+
+
         DOWNLOAD_OK=yes
         break
     done
@@ -887,9 +912,18 @@ download_fedora()
     fedora_bootstrap_mounts
 
     ${BOOTSTRAP_CHROOT}rpm --root ${BOOTSTRAP_INSTALL_ROOT} --initdb
+
     # The --nodeps is STUPID but F15 had a bogus dependency on RawHide?!?!
     ${BOOTSTRAP_CHROOT}rpm --root ${BOOTSTRAP_INSTALL_ROOT} --nodeps -ivh ${BOOTSTRAP_INSTALL_ROOT}/${RELEASE_RPM}
 
+    # F21 and newer need fedora-repos in addition to fedora-release...
+    # Note that fedora-release and fedora-system have a mutual dependency.
+    # So installing the reops package after the release package we can
+    # spare one --nodeps.
+    if [ "$release" -ge "21" ]; then
+      ${BOOTSTRAP_CHROOT}rpm --root ${BOOTSTRAP_INSTALL_ROOT} -ivh ${BOOTSTRAP_INSTALL_ROOT}/${REPOS_RPM}
+    fi
+
     # yum will take $basearch from host, so force the arch we want
     sed -i "s|\$basearch|$basearch|" ${BOOTSTRAP_DIR}/${BOOTSTRAP_INSTALL_ROOT}/etc/yum.repos.d/*
 
-- 
2.1.0

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150102/04cb350a/attachment.sig>

From obnox at samba.org  Fri Jan  2 20:19:50 2015
From: obnox at samba.org (Michael Adam)
Date: Fri, 2 Jan 2015 21:19:50 +0100
Subject: [lxc-devel] [PATCH] fix possible 100% cpu loop by fedora template
Message-ID: <20150102201950.GD2958@obnox.de>

Another patch to the fedora template.

My f21 containers ran into a 100% cpu loop for systemd-journald.

Here is the explanation:
https://lists.linuxcontainers.org/pipermail/lxc-users/2014-October/007907.html

I have made the change to set lxc.kmsg = 0 in the generated
config if the release is using systemd.

Thanks for consideration,

Michael

-------------- next part --------------
From df7ca9966936bfcf4aa52a46dd39d594e0709ce1 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Fri, 2 Jan 2015 21:12:21 +0100
Subject: [PATCH] lxc-fedora: when using systemd, set lxc.kmsg = 0 in the
 config

This is to prevent systemd-journald to enter a 100% cpu loop.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-fedora.in | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index 2123e69..adfaab2 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -1117,13 +1117,22 @@ lxc.include = @LXCTEMPLATECONFIG@/fedora.common.conf
 " >> $config_path/config
     fi
 
+    if [ "x$have_systemd" = "x1" ]; then
+        cat <<EOF >> $config_path/config
+lxc.autodev = 1
+lxc.kmsg = 0
+EOF
+    else
+        cat <<EOF >> $config_path/config
+lxc.autodev = 0
+EOF
+    fi
+
     # Append things which require expansion here...
     cat <<EOF >> $config_path/config
 lxc.arch = $arch
 lxc.utsname = $utsname
 
-lxc.autodev = $auto_dev
-
 # When using LXC with apparmor, uncomment the next line to run unconfined:
 #lxc.aa_profile = unconfined
 
@@ -1337,12 +1346,12 @@ if [ -z "$release" ]; then
     fi
 fi
 
-# Fedora 15 and above run systemd.  We need autodev enabled to keep
+# Fedora 15 and above run systemd.We need autodev enabled to keep
 # systemd from causing problems.
+# Also, kmsg must not be mapped to prevent a 100% cpu loop
+# in systemd-journald.
 if [ $release -gt 14 ]; then
-    auto_dev="1"
-else
-    auto_dev="0"
+    have_systemd="1"
 fi
 
 if [ "$(id -u)" != "0" ]; then
-- 
2.1.0

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150102/d4b2f3b0/attachment.sig>

From beprojectcriu at gmail.com  Sun Jan  4 07:16:07 2015
From: beprojectcriu at gmail.com (beproject criu)
Date: Sun, 4 Jan 2015 12:46:07 +0530
Subject: [lxc-devel] Session Leader
In-Reply-To: <60E9D0C7-864D-43E4-9D42-E950DED4EFC3@gmail.com>
References: <CAMgQSMnzpf8_9uwwd4cgE1HxVOF93w2R8HQHeZADWibX5K6V2g@mail.gmail.com>
 <60E9D0C7-864D-43E4-9D42-E950DED4EFC3@gmail.com>
Message-ID: <CAMgQSM=FF3GuwdB=LLkRjj2Jw_cuOLF_SX_qCGsNKk+uRkgSQQ@mail.gmail.com>

Dear LXC Developers,
Does anybody have any idea why lxc-start executable does not make init the
session leader, whereas lxcapi_start function does call setsid()

On Sat, Jan 3, 2015 at 11:55 AM, Ashish Bijlani <ashish.bijlani at gmail.com>
wrote:

> Could you reply to this email and ask LXC developers to help….if anyone
> has any idea on this.
>
> Ask why lxc-start executable does not make init the session leader,
> whereas lxcapi_start function does call setsid()
>
> On Dec 25, 2014, at 10:19 AM, beproject criu <beprojectcriu at gmail.com>
> wrote:
>
> Dear LXC Developers,
>
> Why init of spawned container is not a session leader?.
> Can i change the session leader of lxc container using hooks,etc?
> If yes, how do i do it.
>
> Thanks.
>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150104/ddd41eb6/attachment.html>

From wangzhenaaa7 at gmail.com  Mon Jan  5 05:41:33 2015
From: wangzhenaaa7 at gmail.com (zhen wang)
Date: Mon, 5 Jan 2015 13:41:33 +0800
Subject: [lxc-devel] cpu.shares doesn't work
Message-ID: <CA+B82AwHhwZFet58vx2pJJ7Va+X0TkQVfh1ffaHpc7mtXpyJ+g@mail.gmail.com>

I have created two containers using docker.  When i changed  the value of
cpu.shares in the associated path of the docker id ,and i have already
substituted -1 in the cpu.cfs_quota_us with 50000,  I tested a program
,which doesn't use io, the result of test didn't show the setting of
 cpu.shares  work. Example :
i set the cpu.shares 128  in one container and the other 1024 and i run the
program in the two container concurrently. The time of the program cost is
almost the same.
Kernel version 2.6.32-431.
cpu cores - 2

Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150105/cfd6eac5/attachment.html>

From JOELN at il.ibm.com  Mon Jan  5 09:45:28 2015
From: JOELN at il.ibm.com (Joel Nider)
Date: Mon, 5 Jan 2015 11:45:28 +0200
Subject: [lxc-devel] Valid Container Names/Identifiers
In-Reply-To: <20141218154204.GE1397@ubuntumail>
References: <CAEPX5rykUAttZjG0vGdGuL+neqef3DwvV_+PyM=fCcfpfpBeDw@mail.gmail.com>
 <20141216152205.GL23859@dakara>
 <OF143F4C87.28BCCC25-ONC2257DB2.003AF128-C2257DB2.003B916E@il.ibm.com>
 <20141218154204.GE1397@ubuntumail>
Message-ID: <OF178110CD.75F88049-ONC2257DC4.00357337-C2257DC4.003599FF@il.ibm.com>

I was on holidays so I just saw this - I will be happy to put together a 
patch.



Joel Nider
Virtualization Research
IBM Research and Development
Haifa Research Lab

Phone: 972-4-829-6326 | Mobile: 972-54-3155635
E-mail: JOELN at il.ibm.com






From:   Serge Hallyn <serge.hallyn at ubuntu.com>
To:     LXC development mailing-list <lxc-devel at lists.linuxcontainers.org>
Date:   18/12/2014 05:42 PM
Subject:        Re: [lxc-devel] Valid Container Names/Identifiers
Sent by:        "lxc-devel" <lxc-devel-bounces at lists.linuxcontainers.org>



Agreed.  Would you mind coming up with a proposed patch to be stricter at
lxcapi_create() and sending it out?

Quoting Joel Nider (JOELN at il.ibm.com):
> I would strongly suggest to nail this down now since the question came 
up. 
>  This is the kind of issue that could create security bugs later on 
(when 
> different parts of the code check for valid names in different ways, or 
> don't check at all). Stephane's suggestion of a 64 ASCII character 
string 
> that forms a valid Linux hostname sounds good to me - is this formally 
> defined somewhere?
> 
> Regards,
> 
> Joel
> 
> "lxc-devel" <lxc-devel-bounces at lists.linuxcontainers.org> wrote on 
> 16/12/2014 05:22:05 PM:
> 
> > From: Stéphane Graber <stgraber at ubuntu.com>
> > To: LXC development mailing-list <lxc-devel at lists.linuxcontainers.org>
> > Date: 16/12/2014 05:22 PM
> > Subject: Re: [lxc-devel] Valid Container Names/Identifiers
> > Sent by: "lxc-devel" <lxc-devel-bounces at lists.linuxcontainers.org>
> > 
> > On Tue, Dec 16, 2014 at 10:36:13AM +0100, Till Walter wrote:
> > > Dear LXC Developers,
> > > 
> > > the manual page of lxc-create states that "The container identifier
> > > format is an alphanumeric string". Yet besides [A-Za-z0-9] other
> > > characters like underscore are also fine.
> > > I had a brief look at the source but did not find any check, e.g.,
> > > using a regex. Is there any check at all? What are valid container
> > > identifiers/names?
> > > I am asking because I am using the official python bindings to write 
a
> > > little utility and want to avoid container naming problems that may
> > > arise.
> > > 
> > > Best regards,
> > > 
> > > BB
> > 
> > So LXC itself doesn't really have a definition for valid names, 
however
> > since the name is typically used for the container's hostname, you
> > should stick to what's considered a valid hostname on Linux.
> > 
> > There's a POSIX RFC for that but IIRC it's basically 64 chars ASCII.
> > 
> > -- 
> > Stéphane Graber
> > Ubuntu developer
> > http://www.ubuntu.com
> > [attachment "signature.asc" deleted by Joel Nider/Haifa/IBM] 
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel
_______________________________________________
lxc-devel mailing list
lxc-devel at lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel



From serge.hallyn at ubuntu.com  Mon Jan  5 12:22:06 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 5 Jan 2015 12:22:06 +0000
Subject: [lxc-devel] cpu.shares doesn't work
In-Reply-To: <CA+B82AwHhwZFet58vx2pJJ7Va+X0TkQVfh1ffaHpc7mtXpyJ+g@mail.gmail.com>
References: <CA+B82AwHhwZFet58vx2pJJ7Va+X0TkQVfh1ffaHpc7mtXpyJ+g@mail.gmail.com>
Message-ID: <20150105122205.GA2090@ubuntumail>

Quoting zhen wang (wangzhenaaa7 at gmail.com):
> I have created two containers using docker.  When i changed  the value of

docker is not lxc

> cpu.shares in the associated path of the docker id ,and i have already
> substituted -1 in the cpu.cfs_quota_us with 50000,  I tested a program
> ,which doesn't use io, the result of test didn't show the setting of
>  cpu.shares  work. Example :
> i set the cpu.shares 128  in one container and the other 1024 and i run the
> program in the two container concurrently. The time of the program cost is
> almost the same.

The cpu.shares will only start to make a difference if the cpu is under
contention by other cgroups.

> Kernel version 2.6.32-431.
> cpu cores - 2
> 
> Thanks.

> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From serge.hallyn at ubuntu.com  Mon Jan  5 12:41:47 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 5 Jan 2015 12:41:47 +0000
Subject: [lxc-devel] [PATCH] Also drop caps in unpriv containers
In-Reply-To: <1419549445-31359-1-git-send-email-stgraber@ubuntu.com>
References: <1419549445-31359-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150105124147.GB2090@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):

No objection per se, but can you explain why?  What is the use
case for this?

> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
> ---
>  src/lxc/conf.c | 22 ++++++++++------------
>  1 file changed, 10 insertions(+), 12 deletions(-)
> 
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index 472eb79..72181dd 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -4158,20 +4158,18 @@ int lxc_setup(struct lxc_handler *handler)
>  		return -1;
>  	}
>  
> -	if (lxc_list_empty(&lxc_conf->id_map)) {
> -		if (!lxc_list_empty(&lxc_conf->keepcaps)) {
> -			if (!lxc_list_empty(&lxc_conf->caps)) {
> -				ERROR("Simultaneously requested dropping and keeping caps");
> -				return -1;
> -			}
> -			if (dropcaps_except(&lxc_conf->keepcaps)) {
> -				ERROR("failed to keep requested caps");
> -				return -1;
> -			}
> -		} else if (setup_caps(&lxc_conf->caps)) {
> -			ERROR("failed to drop capabilities");
> +	if (!lxc_list_empty(&lxc_conf->keepcaps)) {
> +		if (!lxc_list_empty(&lxc_conf->caps)) {
> +			ERROR("Simultaneously requested dropping and keeping caps");
>  			return -1;
>  		}
> +		if (dropcaps_except(&lxc_conf->keepcaps)) {
> +			ERROR("failed to keep requested caps");
> +			return -1;
> +		}
> +	} else if (setup_caps(&lxc_conf->caps)) {
> +		ERROR("failed to drop capabilities");
> +		return -1;
>  	}
>  
>  	NOTICE("'%s' is setup.", name);
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Mon Jan  5 12:43:04 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 5 Jan 2015 12:43:04 +0000
Subject: [lxc-devel] [PATCH] apparmor: Block access to /proc/kcore
In-Reply-To: <1419788009-20768-1-git-send-email-stgraber@ubuntu.com>
References: <1419788009-20768-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150105124304.GC2090@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Just like we block access to mem and kmem, there's no good reason for
> the container to have access to kcore.
> 
> Reported-by: Marc Schaefer
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  config/apparmor/abstractions/container-base    | 5 +++--
>  config/apparmor/abstractions/container-base.in | 5 +++--
>  2 files changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/config/apparmor/abstractions/container-base b/config/apparmor/abstractions/container-base
> index 2d5fd7a..ac8d4e9 100644
> --- a/config/apparmor/abstractions/container-base
> +++ b/config/apparmor/abstractions/container-base
> @@ -70,9 +70,10 @@
>    mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
>  
>    # block some other dangerous paths
> -  deny @{PROC}/sysrq-trigger rwklx,
> -  deny @{PROC}/mem rwklx,
> +  deny @{PROC}/kcore rwklx,
>    deny @{PROC}/kmem rwklx,
> +  deny @{PROC}/mem rwklx,
> +  deny @{PROC}/sysrq-trigger rwklx,
>  
>    # deny writes in /sys except for /sys/fs/cgroup, also allow
>    # fusectl, securityfs and debugfs to be mounted there (read-only)
> diff --git a/config/apparmor/abstractions/container-base.in b/config/apparmor/abstractions/container-base.in
> index 2065735..235913b 100644
> --- a/config/apparmor/abstractions/container-base.in
> +++ b/config/apparmor/abstractions/container-base.in
> @@ -70,9 +70,10 @@
>    mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
>  
>    # block some other dangerous paths
> -  deny @{PROC}/sysrq-trigger rwklx,
> -  deny @{PROC}/mem rwklx,
> +  deny @{PROC}/kcore rwklx,
>    deny @{PROC}/kmem rwklx,
> +  deny @{PROC}/mem rwklx,
> +  deny @{PROC}/sysrq-trigger rwklx,
>  
>    # deny writes in /sys except for /sys/fs/cgroup, also allow
>    # fusectl, securityfs and debugfs to be mounted there (read-only)
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From stgraber at ubuntu.com  Mon Jan  5 12:46:08 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Mon, 5 Jan 2015 07:46:08 -0500
Subject: [lxc-devel] [PATCH] Also drop caps in unpriv containers
In-Reply-To: <20150105124147.GB2090@ubuntumail>
References: <1419549445-31359-1-git-send-email-stgraber@ubuntu.com>
 <20150105124147.GB2090@ubuntumail>
Message-ID: <20150105124608.GB18786@dakara>

On Mon, Jan 05, 2015 at 12:41:47PM +0000, Serge Hallyn wrote:
> Quoting Stéphane Graber (stgraber at ubuntu.com):
> 
> No objection per se, but can you explain why?  What is the use
> case for this?

Preventing systemd from thinking it's got cap_sys_module.

That's my main use case anyway, also having a lxc.cap.* be silently
discarded just feels weird :)

> 
> > Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
> > ---
> >  src/lxc/conf.c | 22 ++++++++++------------
> >  1 file changed, 10 insertions(+), 12 deletions(-)
> > 
> > diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> > index 472eb79..72181dd 100644
> > --- a/src/lxc/conf.c
> > +++ b/src/lxc/conf.c
> > @@ -4158,20 +4158,18 @@ int lxc_setup(struct lxc_handler *handler)
> >  		return -1;
> >  	}
> >  
> > -	if (lxc_list_empty(&lxc_conf->id_map)) {
> > -		if (!lxc_list_empty(&lxc_conf->keepcaps)) {
> > -			if (!lxc_list_empty(&lxc_conf->caps)) {
> > -				ERROR("Simultaneously requested dropping and keeping caps");
> > -				return -1;
> > -			}
> > -			if (dropcaps_except(&lxc_conf->keepcaps)) {
> > -				ERROR("failed to keep requested caps");
> > -				return -1;
> > -			}
> > -		} else if (setup_caps(&lxc_conf->caps)) {
> > -			ERROR("failed to drop capabilities");
> > +	if (!lxc_list_empty(&lxc_conf->keepcaps)) {
> > +		if (!lxc_list_empty(&lxc_conf->caps)) {
> > +			ERROR("Simultaneously requested dropping and keeping caps");
> >  			return -1;
> >  		}
> > +		if (dropcaps_except(&lxc_conf->keepcaps)) {
> > +			ERROR("failed to keep requested caps");
> > +			return -1;
> > +		}
> > +	} else if (setup_caps(&lxc_conf->caps)) {
> > +		ERROR("failed to drop capabilities");
> > +		return -1;
> >  	}
> >  
> >  	NOTICE("'%s' is setup.", name);
> > -- 
> > 1.9.1
> > 
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150105/b140fe77/attachment.sig>

From serge.hallyn at ubuntu.com  Mon Jan  5 15:45:04 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 5 Jan 2015 15:45:04 +0000
Subject: [lxc-devel] [PATCH] Also drop caps in unpriv containers
In-Reply-To: <20150105124608.GB18786@dakara>
References: <1419549445-31359-1-git-send-email-stgraber@ubuntu.com>
 <20150105124147.GB2090@ubuntumail> <20150105124608.GB18786@dakara>
Message-ID: <20150105154504.GB3201@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> On Mon, Jan 05, 2015 at 12:41:47PM +0000, Serge Hallyn wrote:
> > Quoting Stéphane Graber (stgraber at ubuntu.com):
> > 
> > No objection per se, but can you explain why?  What is the use
> > case for this?
> 
> Preventing systemd from thinking it's got cap_sys_module.

Feh.

I don't like it, but ok.

> That's my main use case anyway, also having a lxc.cap.* be silently
> discarded just feels weird :)
> 
> > 
> > > Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> > > ---
> > >  src/lxc/conf.c | 22 ++++++++++------------
> > >  1 file changed, 10 insertions(+), 12 deletions(-)
> > > 
> > > diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> > > index 472eb79..72181dd 100644
> > > --- a/src/lxc/conf.c
> > > +++ b/src/lxc/conf.c
> > > @@ -4158,20 +4158,18 @@ int lxc_setup(struct lxc_handler *handler)
> > >  		return -1;
> > >  	}
> > >  
> > > -	if (lxc_list_empty(&lxc_conf->id_map)) {
> > > -		if (!lxc_list_empty(&lxc_conf->keepcaps)) {
> > > -			if (!lxc_list_empty(&lxc_conf->caps)) {
> > > -				ERROR("Simultaneously requested dropping and keeping caps");
> > > -				return -1;
> > > -			}
> > > -			if (dropcaps_except(&lxc_conf->keepcaps)) {
> > > -				ERROR("failed to keep requested caps");
> > > -				return -1;
> > > -			}
> > > -		} else if (setup_caps(&lxc_conf->caps)) {
> > > -			ERROR("failed to drop capabilities");
> > > +	if (!lxc_list_empty(&lxc_conf->keepcaps)) {
> > > +		if (!lxc_list_empty(&lxc_conf->caps)) {
> > > +			ERROR("Simultaneously requested dropping and keeping caps");
> > >  			return -1;
> > >  		}
> > > +		if (dropcaps_except(&lxc_conf->keepcaps)) {
> > > +			ERROR("failed to keep requested caps");
> > > +			return -1;
> > > +		}
> > > +	} else if (setup_caps(&lxc_conf->caps)) {
> > > +		ERROR("failed to drop capabilities");
> > > +		return -1;
> > >  	}
> > >  
> > >  	NOTICE("'%s' is setup.", name);
> > > -- 
> > > 1.9.1
> > > 
> > > _______________________________________________
> > > lxc-devel mailing list
> > > lxc-devel at lists.linuxcontainers.org
> > > http://lists.linuxcontainers.org/listinfo/lxc-devel
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> 
> -- 
> Stéphane Graber
> Ubuntu developer
> http://www.ubuntu.com



> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From serge.hallyn at ubuntu.com  Mon Jan  5 15:48:39 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 5 Jan 2015 15:48:39 +0000
Subject: [lxc-devel] Session Leader
In-Reply-To: <CAMgQSM=FF3GuwdB=LLkRjj2Jw_cuOLF_SX_qCGsNKk+uRkgSQQ@mail.gmail.com>
References: <CAMgQSMnzpf8_9uwwd4cgE1HxVOF93w2R8HQHeZADWibX5K6V2g@mail.gmail.com>
 <60E9D0C7-864D-43E4-9D42-E950DED4EFC3@gmail.com>
 <CAMgQSM=FF3GuwdB=LLkRjj2Jw_cuOLF_SX_qCGsNKk+uRkgSQQ@mail.gmail.com>
Message-ID: <20150105154839.GC3201@ubuntumail>

lcxapi_start calls setsid but not from the task which will become the
container init.

Quoting beproject criu (beprojectcriu at gmail.com):
> Dear LXC Developers,
> Does anybody have any idea why lxc-start executable does not make init the
> session leader, whereas lxcapi_start function does call setsid()
> 
> On Sat, Jan 3, 2015 at 11:55 AM, Ashish Bijlani <ashish.bijlani at gmail.com>
> wrote:
> 
> > Could you reply to this email and ask LXC developers to help….if anyone
> > has any idea on this.
> >
> > Ask why lxc-start executable does not make init the session leader,
> > whereas lxcapi_start function does call setsid()
> >
> > On Dec 25, 2014, at 10:19 AM, beproject criu <beprojectcriu at gmail.com>
> > wrote:
> >
> > Dear LXC Developers,
> >
> > Why init of spawned container is not a session leader?.
> > Can i change the session leader of lxc container using hooks,etc?
> > If yes, how do i do it.
> >
> > Thanks.
> >
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> >
> >
> >

> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From serge.hallyn at ubuntu.com  Mon Jan  5 16:47:17 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 5 Jan 2015 16:47:17 +0000
Subject: [lxc-devel] [PATCH] fix lxc-fedora template for fedora 21
In-Reply-To: <20150102195924.GC2958@obnox.de>
References: <20150102195924.GC2958@obnox.de>
Message-ID: <20150105164717.GF3201@ubuntumail>

Quoting Michael Adam (obnox at samba.org):
> Hi,
> 
> And a happy new year to everybody!
> 
> Is this the correct way to submit a patch?

Almost - it's perfect, except for please put the patches inline rather
than as attachments, if possible.

> Or is it also possible to simply create a pull request on github?

No for thi sproject I prefer email so that everyone can see them.

> Anyhow, here it is:

Thanks for the patch.  It looks good to me, though I have not tested
and don't have any fedora right now.  I'm hoping mwarfield will
see it and comment if there are any problems, but meanwhile acked belw.

> the fedora template fails for f21 because in
> f21, a package fedora-repos has been split out
> of the fedora-release package, and fedora-repos
> is also required.
> 
> Attached patch fixes this for me by adding the
> fedora-repos pacakge if the release is >= 21.
> 
> Comments / merge appreciated...
> 
> Thanks, Michael

> From c8324559061541e16217e1e9da6886677bbf6516 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Fri, 2 Jan 2015 20:28:59 +0100
> Subject: [PATCH] lxc-fedora: In fedora21, the fedora-repos package is needed.
> 
> fedora-release has been split into fedora-release and fedora-repos.
> 
> Signed-off-by: Michael Adam <obnox at samba.org>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  templates/lxc-fedora.in | 36 +++++++++++++++++++++++++++++++++++-
>  1 file changed, 35 insertions(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
> index 65e9959..2123e69 100644
> --- a/templates/lxc-fedora.in
> +++ b/templates/lxc-fedora.in
> @@ -823,6 +823,13 @@ download_fedora()
>          PKG_LIST="${PKG_LIST} db4-utils"
>      fi
>  
> +    if [[ ${release} -ge 21 ]]
> +    then
> +        # Since Fedora 21, a separate fedora-repos package is needed.
> +        # Before, the information was conained in fedora-release.
> +        PKG_LIST="${PKG_LIST} fedora-repos"
> +    fi
> +
>      DOWNLOAD_OK=no
>  
>      # We're splitting the old loop into two loops plus a directory retrival.
> @@ -851,7 +858,7 @@ download_fedora()
>              RELEASE_URL="$MIRROR_URL/Packages/"
>          fi
>  
> -        echo "Fetching rpm name from $RELEASE_URL..."
> +        echo "Fetching release rpm name from $RELEASE_URL..."
>          # This code is mildly "brittle" in that it assumes a certain directory
>          # page format and parsing HTML.  I've done worse.  :-P
>          RELEASE_RPM=$(curl -L -f "$RELEASE_URL" | sed -e "/fedora-release-${release}-/!d" -e 's/.*<a href=\"//' -e 's/\">.*//' )
> @@ -867,6 +874,24 @@ download_fedora()
>              continue
>          fi
>  
> +        # F21 and newer need fedora-repos in addition to fedora-release.
> +        if [ "$release" -ge "21" ]; then
> +          echo "Fetching repos rpm name from $RELEASE_URL..."
> +          REPOS_RPM=$(curl -L -f "$RELEASE_URL" | sed -e "/fedora-repos-${release}-/!d" -e 's/.*<a href=\"//' -e 's/\">.*//' )
> +          if [ $? -ne 0  -o "${REPOS_RPM}" = "" ]; then
> +              echo "Failed to identify fedora repos rpm."
> +              continue
> +          fi
> +
> +          echo "Fetching fedora repos rpm from ${RELEASE_URL}/${REPOS_RPM}..."
> +          curl -L -f "${RELEASE_URL}/${REPOS_RPM}" > ${INSTALL_ROOT}/${REPOS_RPM}
> +          if [ $? -ne 0 ]; then
> +              echo "Failed to download fedora repos rpm ${RELEASE_RPM}."
> +              continue
> +          fi
> +        fi
> +
> +
>          DOWNLOAD_OK=yes
>          break
>      done
> @@ -887,9 +912,18 @@ download_fedora()
>      fedora_bootstrap_mounts
>  
>      ${BOOTSTRAP_CHROOT}rpm --root ${BOOTSTRAP_INSTALL_ROOT} --initdb
> +
>      # The --nodeps is STUPID but F15 had a bogus dependency on RawHide?!?!
>      ${BOOTSTRAP_CHROOT}rpm --root ${BOOTSTRAP_INSTALL_ROOT} --nodeps -ivh ${BOOTSTRAP_INSTALL_ROOT}/${RELEASE_RPM}
>  
> +    # F21 and newer need fedora-repos in addition to fedora-release...
> +    # Note that fedora-release and fedora-system have a mutual dependency.
> +    # So installing the reops package after the release package we can
> +    # spare one --nodeps.
> +    if [ "$release" -ge "21" ]; then
> +      ${BOOTSTRAP_CHROOT}rpm --root ${BOOTSTRAP_INSTALL_ROOT} -ivh ${BOOTSTRAP_INSTALL_ROOT}/${REPOS_RPM}
> +    fi
> +
>      # yum will take $basearch from host, so force the arch we want
>      sed -i "s|\$basearch|$basearch|" ${BOOTSTRAP_DIR}/${BOOTSTRAP_INSTALL_ROOT}/etc/yum.repos.d/*
>  
> -- 
> 2.1.0
> 




> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From serge.hallyn at ubuntu.com  Mon Jan  5 16:48:55 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 5 Jan 2015 16:48:55 +0000
Subject: [lxc-devel] [PATCH] fix possible 100% cpu loop by fedora
	template
In-Reply-To: <20150102201950.GD2958@obnox.de>
References: <20150102201950.GD2958@obnox.de>
Message-ID: <20150105164855.GG3201@ubuntumail>

Quoting Michael Adam (obnox at samba.org):
> Another patch to the fedora template.
> 
> My f21 containers ran into a 100% cpu loop for systemd-journald.
> 
> Here is the explanation:
> https://lists.linuxcontainers.org/pipermail/lxc-users/2014-October/007907.html
> 
> I have made the change to set lxc.kmsg = 0 in the generated
> config if the release is using systemd.
> 
> Thanks for consideration,
> 
> Michael
> 

> From df7ca9966936bfcf4aa52a46dd39d594e0709ce1 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Fri, 2 Jan 2015 21:12:21 +0100
> Subject: [PATCH] lxc-fedora: when using systemd, set lxc.kmsg = 0 in the
>  config
> 
> This is to prevent systemd-journald to enter a 100% cpu loop.
> 
> Signed-off-by: Michael Adam <obnox at samba.org>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  templates/lxc-fedora.in | 21 +++++++++++++++------
>  1 file changed, 15 insertions(+), 6 deletions(-)
> 
> diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
> index 2123e69..adfaab2 100644
> --- a/templates/lxc-fedora.in
> +++ b/templates/lxc-fedora.in
> @@ -1117,13 +1117,22 @@ lxc.include = @LXCTEMPLATECONFIG@/fedora.common.conf
>  " >> $config_path/config
>      fi
>  
> +    if [ "x$have_systemd" = "x1" ]; then
> +        cat <<EOF >> $config_path/config
> +lxc.autodev = 1
> +lxc.kmsg = 0
> +EOF
> +    else
> +        cat <<EOF >> $config_path/config
> +lxc.autodev = 0
> +EOF
> +    fi
> +
>      # Append things which require expansion here...
>      cat <<EOF >> $config_path/config
>  lxc.arch = $arch
>  lxc.utsname = $utsname
>  
> -lxc.autodev = $auto_dev
> -
>  # When using LXC with apparmor, uncomment the next line to run unconfined:
>  #lxc.aa_profile = unconfined
>  
> @@ -1337,12 +1346,12 @@ if [ -z "$release" ]; then
>      fi
>  fi
>  
> -# Fedora 15 and above run systemd.  We need autodev enabled to keep
> +# Fedora 15 and above run systemd.We need autodev enabled to keep
>  # systemd from causing problems.
> +# Also, kmsg must not be mapped to prevent a 100% cpu loop
> +# in systemd-journald.
>  if [ $release -gt 14 ]; then
> -    auto_dev="1"
> -else
> -    auto_dev="0"
> +    have_systemd="1"
>  fi
>  
>  if [ "$(id -u)" != "0" ]; then
> -- 
> 2.1.0
> 




> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From obnox at samba.org  Mon Jan  5 17:56:03 2015
From: obnox at samba.org (Michael Adam)
Date: Mon, 5 Jan 2015 18:56:03 +0100
Subject: [lxc-devel] [PATCH] fix lxc-fedora template for fedora 21
In-Reply-To: <20150105164717.GF3201@ubuntumail>
References: <20150102195924.GC2958@obnox.de> <20150105164717.GF3201@ubuntumail>
Message-ID: <20150105175603.GG2958@obnox.de>

On 2015-01-05 at 16:47 +0000, Serge Hallyn wrote:
> Quoting Michael Adam (obnox at samba.org):
> > 
> > Is this the correct way to submit a patch?
> 
> Almost - it's perfect, except for please put the patches inline rather
> than as attachments, if possible.

Like with git-send-email?
I can try to set this up, I only always did it the attachment
way for samba and related projects.

> > Anyhow, here it is:
> 
> Thanks for the patch.  It looks good to me, though I have not tested
> and don't have any fedora right now.  I'm hoping mwarfield will
> see it and comment if there are any problems, but meanwhile acked belw.

Thanks! I have already notified mhw on IRC and briefly
talked to him.

Cheers - Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150105/5d375856/attachment.sig>

From serge.hallyn at ubuntu.com  Mon Jan  5 20:17:30 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 5 Jan 2015 20:17:30 +0000
Subject: [lxc-devel] [PATCH] fix lxc-fedora template for fedora 21
In-Reply-To: <20150105175603.GG2958@obnox.de>
References: <20150102195924.GC2958@obnox.de> <20150105164717.GF3201@ubuntumail>
 <20150105175603.GG2958@obnox.de>
Message-ID: <20150105201730.GN3201@ubuntumail>

Quoting Michael Adam (obnox at samba.org):
> On 2015-01-05 at 16:47 +0000, Serge Hallyn wrote:
> > Quoting Michael Adam (obnox at samba.org):
> > > 
> > > Is this the correct way to submit a patch?
> > 
> > Almost - it's perfect, except for please put the patches inline rather
> > than as attachments, if possible.
> 
> Like with git-send-email?
> I can try to set this up, I only always did it the attachment
> way for samba and related projects.

That works too, but usually I just git format-patch to get the
patch in a file, then paste the file in.  I.e. with vim i do

:r 0001-whatever.patch

to insert the patch.

> > > Anyhow, here it is:
> > 
> > Thanks for the patch.  It looks good to me, though I have not tested
> > and don't have any fedora right now.  I'm hoping mwarfield will
> > see it and comment if there are any problems, but meanwhile acked belw.
> 
> Thanks! I have already notified mhw on IRC and briefly
> talked to him.
> 
> Cheers - Michael



> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From obnox at samba.org  Mon Jan  5 20:29:35 2015
From: obnox at samba.org (Michael Adam)
Date: Mon, 5 Jan 2015 21:29:35 +0100
Subject: [lxc-devel] [PATCH] fix lxc-fedora template for fedora 21
In-Reply-To: <20150105201730.GN3201@ubuntumail>
References: <20150102195924.GC2958@obnox.de> <20150105164717.GF3201@ubuntumail>
 <20150105175603.GG2958@obnox.de> <20150105201730.GN3201@ubuntumail>
Message-ID: <20150105202935.GI2958@obnox.de>

On 2015-01-05 at 20:17 +0000, Serge Hallyn wrote:
> Quoting Michael Adam (obnox at samba.org):
> > On 2015-01-05 at 16:47 +0000, Serge Hallyn wrote:
> > > Quoting Michael Adam (obnox at samba.org):
> > > > 
> > > > Is this the correct way to submit a patch?
> > > 
> > > Almost - it's perfect, except for please put the patches inline rather
> > > than as attachments, if possible.
> > 
> > Like with git-send-email?
> > I can try to set this up, I only always did it the attachment
> > way for samba and related projects.
> 
> That works too, but usually I just git format-patch to get the
> patch in a file, then paste the file in.  I.e. with vim i do
> 
> :r 0001-whatever.patch
> 
> to insert the patch.

Great, that's more convenient for me.
Will do so next time.

Thanks - Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150105/0c58ea08/attachment-0001.sig>

From stgraber at ubuntu.com  Mon Jan  5 21:26:23 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Mon, 5 Jan 2015 16:26:23 -0500
Subject: [lxc-devel] [PATCH] lxc-alpine: use yaml for detection of
 latest release
In-Reply-To: <1420011105-19139-1-git-send-email-ncopa@alpinelinux.org>
References: <1420011105-19139-1-git-send-email-ncopa@alpinelinux.org>
Message-ID: <20150105212623.GD18786@dakara>

On Wed, Dec 31, 2014 at 08:31:45AM +0100, Natanael Copa wrote:
> Alpine Linux provides yaml files with latest release instead of the old
> approach with .latest.txt.
> 
> Signed-off-by: Natanael Copa <ncopa at alpinelinux.org>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
> Should also go to 1.0.x stable
> 
>  templates/lxc-alpine.in | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/templates/lxc-alpine.in b/templates/lxc-alpine.in
> index ba27aea..187a032 100644
> --- a/templates/lxc-alpine.in
> +++ b/templates/lxc-alpine.in
> @@ -28,10 +28,15 @@ get_static_apk () {
>  
>      if [ -z "$repository" ]; then
>          url=http://wiki.alpinelinux.org/cgi-bin/dl.cgi
> +	yaml_path="latest-stable/releases/$apk_arch/latest-releases.yaml"
>          if [ -z "$release" ]; then
>              echo -n "Determining the latest release... "
> -            release=$($wget $url/.latest.$apk_arch.txt | \
> -                cut -d " " -f 3 | cut -d / -f 1 | uniq)
> +            release=$($wget $url/$yaml_path | \
> +	        awk '$1 == "branch:" {print $2; exit 0}')
> +            if [ -z "$release" ]; then
> +                release=$($wget $url/.latest.$apk_arch.txt | \
> +                    cut -d " " -f 3 | cut -d / -f 1 | uniq)
> +            fi
>              if [ -z "$release" ]; then
>                  echo failed
>                  return 1
> -- 
> 2.2.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150105/ed249645/attachment.sig>

From noreply at github.com  Mon Jan  5 21:32:33 2015
From: noreply at github.com (GitHub)
Date: Mon, 05 Jan 2015 13:32:33 -0800
Subject: [lxc-devel] [lxc/lxc] 5b75ee: lxc-fedora: when using systemd,
 set lxc.kmsg = 0 i...
Message-ID: <54ab02f129d09_488b3f81c720929c829fe@hookshot-fe5-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 5b75ee4747c5f26c52cfb6127b6420f38f4fba88
      https://github.com/lxc/lxc/commit/5b75ee4747c5f26c52cfb6127b6420f38f4fba88
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-05 (Mon, 05 Jan 2015)

  Changed paths:
    M templates/lxc-fedora.in

  Log Message:
  -----------
  lxc-fedora: when using systemd, set lxc.kmsg = 0 in the config

This is to prevent systemd-journald to enter a 100% cpu loop.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: afc55ed2794ce63714bfcee70b1d0d42d3e8ee05
      https://github.com/lxc/lxc/commit/afc55ed2794ce63714bfcee70b1d0d42d3e8ee05
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-05 (Mon, 05 Jan 2015)

  Changed paths:
    M templates/lxc-fedora.in

  Log Message:
  -----------
  lxc-fedora: In fedora21, the fedora-repos package is needed.

fedora-release has been split into fedora-release and fedora-repos.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: abf117c398c957b213feebe3fa6dea3107c3a452
      https://github.com/lxc/lxc/commit/abf117c398c957b213feebe3fa6dea3107c3a452
  Author: Natanael Copa <ncopa at alpinelinux.org>
  Date:   2015-01-05 (Mon, 05 Jan 2015)

  Changed paths:
    M templates/lxc-alpine.in

  Log Message:
  -----------
  lxc-alpine: use yaml for detection of latest release

Alpine Linux provides yaml files with latest release instead of the old
approach with .latest.txt.

Signed-off-by: Natanael Copa <ncopa at alpinelinux.org>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 98b745498bf97637f68311f944903777f3ee1e67
      https://github.com/lxc/lxc/commit/98b745498bf97637f68311f944903777f3ee1e67
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-05 (Mon, 05 Jan 2015)

  Changed paths:
    M config/apparmor/abstractions/container-base
    M config/apparmor/abstractions/container-base.in

  Log Message:
  -----------
  apparmor: Block access to /proc/kcore

Just like we block access to mem and kmem, there's no good reason for
the container to have access to kcore.

Reported-by: Marc Schaefer
Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 97a8f74f0c80ef71305e86fcef4273afd92b377c
      https://github.com/lxc/lxc/commit/97a8f74f0c80ef71305e86fcef4273afd92b377c
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-05 (Mon, 05 Jan 2015)

  Changed paths:
    M src/lxc/conf.c

  Log Message:
  -----------
  Also drop caps in unpriv containers

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/d3eccbbf805c...97a8f74f0c80

From G.Jaekel at DNB.DE  Thu Jan  8 06:41:14 2015
From: G.Jaekel at DNB.DE (=?UTF-8?B?R3VpZG8gSsOka2Vs?=)
Date: Thu, 08 Jan 2015 07:41:14 +0100
Subject: [lxc-devel] Bump: Failure with authorisation of update-manager in
	Ubuntu Desktop-Container
In-Reply-To: <CA+B82AwHhwZFet58vx2pJJ7Va+X0TkQVfh1ffaHpc7mtXpyJ+g@mail.gmail.com>
References: <CA+B82AwHhwZFet58vx2pJJ7Va+X0TkQVfh1ffaHpc7mtXpyJ+g@mail.gmail.com>
Message-ID: <54AE268A.8000403@DNB.DE>

Hi Dev's,

may anyone please help me to solve this issue?

Guido

On 04.01.2015 20:01, Guido Jäkel wrote on [lxc-user]:
>My goal here is to set up a Ubuntu Desktop Container ...
>[...]
>After a a few tweaks, this already runs very well...
>[...]> But now I stuck at an issue concerning the GUI versions of software management: The apt commandline tools work, but the GUI program update-manager shows the error message "You are not allowed to perform this action" and fail to work. However, if i start it with 'gksudo update-manager', there is no such message.
> 
> In the same way, the software-manager or other GUI methods to install/remove software is not working. May anybody please have a hint what might be missing in the container setup or have to be tweaked inside?

From obnox at samba.org  Thu Jan  8 10:05:16 2015
From: obnox at samba.org (Michael Adam)
Date: Thu, 8 Jan 2015 11:05:16 +0100
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
Message-ID: <20150108100516.GK2958@obnox.de>


Hi,

below find the output of "git format-patch --stdout "
of a series of trivial patches to fix some minor issues
in the template scripts.

The final patch adds a new parameter to the fedora
template: "--mask-tmp". This is what I actually only
wanted to do, but I found some issues in the parsing of
options and help text, fixed them while at it and
was careless enough to check several other templates
for similar flaws.

The reason for the --mask-tmp is to be able to prevent
systemd from over-mounting /tmp with tmpfs in the container.
My current use-case is that I want to be able to use
vagrant-cachier with vagrant-lxc.

Thanks for review / comments / push, ...

Cheers - Michael


From a243b74f1cf61d3c400a16a7d6d287f15cc7c99a Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 09:32:39 +0100
Subject: [PATCH 01/22] lxc-debian: fix parsing of option "--clean": it takes
 no argument.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-debian.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index a9a1652..603894f 100644
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
@@ -475,7 +475,7 @@ do
            --)                shift 1; break ;;
 
         -a|--arch)            arch=$2; shift 2;;
-        -c|--clean)           clean=$2; shift 1;;
+        -c|--clean)           clean=1; shift 1;;
            --mirror)          MIRROR=$2; shift 2;;
         -n|--name)            name=$2; shift 2;;
            --packages)        packages=$2; shift 2;;
-- 
2.1.0


From 9d77c63d5ed19b756b3b0dec7d3d4fa1d9a6a21f Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 09:38:48 +0100
Subject: [PATCH 02/22] lxc-debian: document "--clean" in the usage.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-debian.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index 603894f..d1e4edd 100644
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
@@ -438,6 +438,7 @@ usage()
 {
     cat <<EOF
 $1 -h|--help -p|--path=<path> [-a|--arch] [-c|--clean] [--mirror=<mirror>] [-r|--release=<release>] [--security-mirror=<security mirror>]
+clean: purge the download cache after installation
 arch: the container architecture (e.g. amd64): defaults to host arch
 release: the debian release (e.g. wheezy): defaults to current stable
 mirror: debain mirror to use during installation
-- 
2.1.0


From fea9ebdef51e1aaae65326accce805c2b8f02bf9 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 09:57:34 +0100
Subject: [PATCH 03/22] lxc-debian: document --path in usage

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-debian.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index d1e4edd..8fe7d9d 100644
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
@@ -439,6 +439,7 @@ usage()
     cat <<EOF
 $1 -h|--help -p|--path=<path> [-a|--arch] [-c|--clean] [--mirror=<mirror>] [-r|--release=<release>] [--security-mirror=<security mirror>]
 clean: purge the download cache after installation
+path: path under which the container will be created
 arch: the container architecture (e.g. amd64): defaults to host arch
 release: the debian release (e.g. wheezy): defaults to current stable
 mirror: debain mirror to use during installation
-- 
2.1.0


From ad326e531cf2bf8c95ed18721472f40d48ebba2f Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 09:58:09 +0100
Subject: [PATCH 04/22] lxc-debian: protect possibly unset variable with quotes
 for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-debian.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index 8fe7d9d..4ab61e5 100644
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
@@ -574,7 +574,7 @@ configure_debian_systemd $path $rootfs
 
 post_process ${rootfs} ${release} ${arch} ${hostarch} ${packages}
 
-if [ ! -z $clean ]; then
+if [ ! -z "$clean" ]; then
     clean || exit 1
     exit 0
 fi
-- 
2.1.0


From 4b06f77f7d8bde83f8a3d30e066d87e21a94f089 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:29:23 +0100
Subject: [PATCH 05/22] lxc-ubuntu: document option "--path" in usage text

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-ubuntu.in | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/templates/lxc-ubuntu.in b/templates/lxc-ubuntu.in
index bbe7f7d..55b54bd 100644
--- a/templates/lxc-ubuntu.in
+++ b/templates/lxc-ubuntu.in
@@ -673,8 +673,9 @@ usage()
 $1 -h|--help [-a|--arch] [-b|--bindhome <user>] [-d|--debug]
    [-F | --flush-cache] [-r|--release <release>] [ -S | --auth-key <keyfile>]
    [--rootfs <rootfs>] [--packages <packages>] [-u|--user <user>] [--password <password>]
-   [--mirror <url>] [--security-mirror <url>]
+   [--mirror <url>] [--security-mirror <url>] [-p|--path <path>]
 release: the ubuntu release (e.g. precise): defaults to host release on ubuntu, otherwise uses latest LTS
+path: path under which the container will be created
 bindhome: bind <user>'s home into the container
           The ubuntu user will not be created, and <user> will have
           sudo access.
-- 
2.1.0


From efcb164003876642b2f55432d80b229848848e4e Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:34:49 +0100
Subject: [PATCH 06/22] lxc-opensuse: fix tab/whitespace mixup in usage text.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-opensuse.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
index f727250..89971da 100644
--- a/templates/lxc-opensuse.in
+++ b/templates/lxc-opensuse.in
@@ -403,7 +403,7 @@ do
         -p|--path)      path=$2; shift 2;;
         --rootfs)       rootfs=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
-	-r|--release)   DISTRO=$2; shift 2;;
+        -r|--release)   DISTRO=$2; shift 2;;
         -c|--clean)     clean=$2; shift 2;;
         --)             shift 1; break ;;
         *)              break ;;
-- 
2.1.0


From 0f04581821cff394913daa4ff34bbbe41c57710b Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:35:20 +0100
Subject: [PATCH 07/22] lxc-opensuse: fix parsing of option "--clean": it takes
 no argument

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-opensuse.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
index 89971da..20ffdbd 100644
--- a/templates/lxc-opensuse.in
+++ b/templates/lxc-opensuse.in
@@ -404,7 +404,7 @@ do
         --rootfs)       rootfs=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
         -r|--release)   DISTRO=$2; shift 2;;
-        -c|--clean)     clean=$2; shift 2;;
+        -c|--clean)     clean=1; shift 1;;
         --)             shift 1; break ;;
         *)              break ;;
     esac
-- 
2.1.0


From 167d90b621fc4340987e8d980e18df8f66afb59e Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:36:06 +0100
Subject: [PATCH 08/22] lxc-opensuse: protect possibly unset variable with
 quotes in -z check

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-opensuse.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
index 20ffdbd..bb015c8 100644
--- a/templates/lxc-opensuse.in
+++ b/templates/lxc-opensuse.in
@@ -489,7 +489,7 @@ if [ $? -ne 0 ]; then
     exit 1
 fi
 
-if [ ! -z $clean ]; then
+if [ ! -z "$clean" ]; then
     clean || exit 1
     exit 0
 fi
-- 
2.1.0


From 9f7db00ea47e775045aaca2aeccc1779f22d83be Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:40:34 +0100
Subject: [PATCH 09/22] lxc-archlinux: fix paths printed in helptext.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-archlinux.in | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/lxc-archlinux.in b/templates/lxc-archlinux.in
index fc6f714..20d0663 100644
--- a/templates/lxc-archlinux.in
+++ b/templates/lxc-archlinux.in
@@ -193,8 +193,8 @@ usage:
 Mandatory args:
   -n,--name           container name, used to as an identifier for that container from now on
 Optional args:
-  -p,--path           path to where the container rootfs will be created (${default_path})
-  --rootfs            path for actual container rootfs, (${default_path/rootfs)
+  -p,--path           path to where the container rootfs will be created (${default_path}/<container_name>)
+  --rootfs            path for actual container rootfs, (${default_path/<container_name>/rootfs)
   -P,--packages       preinstall additional packages, comma-separated list
   -e,--enable_units   enable systemd services, comma-separated list
   -d,--disable_units  disable systemd services, comma-separated list
-- 
2.1.0


From 6f3dc9d73b24512efc28836a240625759e0af9bc Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:43:12 +0100
Subject: [PATCH 10/22] lxc-altlinux: fix parsing of option "--clean": it takes
 no argument

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-altlinux.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-altlinux.in b/templates/lxc-altlinux.in
index 1c5084e..9e78125 100644
--- a/templates/lxc-altlinux.in
+++ b/templates/lxc-altlinux.in
@@ -398,7 +398,7 @@ do
         --rootfs)       rootfs_path=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
         -P|--profile)   profile=$2; shift 2;;
-        -c|--clean)     clean=$2; shift 2;;
+        -c|--clean)     clean=1; shift 1;;
         -R|--release)   release=$2; shift 2;;
         -4|--ipv4)      ipv4=$2; shift 2;;
         -6|--ipv6)      ipv6=$2; shift 2;;
-- 
2.1.0


From 7d58ecd08e7d25da51945caa78d240388efdbbe2 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:43:52 +0100
Subject: [PATCH 11/22] lxc-altlinux: protect possibly unset variable with
 quotes for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-altlinux.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-altlinux.in b/templates/lxc-altlinux.in
index 9e78125..ac4527b 100644
--- a/templates/lxc-altlinux.in
+++ b/templates/lxc-altlinux.in
@@ -478,7 +478,7 @@ if [ $? -ne 0 ]; then
     exit 1
 fi
 
-if [ ! -z $clean ]; then
+if [ ! -z "$clean" ]; then
     clean || exit 1
     exit 0
 fi
-- 
2.1.0


From 9e49e0ecc308be0f490f04e358ae7948505b1b75 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:48:40 +0100
Subject: [PATCH 12/22] lxc-openmandriva: fix parsing of option "--clean": it
 takes no argument

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-openmandriva.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-openmandriva.in b/templates/lxc-openmandriva.in
index 45e2efa..4656177 100644
--- a/templates/lxc-openmandriva.in
+++ b/templates/lxc-openmandriva.in
@@ -377,7 +377,7 @@ do
         --rootfs)       rootfs_path=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
         -P|--profile)   profile=$2; shift 2;;
-        -c|--clean)     clean=$2; shift 2;;
+        -c|--clean)     clean=1; shift 1;;
         -R|--release)   release=$2; shift 2;;
         -A|--arch)      arch=$2; shift 2;;
         -4|--ipv4)      ipv4=$2; shift 2;;
-- 
2.1.0


From 257cfeaa233c24a33d93785956c2969750416869 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:49:19 +0100
Subject: [PATCH 13/22] lxc-openmandriva: protect possibly unset variable with
 quotes in -z check

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-openmandriva.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-openmandriva.in b/templates/lxc-openmandriva.in
index 4656177..be8023e 100644
--- a/templates/lxc-openmandriva.in
+++ b/templates/lxc-openmandriva.in
@@ -483,7 +483,7 @@ if [ $? -ne 0 ]; then
     exit 1
 fi
 
-if [ ! -z $clean ]; then
+if [ ! -z "$clean" ]; then
     clean || exit 1
     exit 0
 fi
-- 
2.1.0


From baec0433c6d87c2df2b1cd455277d55248882497 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:01:48 +0100
Subject: [PATCH 14/22] lxc-centos: fix documentation of default value for
 --path.

Use macro @LXCPATH@ not only in code but also in corresponding usage text.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-centos.in | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
index ee88178..7a7f36d 100644
--- a/templates/lxc-centos.in
+++ b/templates/lxc-centos.in
@@ -671,7 +671,8 @@ usage:
 Mandatory args:
   -n,--name         container name, used to as an identifier for that container from now on
 Optional args:
-  -p,--path         path to where the container rootfs will be created, defaults to /var/lib/lxc/name.
+  -p,--path         path to where the container rootfs will be created, defaults to @LXCPATH@/<name>.
+
   -c,--clean        clean the cache
   -R,--release      Centos release for the new container. if the host is Centos, then it will defaultto the host's release.
      --fqdn         fully qualified domain name (FQDN) for DNS and system naming
-- 
2.1.0


From 9d0ed6b06ba00ecfbe9fcbdb47e1f0efd58fbdd1 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:03:05 +0100
Subject: [PATCH 15/22] lxc-centos: fix parsing of option "--clean": it takes
 no argument

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-centos.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
index 7a7f36d..8b70aa0 100644
--- a/templates/lxc-centos.in
+++ b/templates/lxc-centos.in
@@ -698,7 +698,7 @@ do
         -p|--path)      path=$2; shift 2;;
         --rootfs)       rootfs=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
-        -c|--clean)     clean=$2; shift 2;;
+        -c|--clean)     clean=1; shift 1;;
         -R|--release)   release=$2; shift 2;;
 	--repo)		repo="$2"; shift 2;;
         -a|--arch)      newarch=$2; shift 2;;
-- 
2.1.0


From e4a3bc73b6feb23c8ce1c13092175c350d3826fe Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:03:31 +0100
Subject: [PATCH 16/22] lxc-centos: fix tab/space mixup in help text.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-centos.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
index 8b70aa0..94a2170 100644
--- a/templates/lxc-centos.in
+++ b/templates/lxc-centos.in
@@ -700,7 +700,7 @@ do
         -n|--name)      name=$2; shift 2;;
         -c|--clean)     clean=1; shift 1;;
         -R|--release)   release=$2; shift 2;;
-	--repo)		repo="$2"; shift 2;;
+        --repo)         repo="$2"; shift 2;;
         -a|--arch)      newarch=$2; shift 2;;
         --fqdn)         utsname=$2; shift 2;;
         --)             shift 1; break ;;
-- 
2.1.0


From 57f4500f73d16a81eb99599b72e1ef62fb3f4277 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:03:53 +0100
Subject: [PATCH 17/22] lxc-centos: protect possibly unset variable with quotes
 for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-centos.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
index 94a2170..72ff143 100644
--- a/templates/lxc-centos.in
+++ b/templates/lxc-centos.in
@@ -888,7 +888,7 @@ fi
 
 configure_centos_init
 
-if [ ! -z $clean ]; then
+if [ ! -z "$clean" ]; then
     clean || exit 1
     exit 0
 fi
-- 
2.1.0


From 75642717e9638547b1600b9f525d9273b80920e8 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 09:59:20 +0100
Subject: [PATCH 18/22] lxc-fedora: fix documentation of default value of
 --path in usage

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-fedora.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index adfaab2..5dbf57f 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -1189,7 +1189,7 @@ usage:
 Mandatory args:
   -n,--name         container name, used to as an identifier for that container from now on
 Optional args:
-  -p,--path         path to where the container will be created, defaults to @LXCPATH at . The container config will go under @LXCPATH@ in that case
+  -p,--path         path to where the container will be created, defaults to @LXCPATH@/<name>.
   --rootfs          path for actual rootfs.
   -c,--clean        clean the cache
   -R,--release      Fedora release for the new container. if the host is Fedora, then it will default to the host's release.
-- 
2.1.0


From 30c4cc747533c23a71217e180b104759539e103f Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:00:06 +0100
Subject: [PATCH 19/22] lxc-fedora: fix parsing of option "--clean": it takes
 no argument

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-fedora.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index 5dbf57f..3b9e1e7 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -1215,7 +1215,7 @@ do
         -p|--path)      path=$2; shift 2;;
         --rootfs)       rootfs=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
-        -c|--clean)     clean=$2; shift 2;;
+        -c|--clean)     clean=1; shift 1;;
         -R|--release)   release=$2; shift 2;;
         -a|--arch)      newarch=$2; shift 2;;
         --fqdn)         utsname=$2; shift 2;;
-- 
2.1.0


From 16fe5ef14f99a026aef1f663d6b2fc8f47e6c323 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:01:18 +0100
Subject: [PATCH 20/22] lxc-fedora: protect possibly unset variable with quotes
 for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-fedora.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index 3b9e1e7..4f35b81 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -1415,7 +1415,7 @@ then
     configure_fedora_init
 fi
 
-if [ ! -z $clean ]; then
+if [ ! -z "$clean" ]; then
     clean || exit 1
     exit 0
 fi
-- 
2.1.0


From ec8a837f209dfae827bcf2afbd0406ea888a7300 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:22:18 +0100
Subject: [PATCH 21/22] lxc-fedora: break overly long lines in the help text.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-fedora.in | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index 4f35b81..823921b 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -1184,15 +1184,18 @@ usage()
     cat <<EOF
 usage:
     $1 -n|--name=<container_name>
-        [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>] [--fqdn=<network name of container>] [-a|--arch=<arch of the container>]
+        [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>]
+        [--fqdn=<network name of container>] [-a|--arch=<arch of the container>]
         [-h|--help]
 Mandatory args:
   -n,--name         container name, used to as an identifier for that container from now on
 Optional args:
-  -p,--path         path to where the container will be created, defaults to @LXCPATH@/<name>.
+  -p,--path         path to where the container will be created,
+                    defaults to @LXCPATH@/<name>.
   --rootfs          path for actual rootfs.
   -c,--clean        clean the cache
-  -R,--release      Fedora release for the new container. if the host is Fedora, then it will default to the host's release.
+  -R,--release      Fedora release for the new container.
+                    Defaults to host's release if the host is Fedora.
      --fqdn         fully qualified domain name (FQDN) for DNS and system naming
   -a,--arch         Define what arch the container will be [i686,x86_64]
   -h,--help         print this help
-- 
2.1.0


From 66ce44a145745f4ea439f0a1b3c9809d680f1a9d Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:25:24 +0100
Subject: [PATCH 22/22] lxc-fedora: add a new option --mask-tmp

This will configure the container to prevent the standard
behaviour of over-mounting /tmp with tmpfs, which can be
undesirable in some cases.

My personal use case is vagrant-lxc in combination with
vagrant-cachier.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-fedora.in | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index 823921b..f4067e8 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -372,6 +372,12 @@ configure_fedora_systemd()
     chroot ${rootfs_path} ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
     # Make systemd honor SIGPWR
     chroot ${rootfs_path} ln -s /usr/lib/systemd/system/halt.target /etc/systemd/system/sigpwr.target
+
+    # if desired, prevent systemd from over-mounting /tmp with tmpfs
+    if [ $masktmp -eq 1 ]; then
+        chroot ${rootfs_path} ln -s /dev/null /etc/systemd/system/tmp.mount
+    fi
+
     #dependency on a device unit fails it specially that we disabled udev
     # sed -i 's/After=dev-%i.device/After=/' ${rootfs_path}/lib/systemd/system/getty\@.service
     #
@@ -1186,6 +1192,7 @@ usage:
     $1 -n|--name=<container_name>
         [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>]
         [--fqdn=<network name of container>] [-a|--arch=<arch of the container>]
+        [--mask-tmp]
         [-h|--help]
 Mandatory args:
   -n,--name         container name, used to as an identifier for that container from now on
@@ -1198,18 +1205,21 @@ Optional args:
                     Defaults to host's release if the host is Fedora.
      --fqdn         fully qualified domain name (FQDN) for DNS and system naming
   -a,--arch         Define what arch the container will be [i686,x86_64]
+  --mask-tmp        Prevent systemd from over-mounting /tmp with tmpfs.
   -h,--help         print this help
 EOF
     return 0
 }
 
-options=$(getopt -o a:hp:n:cR: -l help,path:,rootfs:,name:,clean,release:,arch:,fqdn: -- "$@")
+options=$(getopt -o a:hp:n:cR: -l help,path:,rootfs:,name:,clean,release:,arch:,fqdn:,mask-tmp -- "$@")
 if [ $? -ne 0 ]; then
     usage $(basename $0)
     exit 1
 fi
 
 arch=$(uname -m)
+masktmp=0
+
 eval set -- "$options"
 while true
 do
@@ -1222,6 +1232,7 @@ do
         -R|--release)   release=$2; shift 2;;
         -a|--arch)      newarch=$2; shift 2;;
         --fqdn)         utsname=$2; shift 2;;
+        --mask-tmp)     masktmp=1; shift 1;;
         --)             shift 1; break ;;
         *)              break ;;
     esac
-- 
2.1.0

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150108/c19e2c4a/attachment.sig>

From obnox at samba.org  Thu Jan  8 10:16:52 2015
From: obnox at samba.org (Michael Adam)
Date: Thu, 8 Jan 2015 11:16:52 +0100
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150108100516.GK2958@obnox.de>
References: <20150108100516.GK2958@obnox.de>
Message-ID: <20150108101652.GL2958@obnox.de>

For those who prefer it, the patches can also be
fetched via git from branch master of
https://github.com/obnoxxx/lxc.git

Cheers - Michael

On 2015-01-08 at 11:05 +0100, Michael Adam wrote:
> 
> Hi,
> 
> below find the output of "git format-patch --stdout "
> of a series of trivial patches to fix some minor issues
> in the template scripts.
> 
> The final patch adds a new parameter to the fedora
> template: "--mask-tmp". This is what I actually only
> wanted to do, but I found some issues in the parsing of
> options and help text, fixed them while at it and
> was careless enough to check several other templates
> for similar flaws.
> 
> The reason for the --mask-tmp is to be able to prevent
> systemd from over-mounting /tmp with tmpfs in the container.
> My current use-case is that I want to be able to use
> vagrant-cachier with vagrant-lxc.
> 
> Thanks for review / comments / push, ...
> 
> Cheers - Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150108/8a3c7bc4/attachment.sig>

From noreply at github.com  Thu Jan  8 16:58:00 2015
From: noreply at github.com (GitHub)
Date: Thu, 08 Jan 2015 08:58:00 -0800
Subject: [lxc-devel] [lxc/lxc] 64b4c7: apparmor: Fix slave bind mounts
Message-ID: <54aeb718a1734_55283f87a4d5729c8302a@hookshot-fe4-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 64b4c7a34b5c0407f3bcddc83f7c061dadb583bb
      https://github.com/lxc/lxc/commit/64b4c7a34b5c0407f3bcddc83f7c061dadb583bb
  Author: Martin Pitt <martin.pitt at ubuntu.com>
  Date:   2015-01-08 (Thu, 08 Jan 2015)

  Changed paths:
    M config/apparmor/abstractions/start-container

  Log Message:
  -----------
  apparmor: Fix slave bind mounts

The permission to make a mount "slave" is spelt "make-slave", not "slave", see
https://launchpad.net/bugs/1401619. Also, we need to make all mounts slave, not
just the root dir.

https://launchpad.net/bugs/1350947


  Commit: bb2afd6038b6271bddf46b0f197a42ba7a3d10f3
      https://github.com/lxc/lxc/commit/bb2afd6038b6271bddf46b0f197a42ba7a3d10f3
  Author: hallyn <serge at hallyn.com>
  Date:   2015-01-08 (Thu, 08 Jan 2015)

  Changed paths:
    M config/apparmor/abstractions/start-container

  Log Message:
  -----------
  Merge pull request #393 from martinpitt/master

apparmor: Fix slave bind mounts


Compare: https://github.com/lxc/lxc/compare/97a8f74f0c80...bb2afd6038b6

From riyakhanna1983 at gmail.com  Fri Jan  9 02:18:03 2015
From: riyakhanna1983 at gmail.com (riya khanna)
Date: Thu, 8 Jan 2015 20:18:03 -0600
Subject: [lxc-devel] lxc-start fails
Message-ID: <CALRD3qJctrW=K4_0Dy20EWGJqW+gCv6GMv2sNL20rRRXOwrz5g@mail.gmail.com>

Hi,

I'm trying to start a container on busy box host.

lxc-start --logfile container.log --logpriority info --name L -f
lxc.conf -- /init

container.log shows the following error:
lxc_conf - conf.c:prepare_ramfs_root:1517 - Bad address - Failed to
make . rprivate

Any idea on what's wrong here?

my lxc.conf is as follows.

lxc.utsname = container
lxc.rootfs = rootfs
lxc.mount.entry=none rootfs/proc proc defaults 0 0
lxc.mount.entry=none rootfs/sys sysfs defaults 0 0
lxc.mount.entry=/dev rootfs/dev none bind 0 0

Using lxc version 1.1

mount shows the following

rootfs on / type rootfs (rw,size=368960k,nr_inodes=92240)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
none on /sys/fs/cgroup type cgroup
(rw,relatime,cpuset,cpu,cpuacct,memory,devices,freezer,blkio,perf_event,debug,clone_children)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)

Looking at the source, the following function fails:

int prepare_ramfs_root(char *root)
{
...
    if (mount(".", NULL, NULL, MS_REC | MS_PRIVATE, NULL)) {
        SYSERROR("Failed to make . rprivate");
        return -1;
    }
...
}

From serge.hallyn at ubuntu.com  Fri Jan  9 14:12:38 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 9 Jan 2015 14:12:38 +0000
Subject: [lxc-devel] lxc-start fails
In-Reply-To: <CALRD3qJctrW=K4_0Dy20EWGJqW+gCv6GMv2sNL20rRRXOwrz5g@mail.gmail.com>
References: <CALRD3qJctrW=K4_0Dy20EWGJqW+gCv6GMv2sNL20rRRXOwrz5g@mail.gmail.com>
Message-ID: <20150109141238.GB9897@ubuntumail>

Quoting riya khanna (riyakhanna1983 at gmail.com):
> Hi,
> 
> I'm trying to start a container on busy box host.
> 
> lxc-start --logfile container.log --logpriority info --name L -f
> lxc.conf -- /init
> 
> container.log shows the following error:
> lxc_conf - conf.c:prepare_ramfs_root:1517 - Bad address - Failed to
> make . rprivate

Hm.  Well that is an odd line.  Does it help if you change line 1517
to read

	if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {

?

From serge.hallyn at ubuntu.com  Fri Jan  9 16:33:42 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 9 Jan 2015 16:33:42 +0000
Subject: [lxc-devel] [PATCH 1/1] set close-all-fds by default
Message-ID: <20150109163342.GA10183@ubuntumail>

When containers request to be daemonized, close-all-fd is
set to true.  But when we switched ot daemonize-by-default we didn't
set close-all-fd by default.

Fix that.  In order to do that we have to always have a lxc_conf
object.  As a consequence, after this patch we can drop a bunch
of checks for c->lxc_conf existing.  We should consider removing
those.  This patch does not do that.

This should close https://github.com/lxc/lxc/issues/354

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/lxccontainer.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 406cead..878c483 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -457,6 +457,14 @@ static bool lxcapi_load_config(struct lxc_container *c, const char *alt_file)
 	return ret;
 }
 
+static void do_set_daemonize(struct lxc_container *c, bool state)
+{
+	c->daemonize = state;
+	/* daemonize implies close_all_fds so set it */
+	if (state)
+		c->lxc_conf->close_all_fds = 1;
+}
+
 static bool lxcapi_want_daemonize(struct lxc_container *c, bool state)
 {
 	if (!c || !c->lxc_conf)
@@ -465,10 +473,7 @@ static bool lxcapi_want_daemonize(struct lxc_container *c, bool state)
 		ERROR("Error getting mem lock");
 		return false;
 	}
-	c->daemonize = state;
-	/* daemonize implies close_all_fds so set it */
-	if (state == 1)
-		c->lxc_conf->close_all_fds = 1;
+	do_set_daemonize(c, state);
 	container_mem_unlock(c);
 	return true;
 }
@@ -4098,7 +4103,9 @@ struct lxc_container *lxc_container_new(const char *name, const char *configpath
 		container_destroy(c);
 		lxcapi_clear_config(c);
 	}
-	c->daemonize = true;
+	if (!c->lxc_conf)
+		c->lxc_conf = lxc_conf_init();
+	do_set_daemonize(c, true);
 	c->pidfile = NULL;
 
 	// assign the member functions
-- 
2.1.0


From serge.hallyn at ubuntu.com  Fri Jan  9 17:04:27 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 9 Jan 2015 17:04:27 +0000
Subject: [lxc-devel] Questions about lxc.autodev
In-Reply-To: <20141126213540.GK10205@dakara>
References: <20141126213540.GK10205@dakara>
Message-ID: <20150109170427.GB10330@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Hello,
> 
> So I'm looking into how to rework lxc.autodev to apply properly to all
> the cases we care about:
>  - Privileged containers started by root
>  - Unprivileged containers started by privileged root
>  - Unprivileged containers started by unprivileged root
>  - Unprivileged containers started by unprivileged user
> 
> My understanding is that autodev currently creates /dev/.lxc and then
> uses one directory per-container+lxc-path-hash under there, creates the
> devices nodes and uses that as the container's /dev.
> 
> My question is why the /dev/.lxc directory to begin with, wouldn't

Ok, after looking back through the code a bit,

One advantage of the current method is that it doesn't need to use a
tmpfs per container.  If the host uses devtmpfs (which most do)
then /dev/.lxc can just be a subdir, otherwise it needs to be the
single tmpfs mount.  This ensures that systemd will see a separate
/dev and be happy.

Another advantage of the current method is that the host can see
the container's /dev more easily.  Though I htink the existence
of lxc-device suggests that we're ok.  I mainly don't want to do
anything that makes it harder for our eventual implementation of
forwarding hotplug events into containers (as per the presentation
at plumbers)

> it make more sense to use LXC_PATH/<container>/dev, mount a tiny
> tmpfs on that and then use it? This would have the advantage of having

I guess one question is whether we think one more mount per container
can become a scalability issue.

Second question is whether systemd is happier if it sees that /dev is
on devtmpfs.

> the same path for privileged and unprivileged containers and avoid the
> ugly lxcpath hash.
> 
> 
> I believe the following setup would make a bit more sense and offer a
> consistent behaviour:
>  - If not available or not a tmpfs, create LXC_PATH/<container>/dev and
>    mount a tiny tmpfs on it. Chown the path to the container's root uid/gid
>    and chmod to something sane.
>  - For all the nodes we care about, attempt to mknod them in there, on
>    failure, fallback to touch+bind-mount from real /dev.

The improved consistency is appealing.

> This would allow for the exact same code to be used for all 4 cases, for
> the layout and location of the autodev tree to be entirely guessable
> without requiring fancy hashing (making it easier for external tools to
> interact with the autodev tree).
> 
> As with the current implementation, the tree wouldn't be flushed on
> container reboot but it would on container shutdown.
> 
> 
> Does the above make sense or am I missing something about the design of
> current autodev?
> 
> Cheers
> 
> -- 
> Stéphane Graber
> Ubuntu developer
> http://www.ubuntu.com



> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From riyakhanna1983 at gmail.com  Fri Jan  9 17:07:52 2015
From: riyakhanna1983 at gmail.com (riya khanna)
Date: Fri, 9 Jan 2015 11:07:52 -0600
Subject: [lxc-devel] lxc-start fails
In-Reply-To: <20150109141238.GB9897@ubuntumail>
References: <CALRD3qJctrW=K4_0Dy20EWGJqW+gCv6GMv2sNL20rRRXOwrz5g@mail.gmail.com>
 <20150109141238.GB9897@ubuntumail>
Message-ID: <CALRD3qKo82AmzJGN1g5b75MwSb_o9C=Q=oN0oTehMgmYmd56AQ@mail.gmail.com>

Yes, that works. Container starts BUT I get the following message:
lxc-start: monitor.c: lxc_monitor_open: 213 connect : Connection refused


# lxc-start --logfile container.log --logpriority info --name
container -f lxc.conf -- /init

lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 10
lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 50
lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 100

lxc-start: monitor.c: lxc_monitor_open: 213 connect : Connection refused
lxc-start: lxc_start.c: main: 345 The container failed to start.
lxc-start: lxc_start.c: main: 347 To get more details, run the
container in foreground mode.
lxc-start: lxc_start.c: main: 349 Additional information can be
obtained by setting the --logfile and --logpriority options.


On Fri, Jan 9, 2015 at 8:12 AM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
> Quoting riya khanna (riyakhanna1983 at gmail.com):
>> Hi,
>>
>> I'm trying to start a container on busy box host.
>>
>> lxc-start --logfile container.log --logpriority info --name L -f
>> lxc.conf -- /init
>>
>> container.log shows the following error:
>> lxc_conf - conf.c:prepare_ramfs_root:1517 - Bad address - Failed to
>> make . rprivate
>
> Hm.  Well that is an odd line.  Does it help if you change line 1517
> to read
>
>         if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
>
> ?
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Fri Jan  9 17:08:45 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 9 Jan 2015 17:08:45 +0000
Subject: [lxc-devel] Questions about lxc.autodev
In-Reply-To: <20150109170427.GB10330@ubuntumail>
References: <20141126213540.GK10205@dakara> <20150109170427.GB10330@ubuntumail>
Message-ID: <20150109170845.GC10330@ubuntumail>

Quoting Serge Hallyn (serge.hallyn at ubuntu.com):
> Another advantage of the current method is that the host can see
> the container's /dev more easily.  Though I htink the existence
> of lxc-device suggests that we're ok.  I mainly don't want to do
> anything that makes it harder for our eventual implementation of
> forwarding hotplug events into containers (as per the presentation
> at plumbers)

This wouldn't help with hotplug, but perhaps we should check for
$lxcpath/$name/keepdev, and if it exists then copy of bind-mount
any devices which exist there into $lxcpath/$name/dev (if autodev!=0)

From stgraber at ubuntu.com  Fri Jan  9 17:11:56 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 9 Jan 2015 12:11:56 -0500
Subject: [lxc-devel] Questions about lxc.autodev
In-Reply-To: <20150109170427.GB10330@ubuntumail>
References: <20141126213540.GK10205@dakara> <20150109170427.GB10330@ubuntumail>
Message-ID: <20150109171156.GA15714@dakara>

On Fri, Jan 09, 2015 at 05:04:27PM +0000, Serge Hallyn wrote:
> Quoting Stéphane Graber (stgraber at ubuntu.com):
> > Hello,
> > 
> > So I'm looking into how to rework lxc.autodev to apply properly to all
> > the cases we care about:
> >  - Privileged containers started by root
> >  - Unprivileged containers started by privileged root
> >  - Unprivileged containers started by unprivileged root
> >  - Unprivileged containers started by unprivileged user
> > 
> > My understanding is that autodev currently creates /dev/.lxc and then
> > uses one directory per-container+lxc-path-hash under there, creates the
> > devices nodes and uses that as the container's /dev.
> > 
> > My question is why the /dev/.lxc directory to begin with, wouldn't
> 
> Ok, after looking back through the code a bit,
> 
> One advantage of the current method is that it doesn't need to use a
> tmpfs per container.  If the host uses devtmpfs (which most do)
> then /dev/.lxc can just be a subdir, otherwise it needs to be the
> single tmpfs mount.  This ensures that systemd will see a separate
> /dev and be happy.
> 
> Another advantage of the current method is that the host can see
> the container's /dev more easily.  Though I htink the existence
> of lxc-device suggests that we're ok.  I mainly don't want to do
> anything that makes it harder for our eventual implementation of
> forwarding hotplug events into containers (as per the presentation
> at plumbers)
> 
> > it make more sense to use LXC_PATH/<container>/dev, mount a tiny
> > tmpfs on that and then use it? This would have the advantage of having
> 
> I guess one question is whether we think one more mount per container
> can become a scalability issue.
> 
> Second question is whether systemd is happier if it sees that /dev is
> on devtmpfs.

I've been using regular tmpfs for a while now with systemd and it's fine
with it. I don't believe it treats devtmpfs any differently than tmpfs.

> 
> > the same path for privileged and unprivileged containers and avoid the
> > ugly lxcpath hash.
> > 
> > 
> > I believe the following setup would make a bit more sense and offer a
> > consistent behaviour:
> >  - If not available or not a tmpfs, create LXC_PATH/<container>/dev and
> >    mount a tiny tmpfs on it. Chown the path to the container's root uid/gid
> >    and chmod to something sane.
> >  - For all the nodes we care about, attempt to mknod them in there, on
> >    failure, fallback to touch+bind-mount from real /dev.
> 
> The improved consistency is appealing.
> 
> > This would allow for the exact same code to be used for all 4 cases, for
> > the layout and location of the autodev tree to be entirely guessable
> > without requiring fancy hashing (making it easier for external tools to
> > interact with the autodev tree).
> > 
> > As with the current implementation, the tree wouldn't be flushed on
> > container reboot but it would on container shutdown.
> > 
> > 
> > Does the above make sense or am I missing something about the design of
> > current autodev?
> > 
> > Cheers
> > 
> > -- 
> > Stéphane Graber
> > Ubuntu developer
> > http://www.ubuntu.com
> 
> 
> 
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150109/78702a6c/attachment.sig>

From serge.hallyn at ubuntu.com  Fri Jan  9 17:17:56 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 9 Jan 2015 17:17:56 +0000
Subject: [lxc-devel] Questions about lxc.autodev
In-Reply-To: <20150109171156.GA15714@dakara>
References: <20141126213540.GK10205@dakara> <20150109170427.GB10330@ubuntumail>
 <20150109171156.GA15714@dakara>
Message-ID: <20150109171756.GE10330@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> On Fri, Jan 09, 2015 at 05:04:27PM +0000, Serge Hallyn wrote:
> > Quoting Stéphane Graber (stgraber at ubuntu.com):
> > > Hello,
> > > 
> > > So I'm looking into how to rework lxc.autodev to apply properly to all
> > > the cases we care about:
> > >  - Privileged containers started by root
> > >  - Unprivileged containers started by privileged root
> > >  - Unprivileged containers started by unprivileged root
> > >  - Unprivileged containers started by unprivileged user
> > > 
> > > My understanding is that autodev currently creates /dev/.lxc and then
> > > uses one directory per-container+lxc-path-hash under there, creates the
> > > devices nodes and uses that as the container's /dev.
> > > 
> > > My question is why the /dev/.lxc directory to begin with, wouldn't
> > 
> > Ok, after looking back through the code a bit,
> > 
> > One advantage of the current method is that it doesn't need to use a
> > tmpfs per container.  If the host uses devtmpfs (which most do)
> > then /dev/.lxc can just be a subdir, otherwise it needs to be the
> > single tmpfs mount.  This ensures that systemd will see a separate
> > /dev and be happy.
> > 
> > Another advantage of the current method is that the host can see
> > the container's /dev more easily.  Though I htink the existence
> > of lxc-device suggests that we're ok.  I mainly don't want to do
> > anything that makes it harder for our eventual implementation of
> > forwarding hotplug events into containers (as per the presentation
> > at plumbers)
> > 
> > > it make more sense to use LXC_PATH/<container>/dev, mount a tiny
> > > tmpfs on that and then use it? This would have the advantage of having
> > 
> > I guess one question is whether we think one more mount per container
> > can become a scalability issue.
> > 
> > Second question is whether systemd is happier if it sees that /dev is
> > on devtmpfs.
> 
> I've been using regular tmpfs for a while now with systemd and it's fine
> with it. I don't believe it treats devtmpfs any differently than tmpfs.

Cool, thanks for that info.

From serge.hallyn at ubuntu.com  Fri Jan  9 19:36:14 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 9 Jan 2015 19:36:14 +0000
Subject: [lxc-devel] [PATCH 1/2] autodev: switch strategies
Message-ID: <20150109193614.GF10330@ubuntumail>

Do not keep container devs under /dev/.lxc.  Instead, always
keep them in $lxcpath/$lxcname/rootfs.dev.  Mount a small
tmpfs there, and bind mount it into $mounted_rootfs/dev .

The tmpfs is mounted in the container monitor's namespace.  This
means that at every reboot it will get re-created.  It seems to
me this better replicates what happens on a real host.

If we want devices persisting across reboots, then perhaps we can
implement a $lxcpath/$name/keepdev directory containing devices to
bind into the container at each startup.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/conf.c  | 324 +++++++++-----------------------------------------------
 src/lxc/start.c |   1 -
 2 files changed, 51 insertions(+), 274 deletions(-)

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 72181dd..822f08d 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -94,10 +94,7 @@
 
 lxc_log_define(lxc_conf, lxc);
 
-#define MAXHWLEN    18
-#define MAXINDEXLEN 20
-#define MAXMTULEN   16
-#define MAXLINELEN  128
+#define LINELEN 4096
 
 #if HAVE_SYS_CAPABILITY_H
 #ifndef CAP_SETFCAP
@@ -295,9 +292,6 @@ static struct caps_opt caps_opt[] = {
 static struct caps_opt caps_opt[] = {};
 #endif
 
-const char *dev_base_path = "/dev/.lxc";
-const char *dev_user_path = "/dev/.lxc/user";
-
 static int run_buffer(char *buffer)
 {
 	struct lxc_popen_FILE *f;
@@ -1092,247 +1086,89 @@ fail:
 }
 
 /*
- * Check to see if a directory has something mounted on it and,
- * if it does, return the fstype.
- *
- * Code largely based on detect_shared_rootfs below
- *
- * Returns: # of matching entries in /proc/self/mounts
- * 	if != 0 fstype is filled with the last filesystem value.
- * 	if == 0 no matches found, fstype unchanged.
- *
- * ToDo: Maybe return the mount options in another parameter...
+ * Just create a path for /dev under $lxcpath/$name and in rootfs
+ * If we hit an error, log it but don't fail yet.
  */
-
-#define LINELEN 4096
-#define MAX_FSTYPE_LEN 128
-static int mount_check_fs( const char *dir, char *fstype )
+static void create_devdir(const char *path)
 {
-	char buf[LINELEN], *p;
-	struct stat s;
-	FILE *f;
-	int found_fs = 0;
-	char *p2;
-
-	DEBUG("entering mount_check_fs for %s", dir);
-
-	if ( 0 != access(dir, F_OK) || 0 != stat(dir, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		return 0;
-	}
-
-	f = fopen("/proc/self/mounts", "r");
-	if (!f)
-		return 0;
-	while (fgets(buf, LINELEN, f)) {
-		p = index(buf, ' ');
-		if( !p )
-			continue;
-		*p = '\0';
-		p2 = p + 1;
-
-		p = index(p2, ' ');
-		if( !p )
-			continue;
-		*p = '\0';
-
-		/* Compare the directory in the entry to desired */
-		if( strcmp( p2, dir ) ) {
-			continue;
-		}
-
-		p2 = p + 1;
-		p = index( p2, ' ');
-		if( !p )
-			continue;
-		*p = '\0';
-
-		++found_fs;
-
-		if( fstype ) {
-			strncpy( fstype, p2, MAX_FSTYPE_LEN - 1 );
-			fstype [ MAX_FSTYPE_LEN - 1 ] = '\0';
-		}
-	}
-
-	fclose(f);
-
-	DEBUG("mount_check_fs returning %d last %s", found_fs, fstype);
-
-	return found_fs;
+	int ret = mkdir(path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
+	if (ret) /* Issue an error but don't fail yet! */
+		SYSERROR("Unable to create devpath %s", path);
+	ret = chmod(path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
+	if (ret)
+		SYSERROR("Failed to chown devpath %s", path);
+	INFO("Created %s", path);
 }
 
 /*
- * Locate a devtmpfs mount (should be on /dev) and create a container
- * subdirectory on it which we can then bind mount to the container
- * /dev instead of mounting a tmpfs there.
+ * Create $lxcpath/$name/dev if it does not yet exist.
  * If we fail, return NULL.
  * Else return the pointer to the name buffer with the string to
  * the devtmpfs subdirectory.
  */
 
-static char *mk_devtmpfs(const char *name, char *path, const char *lxcpath)
+static bool mk_devtmpfs(const char *hostpath, const char *container_path)
 {
-	int ret;
-	struct stat s;
-	char tmp_path[MAXPATHLEN];
-	char fstype[MAX_FSTYPE_LEN];
-	uint64_t hash;
-
-	if ( 0 != access(dev_base_path, F_OK) || 0 != stat(dev_base_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		/* This is just making /dev/.lxc it better work or we're done */
-		ret = mkdir(dev_base_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
-		if ( ret ) {
-			SYSERROR( "Unable to create /dev/.lxc for autodev" );
-			return NULL;
-		}
-	}
-
-	/*
-	 * Programmers notes:
-	 * 	We can not do mounts in this area of code that we want
-	 * 	to be visible in the host.  Consequently, /dev/.lxc must
-	 * 	be set up earlier if we need a tmpfs mounted there.
-	 * 	That only affects the rare cases where autodev is enabled
-	 * 	for a container and devtmpfs is not mounted on /dev in the
-	 * 	host.  In that case, we'll fall back to the old method
-	 * 	of mounting a tmpfs in the container and have no visibility
-	 * 	into the container /dev.
-	 */
-	if( ! mount_check_fs( "/dev", fstype )
-		|| strcmp( "devtmpfs", fstype ) ) {
-		/* Either /dev was not mounted or was not devtmpfs */
-
-		if ( ! mount_check_fs( "/dev/.lxc", NULL ) ) {
-			/*
-			 * /dev/.lxc is not already mounted
-			 * Doing a mount here does no good, since
-			 * it's not visible in the host.
-			 */
-
-			ERROR("/dev/.lxc is not setup - taking fallback" );
-			return NULL;
-		}
-	}
-
-	if ( 0 != access(dev_user_path, F_OK) || 0 != stat(dev_user_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		/*
-		 * This is making /dev/.lxc/user path for non-priv users.
-		 * If this doesn't work, we'll have to fall back in the
-		 * case of non-priv users.  It's mode 1777 like /tmp.
-		 */
-		ret = mkdir(dev_user_path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
-		if ( ret ) {
-			/* Issue an error but don't fail yet! */
-			ERROR("Unable to create /dev/.lxc/user");
-		}
-		/* Umask tends to screw us up here */
-		chmod(dev_user_path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
-	}
-
-	/*
-	 * Since the container name must be unique within a given
-	 * lxcpath, we're going to use a hash of the path
-	 * /lxcpath/name as our hash name in /dev/.lxc/
-	 */
-
-	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s", lxcpath, name);
-	if (ret < 0 || ret >= MAXPATHLEN)
-		return NULL;
-
-	hash = fnv_64a_buf(tmp_path, ret, FNV1A_64_INIT);
-
-	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_base_path, name, hash);
-	if (ret < 0 || ret >= MAXPATHLEN)
-		return NULL;
-
-	if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		ret = mkdir(tmp_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
-		if ( ret ) {
-			/* Something must have failed with the dev_base_path...
-			 * Maybe unpriv user.  Try dev_user_path now... */
-			INFO("Setup in /dev/.lxc failed.  Trying /dev/.lxc/user." );
-
-			ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_user_path, name, hash);
-			if (ret < 0 || ret >= MAXPATHLEN)
-				return NULL;
-
-			if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-				ret = mkdir(tmp_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
-				if ( ret ) {
-					ERROR("Container /dev setup in host /dev failed - taking fallback" );
-					return NULL;
-				}
-			}
-		}
+	if (!dir_exists(hostpath))
+		create_devdir(hostpath);
+	if (!dir_exists(container_path))
+		create_devdir(container_path);
+	if (0 != mount("none", hostpath, "tmpfs", 0, "size=100000,mode=755")) {
+		SYSERROR("Failed mounting tmpfs onto %s\n", hostpath);
+		return false;
 	}
-
-	strcpy( path, tmp_path );
-	return path;
+	return true;
 }
 
-/*
- * Do we want to add options for max size of /dev and a file to
- * specify which devices to create?
- */
 static int mount_autodev(const char *name, char *root, const char *lxcpath)
 {
 	int ret;
-	struct stat s;
-	char path[MAXPATHLEN];
-	char host_path[MAXPATHLEN];
-	char devtmpfs_path[MAXPATHLEN];
+	size_t hlen, clen;
+	char *path, *host_path;
 
 	INFO("Mounting /dev under %s", root);
 
-	ret = snprintf(host_path, MAXPATHLEN, "%s/%s/rootfs.dev", lxcpath, name);
-	if (ret < 0 || ret > MAXPATHLEN)
+	/* $(lxcpath) + '/' + $(name) + "/rootfs.dev" + '\0' */
+	hlen = strlen(lxcpath) + strlen(name) + 13;
+	host_path = alloca(hlen);
+	/* $(root) + "/dev/pts" + '\0' */
+	clen = strlen(root) + 9;
+	path = alloca(clen);
+	ret = snprintf(host_path, hlen, "%s/%s/rootfs.dev", lxcpath, name);
+	if (ret < 0 || ret >= hlen)
 		return -1;
 
-	ret = snprintf(path, MAXPATHLEN, "%s/dev", root);
-	if (ret < 0 || ret > MAXPATHLEN)
+	ret = snprintf(path, clen, "%s/dev", root);
+	if (ret < 0 || ret >= clen)
 		return -1;
 
-	if (mk_devtmpfs( name, devtmpfs_path, lxcpath ) ) {
-		/*
-		 * Get rid of old links and directoriess
-		 * This could be either a symlink and we remove it,
-		 * or an empty directory and we remove it,
-		 * or non-existent and we don't care,
-		 * or a non-empty directory, and we will then emit an error
-		 * but we will not fail out the process.
-		 */
-		unlink( host_path );
-		rmdir( host_path );
-		ret = symlink(devtmpfs_path, host_path);
+	/*
+	 * Create $lxcpath/$name/dev and $(mounted_rootfs/dev), and
+	 * mount a small tmpfs onto $lxcpath/$name/dev.
+	 */
+	if (!mk_devtmpfs(host_path, path))
+		return -1;
 
-		if ( ret < 0 ) {
-			SYSERROR("WARNING: Failed to create symlink '%s'->'%s'", host_path, devtmpfs_path);
-		}
-		DEBUG("Bind mounting %s to %s", devtmpfs_path , path );
-		ret = mount(devtmpfs_path, path, NULL, MS_BIND, 0 );
-	} else {
-		/* Only mount a tmpfs on here if we don't already a mount */
-		if ( ! mount_check_fs( host_path, NULL ) ) {
-			DEBUG("Mounting tmpfs to %s", host_path );
-			ret = mount("none", path, "tmpfs", 0, "size=100000,mode=755");
-		} else {
-			/* This allows someone to manually set up a mount */
-			DEBUG("Bind mounting %s to %s", host_path, path );
-			ret = mount(host_path , path, NULL, MS_BIND, 0 );
-		}
-	}
+	/*
+	 * bind mount the tmpfs from $lxcpath/$name/dev onto
+	 * $(mounted_rootfs)/dev.
+	 */
+	ret = mount(host_path, path, 0, MS_BIND, NULL);
 	if (ret) {
-		SYSERROR("Failed to mount /dev at %s", root);
+		SYSERROR("Failed to bind /dev into container at %s", root);
 		return -1;
 	}
-	ret = snprintf(path, MAXPATHLEN, "%s/dev/pts", root);
-	if (ret < 0 || ret >= MAXPATHLEN)
+	INFO("Bind-mounted %s -> %s", host_path, path);
+
+	ret = snprintf(path, clen, "%s/dev/pts", root);
+	if (ret < 0 || ret >= clen)
 		return -1;
+
 	/*
 	 * If we are running on a devtmpfs mapping, dev/pts may already exist.
 	 * If not, then create it and exit if that fails...
 	 */
-	if ( 0 != access(path, F_OK) || 0 != stat(path, &s) || 0 == S_ISDIR(s.st_mode) ) {
+	if (!dir_exists(path)) {
 		ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
 		if (ret) {
 			SYSERROR("Failed to create /dev/pts in container");
@@ -1395,64 +1231,6 @@ static int setup_autodev(const char *root)
 	return 0;
 }
 
-/*
- * Locate allocated devtmpfs mount and purge it.
- * path lookup mostly taken from mk_devtmpfs
- */
-int lxc_delete_autodev(struct lxc_handler *handler)
-{
-	int ret;
-	struct stat s;
-	struct lxc_conf *lxc_conf = handler->conf;
-	const char *name = handler->name;
-	const char *lxcpath = handler->lxcpath;
-	char tmp_path[MAXPATHLEN];
-	uint64_t hash;
-
-	if ( lxc_conf->autodev <= 0 )
-		return 0;
-
-	/* don't clean on reboot */
-	if ( lxc_conf->reboot == 1 )
-		return 0;
-
-	/*
-	 * Use the same logic as mk_devtmpfs to compute candidate
-	 * path for cleanup.
-	 */
-
-	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s", lxcpath, name);
-	if (ret < 0 || ret >= MAXPATHLEN)
-		return -1;
-
-	hash = fnv_64a_buf(tmp_path, ret, FNV1A_64_INIT);
-
-	/* Probe /dev/.lxc/<container name>.<hash> */
-	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_base_path, name, hash);
-	if (ret < 0 || ret >= MAXPATHLEN)
-		return -1;
-
-	if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		/* Probe /dev/.lxc/user/<container name>.<hash> */
-		ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_user_path, name, hash);
-		if (ret < 0 || ret >= MAXPATHLEN)
-			return -1;
-
-		if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-			WARN("Failed to locate autodev /dev/.lxc and /dev/.lxc/user." );
-			return -1;
-		}
-	}
-
-	/* Do the cleanup */
-	INFO("Cleaning %s", tmp_path );
-	if ( 0 != lxc_rmdir_onedev(tmp_path, NULL) ) {
-		ERROR("Failed to cleanup autodev" );
-	}
-
-	return 0;
-}
-
 static int setup_rootfs(struct lxc_conf *conf)
 {
 	const struct lxc_rootfs *rootfs = &conf->rootfs;
diff --git a/src/lxc/start.c b/src/lxc/start.c
index cd78665..98905a3 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -477,7 +477,6 @@ void lxc_fini(const char *name, struct lxc_handler *handler)
 
 	lxc_console_delete(&handler->conf->console);
 	lxc_delete_tty(&handler->conf->tty_info);
-	lxc_delete_autodev(handler);
 	close(handler->conf->maincmd_fd);
 	handler->conf->maincmd_fd = -1;
 	free(handler->name);
-- 
2.1.0


From serge.hallyn at ubuntu.com  Fri Jan  9 19:38:36 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 9 Jan 2015 19:38:36 +0000
Subject: [lxc-devel] [PATCH 2/2] fill_autodev: bind-mount if mknod fails
In-Reply-To: <20150109193614.GF10330@ubuntumail>
References: <20150109193614.GF10330@ubuntumail>
Message-ID: <20150109193836.GA10641@ubuntumail>

First, rename setup_autodev to fill_autodev, since all it
does is populate it, not fully set it up.

Secondly, if mknod of a device fails, then try bind-mounting
it from the host rather than failing immediately.

Note that this isn't an urgent patch because the common.userns
configuration hook already specifies bind,create=file mount
entries for all the devices we would want.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/conf.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 822f08d..665631b 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -1197,7 +1197,7 @@ static const struct lxc_devs lxc_devs[] = {
 	{ "console",	S_IFCHR | S_IRUSR | S_IWUSR,	       5, 1	},
 };
 
-static int setup_autodev(const char *root)
+static int fill_autodev(const char *root)
 {
 	int ret;
 	char path[MAXPATHLEN];
@@ -1221,8 +1221,25 @@ static int setup_autodev(const char *root)
 			return -1;
 		ret = mknod(path, d->mode, makedev(d->maj, d->min));
 		if (ret && errno != EEXIST) {
-			SYSERROR("Error creating %s", d->name);
-			return -1;
+			char hostpath[MAXPATHLEN];
+			FILE *pathfile;
+
+			// Unprivileged containers cannot create devices, so
+			// bind mount the device from the host
+			ret = snprintf(hostpath, MAXPATHLEN, "/dev/%s", d->name);
+			if (ret < 0 || ret >= MAXPATHLEN)
+				return -1;
+			pathfile = fopen(path, "wb");
+			if (!pathfile) {
+				SYSERROR("Failed to create device mount target '%s'", path);
+				return -1;
+			}
+			fclose(pathfile);
+			if (mount(hostpath, path, 0, MS_BIND, NULL) != 0) {
+				SYSERROR("Failed bind mounting device %s from host into container",
+					d->name);
+				return -1;
+			}
 		}
 	}
 	umask(cmask);
@@ -3889,7 +3906,7 @@ int lxc_setup(struct lxc_handler *handler)
 			ERROR("failed to run autodev hooks for container '%s'.", name);
 			return -1;
 		}
-		if (setup_autodev(lxc_conf->rootfs.mount)) {
+		if (fill_autodev(lxc_conf->rootfs.mount)) {
 			ERROR("failed to populate /dev in the container");
 			return -1;
 		}
-- 
2.1.0


From serge.hallyn at ubuntu.com  Fri Jan  9 20:26:26 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 9 Jan 2015 20:26:26 +0000
Subject: [lxc-devel] [PATCH 1/2] autodev: switch strategies
In-Reply-To: <20150109193614.GF10330@ubuntumail>
References: <20150109193614.GF10330@ubuntumail>
Message-ID: <20150109202626.GB10641@ubuntumail>

Quoting Serge Hallyn (serge.hallyn at ubuntu.com):
> Do not keep container devs under /dev/.lxc.  Instead, always
> keep them in $lxcpath/$lxcname/rootfs.dev.  Mount a small
> tmpfs there, and bind mount it into $mounted_rootfs/dev .
> 
> The tmpfs is mounted in the container monitor's namespace.  This
> means that at every reboot it will get re-created.  It seems to
> me this better replicates what happens on a real host.
> 
> If we want devices persisting across reboots, then perhaps we can
> implement a $lxcpath/$name/keepdev directory containing devices to
> bind into the container at each startup.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> ---
>  src/lxc/conf.c  | 324 +++++++++-----------------------------------------------
>  src/lxc/start.c |   1 -
>  2 files changed, 51 insertions(+), 274 deletions(-)
> 
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index 72181dd..822f08d 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -94,10 +94,7 @@
>  
>  lxc_log_define(lxc_conf, lxc);
>  
> -#define MAXHWLEN    18
> -#define MAXINDEXLEN 20
> -#define MAXMTULEN   16
> -#define MAXLINELEN  128
> +#define LINELEN 4096
>  
>  #if HAVE_SYS_CAPABILITY_H
>  #ifndef CAP_SETFCAP
> @@ -295,9 +292,6 @@ static struct caps_opt caps_opt[] = {
>  static struct caps_opt caps_opt[] = {};
>  #endif
>  
> -const char *dev_base_path = "/dev/.lxc";
> -const char *dev_user_path = "/dev/.lxc/user";
> -
>  static int run_buffer(char *buffer)
>  {
>  	struct lxc_popen_FILE *f;
> @@ -1092,247 +1086,89 @@ fail:
>  }
>  
>  /*
> - * Check to see if a directory has something mounted on it and,
> - * if it does, return the fstype.
> - *
> - * Code largely based on detect_shared_rootfs below
> - *
> - * Returns: # of matching entries in /proc/self/mounts
> - * 	if != 0 fstype is filled with the last filesystem value.
> - * 	if == 0 no matches found, fstype unchanged.
> - *
> - * ToDo: Maybe return the mount options in another parameter...
> + * Just create a path for /dev under $lxcpath/$name and in rootfs
> + * If we hit an error, log it but don't fail yet.
>   */
> -
> -#define LINELEN 4096
> -#define MAX_FSTYPE_LEN 128
> -static int mount_check_fs( const char *dir, char *fstype )
> +static void create_devdir(const char *path)
>  {
> -	char buf[LINELEN], *p;
> -	struct stat s;
> -	FILE *f;
> -	int found_fs = 0;
> -	char *p2;
> -
> -	DEBUG("entering mount_check_fs for %s", dir);
> -
> -	if ( 0 != access(dir, F_OK) || 0 != stat(dir, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		return 0;
> -	}
> -
> -	f = fopen("/proc/self/mounts", "r");
> -	if (!f)
> -		return 0;
> -	while (fgets(buf, LINELEN, f)) {
> -		p = index(buf, ' ');
> -		if( !p )
> -			continue;
> -		*p = '\0';
> -		p2 = p + 1;
> -
> -		p = index(p2, ' ');
> -		if( !p )
> -			continue;
> -		*p = '\0';
> -
> -		/* Compare the directory in the entry to desired */
> -		if( strcmp( p2, dir ) ) {
> -			continue;
> -		}
> -
> -		p2 = p + 1;
> -		p = index( p2, ' ');
> -		if( !p )
> -			continue;
> -		*p = '\0';
> -
> -		++found_fs;
> -
> -		if( fstype ) {
> -			strncpy( fstype, p2, MAX_FSTYPE_LEN - 1 );
> -			fstype [ MAX_FSTYPE_LEN - 1 ] = '\0';
> -		}
> -	}
> -
> -	fclose(f);
> -
> -	DEBUG("mount_check_fs returning %d last %s", found_fs, fstype);
> -
> -	return found_fs;
> +	int ret = mkdir(path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
> +	if (ret) /* Issue an error but don't fail yet! */
> +		SYSERROR("Unable to create devpath %s", path);
> +	ret = chmod(path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
> +	if (ret)
> +		SYSERROR("Failed to chown devpath %s", path);
> +	INFO("Created %s", path);
>  }
>  
>  /*
> - * Locate a devtmpfs mount (should be on /dev) and create a container
> - * subdirectory on it which we can then bind mount to the container
> - * /dev instead of mounting a tmpfs there.
> + * Create $lxcpath/$name/dev if it does not yet exist.
>   * If we fail, return NULL.
>   * Else return the pointer to the name buffer with the string to
>   * the devtmpfs subdirectory.
>   */
>  
> -static char *mk_devtmpfs(const char *name, char *path, const char *lxcpath)
> +static bool mk_devtmpfs(const char *hostpath, const char *container_path)
>  {
> -	int ret;
> -	struct stat s;
> -	char tmp_path[MAXPATHLEN];
> -	char fstype[MAX_FSTYPE_LEN];
> -	uint64_t hash;
> -
> -	if ( 0 != access(dev_base_path, F_OK) || 0 != stat(dev_base_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		/* This is just making /dev/.lxc it better work or we're done */
> -		ret = mkdir(dev_base_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
> -		if ( ret ) {
> -			SYSERROR( "Unable to create /dev/.lxc for autodev" );
> -			return NULL;
> -		}
> -	}
> -
> -	/*
> -	 * Programmers notes:
> -	 * 	We can not do mounts in this area of code that we want
> -	 * 	to be visible in the host.  Consequently, /dev/.lxc must
> -	 * 	be set up earlier if we need a tmpfs mounted there.
> -	 * 	That only affects the rare cases where autodev is enabled
> -	 * 	for a container and devtmpfs is not mounted on /dev in the
> -	 * 	host.  In that case, we'll fall back to the old method
> -	 * 	of mounting a tmpfs in the container and have no visibility
> -	 * 	into the container /dev.
> -	 */
> -	if( ! mount_check_fs( "/dev", fstype )
> -		|| strcmp( "devtmpfs", fstype ) ) {
> -		/* Either /dev was not mounted or was not devtmpfs */
> -
> -		if ( ! mount_check_fs( "/dev/.lxc", NULL ) ) {
> -			/*
> -			 * /dev/.lxc is not already mounted
> -			 * Doing a mount here does no good, since
> -			 * it's not visible in the host.
> -			 */
> -
> -			ERROR("/dev/.lxc is not setup - taking fallback" );
> -			return NULL;
> -		}
> -	}
> -
> -	if ( 0 != access(dev_user_path, F_OK) || 0 != stat(dev_user_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		/*
> -		 * This is making /dev/.lxc/user path for non-priv users.
> -		 * If this doesn't work, we'll have to fall back in the
> -		 * case of non-priv users.  It's mode 1777 like /tmp.
> -		 */
> -		ret = mkdir(dev_user_path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
> -		if ( ret ) {
> -			/* Issue an error but don't fail yet! */
> -			ERROR("Unable to create /dev/.lxc/user");
> -		}
> -		/* Umask tends to screw us up here */
> -		chmod(dev_user_path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
> -	}
> -
> -	/*
> -	 * Since the container name must be unique within a given
> -	 * lxcpath, we're going to use a hash of the path
> -	 * /lxcpath/name as our hash name in /dev/.lxc/
> -	 */
> -
> -	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s", lxcpath, name);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> -		return NULL;
> -
> -	hash = fnv_64a_buf(tmp_path, ret, FNV1A_64_INIT);
> -
> -	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_base_path, name, hash);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> -		return NULL;
> -
> -	if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		ret = mkdir(tmp_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
> -		if ( ret ) {
> -			/* Something must have failed with the dev_base_path...
> -			 * Maybe unpriv user.  Try dev_user_path now... */
> -			INFO("Setup in /dev/.lxc failed.  Trying /dev/.lxc/user." );
> -
> -			ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_user_path, name, hash);
> -			if (ret < 0 || ret >= MAXPATHLEN)
> -				return NULL;
> -
> -			if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -				ret = mkdir(tmp_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
> -				if ( ret ) {
> -					ERROR("Container /dev setup in host /dev failed - taking fallback" );
> -					return NULL;
> -				}
> -			}
> -		}
> +	if (!dir_exists(hostpath))
> +		create_devdir(hostpath);
> +	if (!dir_exists(container_path))
> +		create_devdir(container_path);
> +	if (0 != mount("none", hostpath, "tmpfs", 0, "size=100000,mode=755")) {
> +		SYSERROR("Failed mounting tmpfs onto %s\n", hostpath);
> +		return false;
>  	}

Ok, actually I'm being a bit silly here.  The $lxcpath/$name/rootfs.dev
directory is not needed.  We can just mount a tmpfs straight onto
$(mounted_rootfs)/dev.  We do still need to do it here (earlier than
fill_autodev) because we want it mounted before other lxc.mount.entry's
happen, as they can include device nodes.

> -
> -	strcpy( path, tmp_path );
> -	return path;
> +	return true;
>  }
>  
> -/*
> - * Do we want to add options for max size of /dev and a file to
> - * specify which devices to create?
> - */
>  static int mount_autodev(const char *name, char *root, const char *lxcpath)
>  {
>  	int ret;
> -	struct stat s;
> -	char path[MAXPATHLEN];
> -	char host_path[MAXPATHLEN];
> -	char devtmpfs_path[MAXPATHLEN];
> +	size_t hlen, clen;
> +	char *path, *host_path;
>  
>  	INFO("Mounting /dev under %s", root);
>  
> -	ret = snprintf(host_path, MAXPATHLEN, "%s/%s/rootfs.dev", lxcpath, name);
> -	if (ret < 0 || ret > MAXPATHLEN)
> +	/* $(lxcpath) + '/' + $(name) + "/rootfs.dev" + '\0' */
> +	hlen = strlen(lxcpath) + strlen(name) + 13;
> +	host_path = alloca(hlen);
> +	/* $(root) + "/dev/pts" + '\0' */
> +	clen = strlen(root) + 9;
> +	path = alloca(clen);
> +	ret = snprintf(host_path, hlen, "%s/%s/rootfs.dev", lxcpath, name);
> +	if (ret < 0 || ret >= hlen)
>  		return -1;
>  
> -	ret = snprintf(path, MAXPATHLEN, "%s/dev", root);
> -	if (ret < 0 || ret > MAXPATHLEN)
> +	ret = snprintf(path, clen, "%s/dev", root);
> +	if (ret < 0 || ret >= clen)
>  		return -1;
>  
> -	if (mk_devtmpfs( name, devtmpfs_path, lxcpath ) ) {
> -		/*
> -		 * Get rid of old links and directoriess
> -		 * This could be either a symlink and we remove it,
> -		 * or an empty directory and we remove it,
> -		 * or non-existent and we don't care,
> -		 * or a non-empty directory, and we will then emit an error
> -		 * but we will not fail out the process.
> -		 */
> -		unlink( host_path );
> -		rmdir( host_path );
> -		ret = symlink(devtmpfs_path, host_path);
> +	/*
> +	 * Create $lxcpath/$name/dev and $(mounted_rootfs/dev), and
> +	 * mount a small tmpfs onto $lxcpath/$name/dev.
> +	 */
> +	if (!mk_devtmpfs(host_path, path))
> +		return -1;
>  
> -		if ( ret < 0 ) {
> -			SYSERROR("WARNING: Failed to create symlink '%s'->'%s'", host_path, devtmpfs_path);
> -		}
> -		DEBUG("Bind mounting %s to %s", devtmpfs_path , path );
> -		ret = mount(devtmpfs_path, path, NULL, MS_BIND, 0 );
> -	} else {
> -		/* Only mount a tmpfs on here if we don't already a mount */
> -		if ( ! mount_check_fs( host_path, NULL ) ) {
> -			DEBUG("Mounting tmpfs to %s", host_path );
> -			ret = mount("none", path, "tmpfs", 0, "size=100000,mode=755");
> -		} else {
> -			/* This allows someone to manually set up a mount */
> -			DEBUG("Bind mounting %s to %s", host_path, path );
> -			ret = mount(host_path , path, NULL, MS_BIND, 0 );
> -		}
> -	}
> +	/*
> +	 * bind mount the tmpfs from $lxcpath/$name/dev onto
> +	 * $(mounted_rootfs)/dev.
> +	 */
> +	ret = mount(host_path, path, 0, MS_BIND, NULL);
>  	if (ret) {
> -		SYSERROR("Failed to mount /dev at %s", root);
> +		SYSERROR("Failed to bind /dev into container at %s", root);
>  		return -1;
>  	}
> -	ret = snprintf(path, MAXPATHLEN, "%s/dev/pts", root);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> +	INFO("Bind-mounted %s -> %s", host_path, path);
> +
> +	ret = snprintf(path, clen, "%s/dev/pts", root);
> +	if (ret < 0 || ret >= clen)
>  		return -1;
> +
>  	/*
>  	 * If we are running on a devtmpfs mapping, dev/pts may already exist.
>  	 * If not, then create it and exit if that fails...
>  	 */
> -	if ( 0 != access(path, F_OK) || 0 != stat(path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> +	if (!dir_exists(path)) {
>  		ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
>  		if (ret) {
>  			SYSERROR("Failed to create /dev/pts in container");
> @@ -1395,64 +1231,6 @@ static int setup_autodev(const char *root)
>  	return 0;
>  }
>  
> -/*
> - * Locate allocated devtmpfs mount and purge it.
> - * path lookup mostly taken from mk_devtmpfs
> - */
> -int lxc_delete_autodev(struct lxc_handler *handler)
> -{
> -	int ret;
> -	struct stat s;
> -	struct lxc_conf *lxc_conf = handler->conf;
> -	const char *name = handler->name;
> -	const char *lxcpath = handler->lxcpath;
> -	char tmp_path[MAXPATHLEN];
> -	uint64_t hash;
> -
> -	if ( lxc_conf->autodev <= 0 )
> -		return 0;
> -
> -	/* don't clean on reboot */
> -	if ( lxc_conf->reboot == 1 )
> -		return 0;
> -
> -	/*
> -	 * Use the same logic as mk_devtmpfs to compute candidate
> -	 * path for cleanup.
> -	 */
> -
> -	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s", lxcpath, name);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> -		return -1;
> -
> -	hash = fnv_64a_buf(tmp_path, ret, FNV1A_64_INIT);
> -
> -	/* Probe /dev/.lxc/<container name>.<hash> */
> -	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_base_path, name, hash);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> -		return -1;
> -
> -	if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		/* Probe /dev/.lxc/user/<container name>.<hash> */
> -		ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_user_path, name, hash);
> -		if (ret < 0 || ret >= MAXPATHLEN)
> -			return -1;
> -
> -		if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -			WARN("Failed to locate autodev /dev/.lxc and /dev/.lxc/user." );
> -			return -1;
> -		}
> -	}
> -
> -	/* Do the cleanup */
> -	INFO("Cleaning %s", tmp_path );
> -	if ( 0 != lxc_rmdir_onedev(tmp_path, NULL) ) {
> -		ERROR("Failed to cleanup autodev" );
> -	}
> -
> -	return 0;
> -}
> -
>  static int setup_rootfs(struct lxc_conf *conf)
>  {
>  	const struct lxc_rootfs *rootfs = &conf->rootfs;
> diff --git a/src/lxc/start.c b/src/lxc/start.c
> index cd78665..98905a3 100644
> --- a/src/lxc/start.c
> +++ b/src/lxc/start.c
> @@ -477,7 +477,6 @@ void lxc_fini(const char *name, struct lxc_handler *handler)
>  
>  	lxc_console_delete(&handler->conf->console);
>  	lxc_delete_tty(&handler->conf->tty_info);
> -	lxc_delete_autodev(handler);
>  	close(handler->conf->maincmd_fd);
>  	handler->conf->maincmd_fd = -1;
>  	free(handler->name);
> -- 
> 2.1.0
> 

From serge.hallyn at ubuntu.com  Fri Jan  9 21:38:18 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 9 Jan 2015 21:38:18 +0000
Subject: [lxc-devel] [PATCH 1/2] autodev: switch strategies (v2)
In-Reply-To: <20150109202626.GB10641@ubuntumail>
References: <20150109193614.GF10330@ubuntumail>
 <20150109202626.GB10641@ubuntumail>
Message-ID: <20150109213817.GC10641@ubuntumail>

Do not keep container devs under /dev/.lxc.  Instead, always
keep them in a small tmpfs mounted at $(mounted_root)/dev.

The tmpfs is mounted in the container monitor's namespace.  This
means that at every reboot it will get re-created.  It seems to
me this better replicates what happens on a real host.

If we want devices persisting across reboots, then perhaps we can
implement a $lxcpath/$name/keepdev directory containing devices to
bind into the container at each startup.

Changelog (v2): don't bother with the $lxcpath/$name/rootfs.dev
	directory, just mount the tmpfs straight into the container.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/conf.c  | 318 ++++++--------------------------------------------------
 src/lxc/start.c |   1 -
 2 files changed, 31 insertions(+), 288 deletions(-)

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 72181dd..dad79ab 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -94,10 +94,7 @@
 
 lxc_log_define(lxc_conf, lxc);
 
-#define MAXHWLEN    18
-#define MAXINDEXLEN 20
-#define MAXMTULEN   16
-#define MAXLINELEN  128
+#define LINELEN 4096
 
 #if HAVE_SYS_CAPABILITY_H
 #ifndef CAP_SETFCAP
@@ -295,9 +292,6 @@ static struct caps_opt caps_opt[] = {
 static struct caps_opt caps_opt[] = {};
 #endif
 
-const char *dev_base_path = "/dev/.lxc";
-const char *dev_user_path = "/dev/.lxc/user";
-
 static int run_buffer(char *buffer)
 {
 	struct lxc_popen_FILE *f;
@@ -1092,247 +1086,55 @@ fail:
 }
 
 /*
- * Check to see if a directory has something mounted on it and,
- * if it does, return the fstype.
- *
- * Code largely based on detect_shared_rootfs below
- *
- * Returns: # of matching entries in /proc/self/mounts
- * 	if != 0 fstype is filled with the last filesystem value.
- * 	if == 0 no matches found, fstype unchanged.
- *
- * ToDo: Maybe return the mount options in another parameter...
+ * Just create a path for /dev under $lxcpath/$name and in rootfs
+ * If we hit an error, log it but don't fail yet.
  */
-
-#define LINELEN 4096
-#define MAX_FSTYPE_LEN 128
-static int mount_check_fs( const char *dir, char *fstype )
+static void create_devdir(const char *path)
 {
-	char buf[LINELEN], *p;
-	struct stat s;
-	FILE *f;
-	int found_fs = 0;
-	char *p2;
-
-	DEBUG("entering mount_check_fs for %s", dir);
-
-	if ( 0 != access(dir, F_OK) || 0 != stat(dir, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		return 0;
-	}
-
-	f = fopen("/proc/self/mounts", "r");
-	if (!f)
-		return 0;
-	while (fgets(buf, LINELEN, f)) {
-		p = index(buf, ' ');
-		if( !p )
-			continue;
-		*p = '\0';
-		p2 = p + 1;
-
-		p = index(p2, ' ');
-		if( !p )
-			continue;
-		*p = '\0';
-
-		/* Compare the directory in the entry to desired */
-		if( strcmp( p2, dir ) ) {
-			continue;
-		}
-
-		p2 = p + 1;
-		p = index( p2, ' ');
-		if( !p )
-			continue;
-		*p = '\0';
-
-		++found_fs;
-
-		if( fstype ) {
-			strncpy( fstype, p2, MAX_FSTYPE_LEN - 1 );
-			fstype [ MAX_FSTYPE_LEN - 1 ] = '\0';
-		}
-	}
-
-	fclose(f);
-
-	DEBUG("mount_check_fs returning %d last %s", found_fs, fstype);
-
-	return found_fs;
-}
-
-/*
- * Locate a devtmpfs mount (should be on /dev) and create a container
- * subdirectory on it which we can then bind mount to the container
- * /dev instead of mounting a tmpfs there.
- * If we fail, return NULL.
- * Else return the pointer to the name buffer with the string to
- * the devtmpfs subdirectory.
- */
-
-static char *mk_devtmpfs(const char *name, char *path, const char *lxcpath)
-{
-	int ret;
-	struct stat s;
-	char tmp_path[MAXPATHLEN];
-	char fstype[MAX_FSTYPE_LEN];
-	uint64_t hash;
-
-	if ( 0 != access(dev_base_path, F_OK) || 0 != stat(dev_base_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		/* This is just making /dev/.lxc it better work or we're done */
-		ret = mkdir(dev_base_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
-		if ( ret ) {
-			SYSERROR( "Unable to create /dev/.lxc for autodev" );
-			return NULL;
-		}
-	}
-
-	/*
-	 * Programmers notes:
-	 * 	We can not do mounts in this area of code that we want
-	 * 	to be visible in the host.  Consequently, /dev/.lxc must
-	 * 	be set up earlier if we need a tmpfs mounted there.
-	 * 	That only affects the rare cases where autodev is enabled
-	 * 	for a container and devtmpfs is not mounted on /dev in the
-	 * 	host.  In that case, we'll fall back to the old method
-	 * 	of mounting a tmpfs in the container and have no visibility
-	 * 	into the container /dev.
-	 */
-	if( ! mount_check_fs( "/dev", fstype )
-		|| strcmp( "devtmpfs", fstype ) ) {
-		/* Either /dev was not mounted or was not devtmpfs */
-
-		if ( ! mount_check_fs( "/dev/.lxc", NULL ) ) {
-			/*
-			 * /dev/.lxc is not already mounted
-			 * Doing a mount here does no good, since
-			 * it's not visible in the host.
-			 */
-
-			ERROR("/dev/.lxc is not setup - taking fallback" );
-			return NULL;
-		}
-	}
-
-	if ( 0 != access(dev_user_path, F_OK) || 0 != stat(dev_user_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		/*
-		 * This is making /dev/.lxc/user path for non-priv users.
-		 * If this doesn't work, we'll have to fall back in the
-		 * case of non-priv users.  It's mode 1777 like /tmp.
-		 */
-		ret = mkdir(dev_user_path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
-		if ( ret ) {
-			/* Issue an error but don't fail yet! */
-			ERROR("Unable to create /dev/.lxc/user");
-		}
-		/* Umask tends to screw us up here */
-		chmod(dev_user_path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
-	}
-
-	/*
-	 * Since the container name must be unique within a given
-	 * lxcpath, we're going to use a hash of the path
-	 * /lxcpath/name as our hash name in /dev/.lxc/
-	 */
-
-	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s", lxcpath, name);
-	if (ret < 0 || ret >= MAXPATHLEN)
-		return NULL;
-
-	hash = fnv_64a_buf(tmp_path, ret, FNV1A_64_INIT);
-
-	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_base_path, name, hash);
-	if (ret < 0 || ret >= MAXPATHLEN)
-		return NULL;
-
-	if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		ret = mkdir(tmp_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
-		if ( ret ) {
-			/* Something must have failed with the dev_base_path...
-			 * Maybe unpriv user.  Try dev_user_path now... */
-			INFO("Setup in /dev/.lxc failed.  Trying /dev/.lxc/user." );
-
-			ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_user_path, name, hash);
-			if (ret < 0 || ret >= MAXPATHLEN)
-				return NULL;
-
-			if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-				ret = mkdir(tmp_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
-				if ( ret ) {
-					ERROR("Container /dev setup in host /dev failed - taking fallback" );
-					return NULL;
-				}
-			}
-		}
-	}
-
-	strcpy( path, tmp_path );
-	return path;
+	int ret = mkdir(path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
+	if (ret) /* Issue an error but don't fail yet! */
+		SYSERROR("Unable to create devpath %s", path);
+	ret = chmod(path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
+	if (ret)
+		SYSERROR("Failed to chown devpath %s", path);
+	INFO("Created %s", path);
 }
 
-/*
- * Do we want to add options for max size of /dev and a file to
- * specify which devices to create?
- */
 static int mount_autodev(const char *name, char *root, const char *lxcpath)
 {
 	int ret;
-	struct stat s;
-	char path[MAXPATHLEN];
-	char host_path[MAXPATHLEN];
-	char devtmpfs_path[MAXPATHLEN];
+	size_t clen;
+	char *path;
 
 	INFO("Mounting /dev under %s", root);
 
-	ret = snprintf(host_path, MAXPATHLEN, "%s/%s/rootfs.dev", lxcpath, name);
-	if (ret < 0 || ret > MAXPATHLEN)
-		return -1;
+	/* $(root) + "/dev/pts" + '\0' */
+	clen = strlen(root) + 9;
+	path = alloca(clen);
 
-	ret = snprintf(path, MAXPATHLEN, "%s/dev", root);
-	if (ret < 0 || ret > MAXPATHLEN)
+	ret = snprintf(path, clen, "%s/dev", root);
+	if (ret < 0 || ret >= clen)
 		return -1;
 
-	if (mk_devtmpfs( name, devtmpfs_path, lxcpath ) ) {
-		/*
-		 * Get rid of old links and directoriess
-		 * This could be either a symlink and we remove it,
-		 * or an empty directory and we remove it,
-		 * or non-existent and we don't care,
-		 * or a non-empty directory, and we will then emit an error
-		 * but we will not fail out the process.
-		 */
-		unlink( host_path );
-		rmdir( host_path );
-		ret = symlink(devtmpfs_path, host_path);
-
-		if ( ret < 0 ) {
-			SYSERROR("WARNING: Failed to create symlink '%s'->'%s'", host_path, devtmpfs_path);
-		}
-		DEBUG("Bind mounting %s to %s", devtmpfs_path , path );
-		ret = mount(devtmpfs_path, path, NULL, MS_BIND, 0 );
-	} else {
-		/* Only mount a tmpfs on here if we don't already a mount */
-		if ( ! mount_check_fs( host_path, NULL ) ) {
-			DEBUG("Mounting tmpfs to %s", host_path );
-			ret = mount("none", path, "tmpfs", 0, "size=100000,mode=755");
-		} else {
-			/* This allows someone to manually set up a mount */
-			DEBUG("Bind mounting %s to %s", host_path, path );
-			ret = mount(host_path , path, NULL, MS_BIND, 0 );
-		}
+	/* Create $(mounted_rootfs/dev), and * mount a small tmpfs onto it */
+	if (!dir_exists(path))
+		create_devdir(path);
+	if (0 != mount("none", path, "tmpfs", 0, "size=100000,mode=755")) {
+		SYSERROR("Failed mounting tmpfs onto %s\n", path);
+		return false;
 	}
-	if (ret) {
-		SYSERROR("Failed to mount /dev at %s", root);
-		return -1;
-	}
-	ret = snprintf(path, MAXPATHLEN, "%s/dev/pts", root);
-	if (ret < 0 || ret >= MAXPATHLEN)
+
+	INFO("Mounted tmpfs onto %s",  path);
+
+	ret = snprintf(path, clen, "%s/dev/pts", root);
+	if (ret < 0 || ret >= clen)
 		return -1;
+
 	/*
 	 * If we are running on a devtmpfs mapping, dev/pts may already exist.
 	 * If not, then create it and exit if that fails...
 	 */
-	if ( 0 != access(path, F_OK) || 0 != stat(path, &s) || 0 == S_ISDIR(s.st_mode) ) {
+	if (!dir_exists(path)) {
 		ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
 		if (ret) {
 			SYSERROR("Failed to create /dev/pts in container");
@@ -1395,64 +1197,6 @@ static int setup_autodev(const char *root)
 	return 0;
 }
 
-/*
- * Locate allocated devtmpfs mount and purge it.
- * path lookup mostly taken from mk_devtmpfs
- */
-int lxc_delete_autodev(struct lxc_handler *handler)
-{
-	int ret;
-	struct stat s;
-	struct lxc_conf *lxc_conf = handler->conf;
-	const char *name = handler->name;
-	const char *lxcpath = handler->lxcpath;
-	char tmp_path[MAXPATHLEN];
-	uint64_t hash;
-
-	if ( lxc_conf->autodev <= 0 )
-		return 0;
-
-	/* don't clean on reboot */
-	if ( lxc_conf->reboot == 1 )
-		return 0;
-
-	/*
-	 * Use the same logic as mk_devtmpfs to compute candidate
-	 * path for cleanup.
-	 */
-
-	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s", lxcpath, name);
-	if (ret < 0 || ret >= MAXPATHLEN)
-		return -1;
-
-	hash = fnv_64a_buf(tmp_path, ret, FNV1A_64_INIT);
-
-	/* Probe /dev/.lxc/<container name>.<hash> */
-	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_base_path, name, hash);
-	if (ret < 0 || ret >= MAXPATHLEN)
-		return -1;
-
-	if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		/* Probe /dev/.lxc/user/<container name>.<hash> */
-		ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_user_path, name, hash);
-		if (ret < 0 || ret >= MAXPATHLEN)
-			return -1;
-
-		if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-			WARN("Failed to locate autodev /dev/.lxc and /dev/.lxc/user." );
-			return -1;
-		}
-	}
-
-	/* Do the cleanup */
-	INFO("Cleaning %s", tmp_path );
-	if ( 0 != lxc_rmdir_onedev(tmp_path, NULL) ) {
-		ERROR("Failed to cleanup autodev" );
-	}
-
-	return 0;
-}
-
 static int setup_rootfs(struct lxc_conf *conf)
 {
 	const struct lxc_rootfs *rootfs = &conf->rootfs;
diff --git a/src/lxc/start.c b/src/lxc/start.c
index cd78665..98905a3 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -477,7 +477,6 @@ void lxc_fini(const char *name, struct lxc_handler *handler)
 
 	lxc_console_delete(&handler->conf->console);
 	lxc_delete_tty(&handler->conf->tty_info);
-	lxc_delete_autodev(handler);
 	close(handler->conf->maincmd_fd);
 	handler->conf->maincmd_fd = -1;
 	free(handler->name);
-- 
2.1.0


From serge.hallyn at ubuntu.com  Fri Jan  9 21:55:39 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 9 Jan 2015 21:55:39 +0000
Subject: [lxc-devel] lxc-start fails
In-Reply-To: <CALRD3qKo82AmzJGN1g5b75MwSb_o9C=Q=oN0oTehMgmYmd56AQ@mail.gmail.com>
References: <CALRD3qJctrW=K4_0Dy20EWGJqW+gCv6GMv2sNL20rRRXOwrz5g@mail.gmail.com>
 <20150109141238.GB9897@ubuntumail>
 <CALRD3qKo82AmzJGN1g5b75MwSb_o9C=Q=oN0oTehMgmYmd56AQ@mail.gmail.com>
Message-ID: <20150109215539.GD10641@ubuntumail>

Hm.  Below are you logged in as root?  Did you start the container
as root?  Can you show "ps -ef | grep lxc" and "id"?

Thanks for verifying the below - I'll post a patch for that soon.

-serge

Quoting riya khanna (riyakhanna1983 at gmail.com):
> Yes, that works. Container starts BUT I get the following message:
> lxc-start: monitor.c: lxc_monitor_open: 213 connect : Connection refused
> 
> 
> # lxc-start --logfile container.log --logpriority info --name
> container -f lxc.conf -- /init
> 
> lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 10
> lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 50
> lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 100
> 
> lxc-start: monitor.c: lxc_monitor_open: 213 connect : Connection refused
> lxc-start: lxc_start.c: main: 345 The container failed to start.
> lxc-start: lxc_start.c: main: 347 To get more details, run the
> container in foreground mode.
> lxc-start: lxc_start.c: main: 349 Additional information can be
> obtained by setting the --logfile and --logpriority options.
> 
> 
> On Fri, Jan 9, 2015 at 8:12 AM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
> > Quoting riya khanna (riyakhanna1983 at gmail.com):
> >> Hi,
> >>
> >> I'm trying to start a container on busy box host.
> >>
> >> lxc-start --logfile container.log --logpriority info --name L -f
> >> lxc.conf -- /init
> >>
> >> container.log shows the following error:
> >> lxc_conf - conf.c:prepare_ramfs_root:1517 - Bad address - Failed to
> >> make . rprivate
> >
> > Hm.  Well that is an odd line.  Does it help if you change line 1517
> > to read
> >
> >         if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
> >
> > ?
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Fri Jan  9 22:00:28 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 9 Jan 2015 22:00:28 +0000
Subject: [lxc-devel] [PATCH 1/1] Fix reversed args in mount call
Message-ID: <20150109220028.GE10641@ubuntumail>

Riya Khanna reported that with a ramfs rootfs the mount to make
/ rprivate was returning -EFAULT.  NULL was being passed as the
mount target.  Pass "/" instead.

Reported-by: riya khanna <riyakhanna1983 at gmail.com>>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/conf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 72181dd..9072002 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -1513,7 +1513,7 @@ int prepare_ramfs_root(char *root)
 		return -1;
 	}
 
-	if (mount(".", NULL, NULL, MS_REC | MS_PRIVATE, NULL)) {
+	if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
 		SYSERROR("Failed to make . rprivate");
 		return -1;
 	}
-- 
2.1.0


From riyakhanna1983 at gmail.com  Sat Jan 10 01:41:29 2015
From: riyakhanna1983 at gmail.com (riya khanna)
Date: Fri, 9 Jan 2015 19:41:29 -0600
Subject: [lxc-devel] lxc-start fails
In-Reply-To: <20150109215539.GD10641@ubuntumail>
References: <CALRD3qJctrW=K4_0Dy20EWGJqW+gCv6GMv2sNL20rRRXOwrz5g@mail.gmail.com>
 <20150109141238.GB9897@ubuntumail>
 <CALRD3qKo82AmzJGN1g5b75MwSb_o9C=Q=oN0oTehMgmYmd56AQ@mail.gmail.com>
 <20150109215539.GD10641@ubuntumail>
Message-ID: <CALRD3qL5U1U8NkRk1C4LsmBWX=PrWj-jrRhPQL23Fw=ZO9KRQg@mail.gmail.com>

Yes. Logged in as root.

# ps -ef | grep lxc
   68 0          0:00 lxc-start -n container -f lxc.conf -d -- /init

# id
uid=0 gid=0

Thanks for the patch.

On Fri, Jan 9, 2015 at 3:55 PM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
> Hm.  Below are you logged in as root?  Did you start the container
> as root?  Can you show "ps -ef | grep lxc" and "id"?
>
> Thanks for verifying the below - I'll post a patch for that soon.
>
> -serge
>
> Quoting riya khanna (riyakhanna1983 at gmail.com):
>> Yes, that works. Container starts BUT I get the following message:
>> lxc-start: monitor.c: lxc_monitor_open: 213 connect : Connection refused
>>
>>
>> # lxc-start --logfile container.log --logpriority info --name
>> container -f lxc.conf -- /init
>>
>> lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 10
>> lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 50
>> lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 100
>>
>> lxc-start: monitor.c: lxc_monitor_open: 213 connect : Connection refused
>> lxc-start: lxc_start.c: main: 345 The container failed to start.
>> lxc-start: lxc_start.c: main: 347 To get more details, run the
>> container in foreground mode.
>> lxc-start: lxc_start.c: main: 349 Additional information can be
>> obtained by setting the --logfile and --logpriority options.
>>
>>
>> On Fri, Jan 9, 2015 at 8:12 AM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
>> > Quoting riya khanna (riyakhanna1983 at gmail.com):
>> >> Hi,
>> >>
>> >> I'm trying to start a container on busy box host.
>> >>
>> >> lxc-start --logfile container.log --logpriority info --name L -f
>> >> lxc.conf -- /init
>> >>
>> >> container.log shows the following error:
>> >> lxc_conf - conf.c:prepare_ramfs_root:1517 - Bad address - Failed to
>> >> make . rprivate
>> >
>> > Hm.  Well that is an odd line.  Does it help if you change line 1517
>> > to read
>> >
>> >         if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
>> >
>> > ?
>> > _______________________________________________
>> > lxc-devel mailing list
>> > lxc-devel at lists.linuxcontainers.org
>> > http://lists.linuxcontainers.org/listinfo/lxc-devel
>> _______________________________________________
>> lxc-devel mailing list
>> lxc-devel at lists.linuxcontainers.org
>> http://lists.linuxcontainers.org/listinfo/lxc-devel
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From riyakhanna1983 at gmail.com  Sat Jan 10 01:49:54 2015
From: riyakhanna1983 at gmail.com (riya khanna)
Date: Fri, 9 Jan 2015 19:49:54 -0600
Subject: [lxc-devel] Session Leader
In-Reply-To: <20150105154839.GC3201@ubuntumail>
References: <CAMgQSMnzpf8_9uwwd4cgE1HxVOF93w2R8HQHeZADWibX5K6V2g@mail.gmail.com>
 <60E9D0C7-864D-43E4-9D42-E950DED4EFC3@gmail.com>
 <CAMgQSM=FF3GuwdB=LLkRjj2Jw_cuOLF_SX_qCGsNKk+uRkgSQQ@mail.gmail.com>
 <20150105154839.GC3201@ubuntumail>
Message-ID: <CALRD3qJ7p3MVA7q8pejGJOMJBNd+qSn45Q0E-E65=00KXz9L7w@mail.gmail.com>

Why is init not a session leader? I faced an issue with using CRIU
because of that. Adding CRIU folks as well.
Error (cr-dump.c:1598): A session leader of 74(1) is outside of its
pid namespace

   68 0          0:00 lxc-start -n container -f lxc.conf -d -- /init
   74 0          0:00 /init


On Mon, Jan 5, 2015 at 9:48 AM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
> lcxapi_start calls setsid but not from the task which will become the
> container init.
>
> Quoting beproject criu (beprojectcriu at gmail.com):
>> Dear LXC Developers,
>> Does anybody have any idea why lxc-start executable does not make init the
>> session leader, whereas lxcapi_start function does call setsid()
>>
>> On Sat, Jan 3, 2015 at 11:55 AM, Ashish Bijlani <ashish.bijlani at gmail.com>
>> wrote:
>>
>> > Could you reply to this email and ask LXC developers to help….if anyone
>> > has any idea on this.
>> >
>> > Ask why lxc-start executable does not make init the session leader,
>> > whereas lxcapi_start function does call setsid()
>> >
>> > On Dec 25, 2014, at 10:19 AM, beproject criu <beprojectcriu at gmail.com>
>> > wrote:
>> >
>> > Dear LXC Developers,
>> >
>> > Why init of spawned container is not a session leader?.
>> > Can i change the session leader of lxc container using hooks,etc?
>> > If yes, how do i do it.
>> >
>> > Thanks.
>> >
>> > _______________________________________________
>> > lxc-devel mailing list
>> > lxc-devel at lists.linuxcontainers.org
>> > http://lists.linuxcontainers.org/listinfo/lxc-devel
>> >
>> >
>> >
>
>> _______________________________________________
>> lxc-devel mailing list
>> lxc-devel at lists.linuxcontainers.org
>> http://lists.linuxcontainers.org/listinfo/lxc-devel
>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From tycho.andersen at canonical.com  Sat Jan 10 03:30:33 2015
From: tycho.andersen at canonical.com (Tycho Andersen)
Date: Fri, 9 Jan 2015 20:30:33 -0700
Subject: [lxc-devel] Session Leader
In-Reply-To: <CALRD3qJ7p3MVA7q8pejGJOMJBNd+qSn45Q0E-E65=00KXz9L7w@mail.gmail.com>
References: <CAMgQSMnzpf8_9uwwd4cgE1HxVOF93w2R8HQHeZADWibX5K6V2g@mail.gmail.com>
 <60E9D0C7-864D-43E4-9D42-E950DED4EFC3@gmail.com>
 <CAMgQSM=FF3GuwdB=LLkRjj2Jw_cuOLF_SX_qCGsNKk+uRkgSQQ@mail.gmail.com>
 <20150105154839.GC3201@ubuntumail>
 <CALRD3qJ7p3MVA7q8pejGJOMJBNd+qSn45Q0E-E65=00KXz9L7w@mail.gmail.com>
Message-ID: <20150110033033.GA17438@hopstrocity>

On Fri, Jan 09, 2015 at 07:49:54PM -0600, riya khanna wrote:
> Why is init not a session leader? I faced an issue with using CRIU
> because of that. Adding CRIU folks as well.

How did you call CRIU to do the dump?

Tycho

> Error (cr-dump.c:1598): A session leader of 74(1) is outside of its
> pid namespace
> 
>    68 0          0:00 lxc-start -n container -f lxc.conf -d -- /init
>    74 0          0:00 /init
> 
> 
> On Mon, Jan 5, 2015 at 9:48 AM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
> > lcxapi_start calls setsid but not from the task which will become the
> > container init.
> >
> > Quoting beproject criu (beprojectcriu at gmail.com):
> >> Dear LXC Developers,
> >> Does anybody have any idea why lxc-start executable does not make init the
> >> session leader, whereas lxcapi_start function does call setsid()
> >>
> >> On Sat, Jan 3, 2015 at 11:55 AM, Ashish Bijlani <ashish.bijlani at gmail.com>
> >> wrote:
> >>
> >> > Could you reply to this email and ask LXC developers to help….if anyone
> >> > has any idea on this.
> >> >
> >> > Ask why lxc-start executable does not make init the session leader,
> >> > whereas lxcapi_start function does call setsid()
> >> >
> >> > On Dec 25, 2014, at 10:19 AM, beproject criu <beprojectcriu at gmail.com>
> >> > wrote:
> >> >
> >> > Dear LXC Developers,
> >> >
> >> > Why init of spawned container is not a session leader?.
> >> > Can i change the session leader of lxc container using hooks,etc?
> >> > If yes, how do i do it.
> >> >
> >> > Thanks.
> >> >
> >> > _______________________________________________
> >> > lxc-devel mailing list
> >> > lxc-devel at lists.linuxcontainers.org
> >> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> >> >
> >> >
> >> >
> >
> >> _______________________________________________
> >> lxc-devel mailing list
> >> lxc-devel at lists.linuxcontainers.org
> >> http://lists.linuxcontainers.org/listinfo/lxc-devel
> >
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Sat Jan 10 03:36:47 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Sat, 10 Jan 2015 03:36:47 +0000
Subject: [lxc-devel] lxc-start fails
In-Reply-To: <CALRD3qL5U1U8NkRk1C4LsmBWX=PrWj-jrRhPQL23Fw=ZO9KRQg@mail.gmail.com>
References: <CALRD3qJctrW=K4_0Dy20EWGJqW+gCv6GMv2sNL20rRRXOwrz5g@mail.gmail.com>
 <20150109141238.GB9897@ubuntumail>
 <CALRD3qKo82AmzJGN1g5b75MwSb_o9C=Q=oN0oTehMgmYmd56AQ@mail.gmail.com>
 <20150109215539.GD10641@ubuntumail>
 <CALRD3qL5U1U8NkRk1C4LsmBWX=PrWj-jrRhPQL23Fw=ZO9KRQg@mail.gmail.com>
Message-ID: <20150110033647.GI10641@ubuntumail>

Heh, I hesitate to say this because it's usually the butt of a joke,

but could you try rebooting and then starting the container?  Start it with
the -l info -o container.log options and show us the resulting container.log
file.

Quoting riya khanna (riyakhanna1983 at gmail.com):
> Yes. Logged in as root.
> 
> # ps -ef | grep lxc
>    68 0          0:00 lxc-start -n container -f lxc.conf -d -- /init
> 
> # id
> uid=0 gid=0
> 
> Thanks for the patch.
> 
> On Fri, Jan 9, 2015 at 3:55 PM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
> > Hm.  Below are you logged in as root?  Did you start the container
> > as root?  Can you show "ps -ef | grep lxc" and "id"?
> >
> > Thanks for verifying the below - I'll post a patch for that soon.
> >
> > -serge
> >
> > Quoting riya khanna (riyakhanna1983 at gmail.com):
> >> Yes, that works. Container starts BUT I get the following message:
> >> lxc-start: monitor.c: lxc_monitor_open: 213 connect : Connection refused
> >>
> >>
> >> # lxc-start --logfile container.log --logpriority info --name
> >> container -f lxc.conf -- /init
> >>
> >> lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 10
> >> lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 50
> >> lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 100
> >>
> >> lxc-start: monitor.c: lxc_monitor_open: 213 connect : Connection refused
> >> lxc-start: lxc_start.c: main: 345 The container failed to start.
> >> lxc-start: lxc_start.c: main: 347 To get more details, run the
> >> container in foreground mode.
> >> lxc-start: lxc_start.c: main: 349 Additional information can be
> >> obtained by setting the --logfile and --logpriority options.
> >>
> >>
> >> On Fri, Jan 9, 2015 at 8:12 AM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
> >> > Quoting riya khanna (riyakhanna1983 at gmail.com):
> >> >> Hi,
> >> >>
> >> >> I'm trying to start a container on busy box host.
> >> >>
> >> >> lxc-start --logfile container.log --logpriority info --name L -f
> >> >> lxc.conf -- /init
> >> >>
> >> >> container.log shows the following error:
> >> >> lxc_conf - conf.c:prepare_ramfs_root:1517 - Bad address - Failed to
> >> >> make . rprivate
> >> >
> >> > Hm.  Well that is an odd line.  Does it help if you change line 1517
> >> > to read
> >> >
> >> >         if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
> >> >
> >> > ?
> >> > _______________________________________________
> >> > lxc-devel mailing list
> >> > lxc-devel at lists.linuxcontainers.org
> >> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> >> _______________________________________________
> >> lxc-devel mailing list
> >> lxc-devel at lists.linuxcontainers.org
> >> http://lists.linuxcontainers.org/listinfo/lxc-devel
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From riyakhanna1983 at gmail.com  Sat Jan 10 03:50:23 2015
From: riyakhanna1983 at gmail.com (riya khanna)
Date: Fri, 9 Jan 2015 21:50:23 -0600
Subject: [lxc-devel] lxc-start fails
In-Reply-To: <20150110033647.GI10641@ubuntumail>
References: <CALRD3qJctrW=K4_0Dy20EWGJqW+gCv6GMv2sNL20rRRXOwrz5g@mail.gmail.com>
 <20150109141238.GB9897@ubuntumail>
 <CALRD3qKo82AmzJGN1g5b75MwSb_o9C=Q=oN0oTehMgmYmd56AQ@mail.gmail.com>
 <20150109215539.GD10641@ubuntumail>
 <CALRD3qL5U1U8NkRk1C4LsmBWX=PrWj-jrRhPQL23Fw=ZO9KRQg@mail.gmail.com>
 <20150110033647.GI10641@ubuntumail>
Message-ID: <CALRD3qKULutVq-G2R1LKDQ5XT_9jPfjK7toiRDLj6qv7-2GuFw@mail.gmail.com>

Sorry about that. container.log below:

      lxc-start 1420861068.870 WARN     lxc_log -
log.c:lxc_log_init:316 - lxc_log_init called with log already
initialized
      lxc-start 1420861068.879 WARN     lxc_cgfs -
cgfs.c:lxc_cgroup_get_container_info:1100 - Not attaching to cgroup
cpuset unknown to /usr/local/var/lib/lxc container
      lxc-start 1420861068.889 INFO     lxc_start -
start.c:lxc_check_inherited:209 - closed inherited fd 4
      lxc-start 1420861068.905 INFO     lxc_start -
start.c:lxc_check_inherited:209 - closed inherited fd 4
      lxc-start 1420861068.911 INFO     lxc_lsm -
lsm/lsm.c:lsm_init:48 - LSM security driver nop
      lxc-start 1420861068.912 INFO     lxc_monitor -
monitor.c:lxc_monitor_sock_name:177 - using monitor sock name
lxc/69d2cd1be5952f52//usr/local/var/lib/lxc
      lxc-start 1420861068.913 ERROR    lxc_monitor -
monitor.c:lxc_monitor_open:208 - connect : backing off 10
      lxc-start 1420861068.918 DEBUG    lxc_start -
start.c:setup_signal_fd:247 - sigchild handler set
      lxc-start 1420861068.923 DEBUG    lxc_console -
console.c:lxc_console_peer_default:536 - no console peer
      lxc-start 1420861068.923 INFO     lxc_start -
start.c:lxc_init:443 - 'container' is initialized
      lxc-start 1420861068.926 DEBUG    lxc_start -
start.c:__lxc_start:1061 - Not dropping cap_sys_boot or watching utmp
      lxc-start 1420861068.927 INFO     lxc_cgroup -
cgroup.c:cgroup_init:65 - cgroup driver cgroupfs initing for container
      lxc-start 1420861068.932 ERROR    lxc_monitor -
monitor.c:lxc_monitor_open:208 - connect : backing off 50
      lxc-start 1420861068.947 DEBUG    lxc_cgfs -
cgfs.c:do_setup_cgroup_limits:1913 - cgroup 'devices.allow' set to 'a
# allow all first'
      lxc-start 1420861068.947 INFO     lxc_cgfs -
cgfs.c:do_setup_cgroup_limits:1917 - cgroup has been setup
      lxc-start 1420861068.959 DEBUG    lxc_conf -
conf.c:setup_rootfs:1478 - mounted '/home/riya/rootfs' on
'/usr/local/lib/lxc/rootfs'
      lxc-start 1420861068.959 INFO     lxc_conf -
conf.c:setup_utsname:900 - 'container' hostname has been setup
      lxc-start 1420861068.960 DEBUG    lxc_conf -
conf.c:check_autodev:3784 - Set exec command to /init
      lxc-start 1420861068.964 DEBUG    lxc_conf -
conf.c:mount_entry:1974 - mounted 'none' on
'/usr/local/lib/lxc/rootfs//proc', type 'proc'
      lxc-start 1420861068.965 DEBUG    lxc_conf -
conf.c:mount_entry:1974 - mounted 'none' on
'/usr/local/lib/lxc/rootfs//sys', type 'sysfs'
      lxc-start 1420861068.965 DEBUG    lxc_conf -
conf.c:mount_entry:1924 - remounting /dev on
/usr/local/lib/lxc/rootfs//dev to respect bind or remount options
      lxc-start 1420861068.965 DEBUG    lxc_conf -
conf.c:mount_entry:1939 - (at remount) flags for /dev was 0, required
extra flags are 0
      lxc-start 1420861068.965 DEBUG    lxc_conf -
conf.c:mount_entry:1948 - mountflags already was 4096, skipping
remount
      lxc-start 1420861068.965 DEBUG    lxc_conf -
conf.c:mount_entry:1974 - mounted '/dev' on
'/usr/local/lib/lxc/rootfs//dev', type 'none'
      lxc-start 1420861068.965 INFO     lxc_conf -
conf.c:mount_file_entries:2223 - mount points have been setup

      lxc-start 1420861068.992 ERROR    lxc_monitor -
monitor.c:lxc_monitor_open:208 - connect : backing off 100
      lxc-start 1420861069.103 ERROR    lxc_monitor -
monitor.c:lxc_monitor_open:213 - connect : Connection refused

      lxc-start 1420861069.104 ERROR    lxc_start_ui -
lxc_start.c:main:345 - The container failed to start.
      lxc-start 1420861069.104 ERROR    lxc_start_ui -
lxc_start.c:main:347 - To get more details, run the container in
foreground mode.
      lxc-start 1420861069.104 ERROR    lxc_start_ui -
lxc_start.c:main:349 - Additional information can be obtained by
setting the --logfile and --logpriority options.

On Fri, Jan 9, 2015 at 9:36 PM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
> Heh, I hesitate to say this because it's usually the butt of a joke,
>
> but could you try rebooting and then starting the container?  Start it with
> the -l info -o container.log options and show us the resulting container.log
> file.
>
> Quoting riya khanna (riyakhanna1983 at gmail.com):
>> Yes. Logged in as root.
>>
>> # ps -ef | grep lxc
>>    68 0          0:00 lxc-start -n container -f lxc.conf -d -- /init
>>
>> # id
>> uid=0 gid=0
>>
>> Thanks for the patch.
>>
>> On Fri, Jan 9, 2015 at 3:55 PM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
>> > Hm.  Below are you logged in as root?  Did you start the container
>> > as root?  Can you show "ps -ef | grep lxc" and "id"?
>> >
>> > Thanks for verifying the below - I'll post a patch for that soon.
>> >
>> > -serge
>> >
>> > Quoting riya khanna (riyakhanna1983 at gmail.com):
>> >> Yes, that works. Container starts BUT I get the following message:
>> >> lxc-start: monitor.c: lxc_monitor_open: 213 connect : Connection refused
>> >>
>> >>
>> >> # lxc-start --logfile container.log --logpriority info --name
>> >> container -f lxc.conf -- /init
>> >>
>> >> lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 10
>> >> lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 50
>> >> lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 100
>> >>
>> >> lxc-start: monitor.c: lxc_monitor_open: 213 connect : Connection refused
>> >> lxc-start: lxc_start.c: main: 345 The container failed to start.
>> >> lxc-start: lxc_start.c: main: 347 To get more details, run the
>> >> container in foreground mode.
>> >> lxc-start: lxc_start.c: main: 349 Additional information can be
>> >> obtained by setting the --logfile and --logpriority options.
>> >>
>> >>
>> >> On Fri, Jan 9, 2015 at 8:12 AM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
>> >> > Quoting riya khanna (riyakhanna1983 at gmail.com):
>> >> >> Hi,
>> >> >>
>> >> >> I'm trying to start a container on busy box host.
>> >> >>
>> >> >> lxc-start --logfile container.log --logpriority info --name L -f
>> >> >> lxc.conf -- /init
>> >> >>
>> >> >> container.log shows the following error:
>> >> >> lxc_conf - conf.c:prepare_ramfs_root:1517 - Bad address - Failed to
>> >> >> make . rprivate
>> >> >
>> >> > Hm.  Well that is an odd line.  Does it help if you change line 1517
>> >> > to read
>> >> >
>> >> >         if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
>> >> >
>> >> > ?
>> >> > _______________________________________________
>> >> > lxc-devel mailing list
>> >> > lxc-devel at lists.linuxcontainers.org
>> >> > http://lists.linuxcontainers.org/listinfo/lxc-devel
>> >> _______________________________________________
>> >> lxc-devel mailing list
>> >> lxc-devel at lists.linuxcontainers.org
>> >> http://lists.linuxcontainers.org/listinfo/lxc-devel
>> > _______________________________________________
>> > lxc-devel mailing list
>> > lxc-devel at lists.linuxcontainers.org
>> > http://lists.linuxcontainers.org/listinfo/lxc-devel
>> _______________________________________________
>> lxc-devel mailing list
>> lxc-devel at lists.linuxcontainers.org
>> http://lists.linuxcontainers.org/listinfo/lxc-devel
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From riyakhanna1983 at gmail.com  Sat Jan 10 03:51:11 2015
From: riyakhanna1983 at gmail.com (riya khanna)
Date: Fri, 9 Jan 2015 21:51:11 -0600
Subject: [lxc-devel] Session Leader
In-Reply-To: <20150110033033.GA17438@hopstrocity>
References: <CAMgQSMnzpf8_9uwwd4cgE1HxVOF93w2R8HQHeZADWibX5K6V2g@mail.gmail.com>
 <60E9D0C7-864D-43E4-9D42-E950DED4EFC3@gmail.com>
 <CAMgQSM=FF3GuwdB=LLkRjj2Jw_cuOLF_SX_qCGsNKk+uRkgSQQ@mail.gmail.com>
 <20150105154839.GC3201@ubuntumail>
 <CALRD3qJ7p3MVA7q8pejGJOMJBNd+qSn45Q0E-E65=00KXz9L7w@mail.gmail.com>
 <20150110033033.GA17438@hopstrocity>
Message-ID: <CALRD3q+2V=QLc1LZo3QmTCDSKkXQpptqF2maZMMayEPmR1Ap4Q@mail.gmail.com>

criu dump --root /usr/local/lib/lxc/rootfs/root --evasive-devices \
--tcp-established --ext-mount-map /dev:dev --file-locks -n net -n mnt \
-n ipc -n pid -vvv -D data -o dump.log -t 74

I don't have dump.log for that run, but if you want I can rerun and
send you dump.log as well.

On Fri, Jan 9, 2015 at 9:30 PM, Tycho Andersen
<tycho.andersen at canonical.com> wrote:
> On Fri, Jan 09, 2015 at 07:49:54PM -0600, riya khanna wrote:
>> Why is init not a session leader? I faced an issue with using CRIU
>> because of that. Adding CRIU folks as well.
>
> How did you call CRIU to do the dump?
>
> Tycho
>
>> Error (cr-dump.c:1598): A session leader of 74(1) is outside of its
>> pid namespace
>>
>>    68 0          0:00 lxc-start -n container -f lxc.conf -d -- /init
>>    74 0          0:00 /init
>>
>>
>> On Mon, Jan 5, 2015 at 9:48 AM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
>> > lcxapi_start calls setsid but not from the task which will become the
>> > container init.
>> >
>> > Quoting beproject criu (beprojectcriu at gmail.com):
>> >> Dear LXC Developers,
>> >> Does anybody have any idea why lxc-start executable does not make init the
>> >> session leader, whereas lxcapi_start function does call setsid()
>> >>
>> >> On Sat, Jan 3, 2015 at 11:55 AM, Ashish Bijlani <ashish.bijlani at gmail.com>
>> >> wrote:
>> >>
>> >> > Could you reply to this email and ask LXC developers to help….if anyone
>> >> > has any idea on this.
>> >> >
>> >> > Ask why lxc-start executable does not make init the session leader,
>> >> > whereas lxcapi_start function does call setsid()
>> >> >
>> >> > On Dec 25, 2014, at 10:19 AM, beproject criu <beprojectcriu at gmail.com>
>> >> > wrote:
>> >> >
>> >> > Dear LXC Developers,
>> >> >
>> >> > Why init of spawned container is not a session leader?.
>> >> > Can i change the session leader of lxc container using hooks,etc?
>> >> > If yes, how do i do it.
>> >> >
>> >> > Thanks.
>> >> >
>> >> > _______________________________________________
>> >> > lxc-devel mailing list
>> >> > lxc-devel at lists.linuxcontainers.org
>> >> > http://lists.linuxcontainers.org/listinfo/lxc-devel
>> >> >
>> >> >
>> >> >
>> >
>> >> _______________________________________________
>> >> lxc-devel mailing list
>> >> lxc-devel at lists.linuxcontainers.org
>> >> http://lists.linuxcontainers.org/listinfo/lxc-devel
>> >
>> > _______________________________________________
>> > lxc-devel mailing list
>> > lxc-devel at lists.linuxcontainers.org
>> > http://lists.linuxcontainers.org/listinfo/lxc-devel
>> _______________________________________________
>> lxc-devel mailing list
>> lxc-devel at lists.linuxcontainers.org
>> http://lists.linuxcontainers.org/listinfo/lxc-devel
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Sat Jan 10 04:05:05 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Sat, 10 Jan 2015 04:05:05 +0000
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150108101652.GL2958@obnox.de>
References: <20150108100516.GK2958@obnox.de> <20150108101652.GL2958@obnox.de>
Message-ID: <20150110040505.GJ10641@ubuntumail>

Hi,

thanks.

the trivial ones look almost all correct to me - the only worry I have
is about adding -p to the help output.  -p is not meant to be used by
users, only by lxc-create in calling the templates.  It looks like you
only added that to the ubuntu template (so that's the only part of those
that I object to).  Actually a patch to remove '-p|--path' from the
help statement in all other templates would be appreciated.

The less controversial one is adding mask-tmp to the fedora template.
It looks fine to me, but that should go separately to mwarfield, our
fedora template maintainer :)

-serge

Quoting Michael Adam (obnox at samba.org):
> For those who prefer it, the patches can also be
> fetched via git from branch master of
> https://github.com/obnoxxx/lxc.git
> 
> Cheers - Michael
> 
> On 2015-01-08 at 11:05 +0100, Michael Adam wrote:
> > 
> > Hi,
> > 
> > below find the output of "git format-patch --stdout "
> > of a series of trivial patches to fix some minor issues
> > in the template scripts.
> > 
> > The final patch adds a new parameter to the fedora
> > template: "--mask-tmp". This is what I actually only
> > wanted to do, but I found some issues in the parsing of
> > options and help text, fixed them while at it and
> > was careless enough to check several other templates
> > for similar flaws.
> > 
> > The reason for the --mask-tmp is to be able to prevent
> > systemd from over-mounting /tmp with tmpfs in the container.
> > My current use-case is that I want to be able to use
> > vagrant-cachier with vagrant-lxc.
> > 
> > Thanks for review / comments / push, ...
> > 
> > Cheers - Michael



> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From serge.hallyn at ubuntu.com  Sat Jan 10 04:13:47 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Sat, 10 Jan 2015 04:13:47 +0000
Subject: [lxc-devel] lxc-start fails
In-Reply-To: <CALRD3qKULutVq-G2R1LKDQ5XT_9jPfjK7toiRDLj6qv7-2GuFw@mail.gmail.com>
References: <CALRD3qJctrW=K4_0Dy20EWGJqW+gCv6GMv2sNL20rRRXOwrz5g@mail.gmail.com>
 <20150109141238.GB9897@ubuntumail>
 <CALRD3qKo82AmzJGN1g5b75MwSb_o9C=Q=oN0oTehMgmYmd56AQ@mail.gmail.com>
 <20150109215539.GD10641@ubuntumail>
 <CALRD3qL5U1U8NkRk1C4LsmBWX=PrWj-jrRhPQL23Fw=ZO9KRQg@mail.gmail.com>
 <20150110033647.GI10641@ubuntumail>
 <CALRD3qKULutVq-G2R1LKDQ5XT_9jPfjK7toiRDLj6qv7-2GuFw@mail.gmail.com>
Message-ID: <20150110041347.GK10641@ubuntumail>

>       lxc-start 1420861068.913 ERROR    lxc_monitor -
> monitor.c:lxc_monitor_open:208 - connect : backing off 10

Please tell us more about your system.  Busybox based.  What sort of kernel,
and what sort of security features built in?  What does 'netstat -xp | grep lxc'
show?  If it lists a process, what does /proc/$pid/status and /proc/$pid/attr/current
show for both its pid, and your shell ($$) ?

From obnox at samba.org  Sat Jan 10 12:08:37 2015
From: obnox at samba.org (Michael Adam)
Date: Sat, 10 Jan 2015 13:08:37 +0100
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150110040505.GJ10641@ubuntumail>
References: <20150108100516.GK2958@obnox.de> <20150108101652.GL2958@obnox.de>
 <20150110040505.GJ10641@ubuntumail>
Message-ID: <20150110120836.GA8528@obnox.de>

Hi Serge,

Thanks for your comments.

On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
> Hi,
> 
> thanks.
> 
> the trivial ones look almost all correct to me - the only worry I have
> is about adding -p to the help output.  -p is not meant to be used by
> users, only by lxc-create in calling the templates.  It looks like you
> only added that to the ubuntu template (so that's the only part of those
> that I object to).

Not quite: Added to ubuntu and debian templates, because it was
not documented there, and fixed the printed paths in archlinux,
centos and fedora.

It also seems that templates for fedora, centos and friends treat
the path parameter differently than debian and ubuntu in that
they do provide a default. Debian and ubuntu templates don't
and fail if --path is not specified.

> Actually a patch to remove '-p|--path' from the
> help statement in all other templates would be appreciated.

Ok, so the reasoning is that the template script should only
be called from lxc-create and that lxc-create adds the --path
parameter to the call, correct?

> The less controversial one is adding mask-tmp to the fedora template.
> It looks fine to me, but that should go separately to mwarfield, our
> fedora template maintainer :)

I had notified mhw of my patches on irc, but apparently he is
currently very busy.

For a start, following is an update of the uncontroversial fix
patches, i.e. the fix patche without the path ones, and without
the mask-tmp patch.

Cheers - Michael


From d7c0574f6deae345ddaa58e9cd3d85018d1a6908 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 09:32:39 +0100
Subject: [PATCH 01/16] lxc-debian: fix parsing of option "--clean": it takes
 no argument.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-debian.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index a9a1652..603894f 100644
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
@@ -475,7 +475,7 @@ do
            --)                shift 1; break ;;
 
         -a|--arch)            arch=$2; shift 2;;
-        -c|--clean)           clean=$2; shift 1;;
+        -c|--clean)           clean=1; shift 1;;
            --mirror)          MIRROR=$2; shift 2;;
         -n|--name)            name=$2; shift 2;;
            --packages)        packages=$2; shift 2;;
-- 
2.1.0


From 31347d5bd8f405f42e17d375de85b92c72963a65 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 09:38:48 +0100
Subject: [PATCH 02/16] lxc-debian: document "--clean" in the usage.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-debian.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index 603894f..d1e4edd 100644
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
@@ -438,6 +438,7 @@ usage()
 {
     cat <<EOF
 $1 -h|--help -p|--path=<path> [-a|--arch] [-c|--clean] [--mirror=<mirror>] [-r|--release=<release>] [--security-mirror=<security mirror>]
+clean: purge the download cache after installation
 arch: the container architecture (e.g. amd64): defaults to host arch
 release: the debian release (e.g. wheezy): defaults to current stable
 mirror: debain mirror to use during installation
-- 
2.1.0


From 48f3faa90ee6e599281ca7e09fa6386961db9067 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 09:58:09 +0100
Subject: [PATCH 03/16] lxc-debian: protect possibly unset variable with quotes
 for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-debian.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index d1e4edd..65093f3 100644
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
@@ -573,7 +573,7 @@ configure_debian_systemd $path $rootfs
 
 post_process ${rootfs} ${release} ${arch} ${hostarch} ${packages}
 
-if [ ! -z $clean ]; then
+if [ ! -z "$clean" ]; then
     clean || exit 1
     exit 0
 fi
-- 
2.1.0


From 4be2378d34aa89b39a04d3379d340212499e0075 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:34:49 +0100
Subject: [PATCH 04/16] lxc-opensuse: fix tab/whitespace mixup in usage text.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-opensuse.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
index f727250..89971da 100644
--- a/templates/lxc-opensuse.in
+++ b/templates/lxc-opensuse.in
@@ -403,7 +403,7 @@ do
         -p|--path)      path=$2; shift 2;;
         --rootfs)       rootfs=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
-	-r|--release)   DISTRO=$2; shift 2;;
+        -r|--release)   DISTRO=$2; shift 2;;
         -c|--clean)     clean=$2; shift 2;;
         --)             shift 1; break ;;
         *)              break ;;
-- 
2.1.0


From 9523398ff4a28b3c819c8cd26108807ce64c9330 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:35:20 +0100
Subject: [PATCH 05/16] lxc-opensuse: fix parsing of option "--clean": it takes
 no argument

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-opensuse.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
index 89971da..20ffdbd 100644
--- a/templates/lxc-opensuse.in
+++ b/templates/lxc-opensuse.in
@@ -404,7 +404,7 @@ do
         --rootfs)       rootfs=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
         -r|--release)   DISTRO=$2; shift 2;;
-        -c|--clean)     clean=$2; shift 2;;
+        -c|--clean)     clean=1; shift 1;;
         --)             shift 1; break ;;
         *)              break ;;
     esac
-- 
2.1.0


From 1c847d4c71c79a6bcade46f9743fdb9006fe79bc Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:36:06 +0100
Subject: [PATCH 06/16] lxc-opensuse: protect possibly unset variable with
 quotes in -z check

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-opensuse.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
index 20ffdbd..bb015c8 100644
--- a/templates/lxc-opensuse.in
+++ b/templates/lxc-opensuse.in
@@ -489,7 +489,7 @@ if [ $? -ne 0 ]; then
     exit 1
 fi
 
-if [ ! -z $clean ]; then
+if [ ! -z "$clean" ]; then
     clean || exit 1
     exit 0
 fi
-- 
2.1.0


From e91db6d594ff522a8915477797138daa26d201a9 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:43:12 +0100
Subject: [PATCH 07/16] lxc-altlinux: fix parsing of option "--clean": it takes
 no argument

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-altlinux.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-altlinux.in b/templates/lxc-altlinux.in
index 1c5084e..9e78125 100644
--- a/templates/lxc-altlinux.in
+++ b/templates/lxc-altlinux.in
@@ -398,7 +398,7 @@ do
         --rootfs)       rootfs_path=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
         -P|--profile)   profile=$2; shift 2;;
-        -c|--clean)     clean=$2; shift 2;;
+        -c|--clean)     clean=1; shift 1;;
         -R|--release)   release=$2; shift 2;;
         -4|--ipv4)      ipv4=$2; shift 2;;
         -6|--ipv6)      ipv6=$2; shift 2;;
-- 
2.1.0


From 932ec3418d5b3a2c8f8713fd6f86946671e74598 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:43:52 +0100
Subject: [PATCH 08/16] lxc-altlinux: protect possibly unset variable with
 quotes for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-altlinux.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-altlinux.in b/templates/lxc-altlinux.in
index 9e78125..ac4527b 100644
--- a/templates/lxc-altlinux.in
+++ b/templates/lxc-altlinux.in
@@ -478,7 +478,7 @@ if [ $? -ne 0 ]; then
     exit 1
 fi
 
-if [ ! -z $clean ]; then
+if [ ! -z "$clean" ]; then
     clean || exit 1
     exit 0
 fi
-- 
2.1.0


From ff67ced9bfb6965f8372138fa9f0ffe300d2fbc3 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:48:40 +0100
Subject: [PATCH 09/16] lxc-openmandriva: fix parsing of option "--clean": it
 takes no argument

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-openmandriva.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-openmandriva.in b/templates/lxc-openmandriva.in
index 45e2efa..4656177 100644
--- a/templates/lxc-openmandriva.in
+++ b/templates/lxc-openmandriva.in
@@ -377,7 +377,7 @@ do
         --rootfs)       rootfs_path=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
         -P|--profile)   profile=$2; shift 2;;
-        -c|--clean)     clean=$2; shift 2;;
+        -c|--clean)     clean=1; shift 1;;
         -R|--release)   release=$2; shift 2;;
         -A|--arch)      arch=$2; shift 2;;
         -4|--ipv4)      ipv4=$2; shift 2;;
-- 
2.1.0


From 890cb7e0c19da78d8ed5758ea0cce10b790bda39 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:49:19 +0100
Subject: [PATCH 10/16] lxc-openmandriva: protect possibly unset variable with
 quotes in -z check

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-openmandriva.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-openmandriva.in b/templates/lxc-openmandriva.in
index 4656177..be8023e 100644
--- a/templates/lxc-openmandriva.in
+++ b/templates/lxc-openmandriva.in
@@ -483,7 +483,7 @@ if [ $? -ne 0 ]; then
     exit 1
 fi
 
-if [ ! -z $clean ]; then
+if [ ! -z "$clean" ]; then
     clean || exit 1
     exit 0
 fi
-- 
2.1.0


From 07ce7a2617686de304addbacdec1ae417eb63433 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:03:05 +0100
Subject: [PATCH 11/16] lxc-centos: fix parsing of option "--clean": it takes
 no argument

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-centos.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
index ee88178..ee34289 100644
--- a/templates/lxc-centos.in
+++ b/templates/lxc-centos.in
@@ -697,7 +697,7 @@ do
         -p|--path)      path=$2; shift 2;;
         --rootfs)       rootfs=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
-        -c|--clean)     clean=$2; shift 2;;
+        -c|--clean)     clean=1; shift 1;;
         -R|--release)   release=$2; shift 2;;
 	--repo)		repo="$2"; shift 2;;
         -a|--arch)      newarch=$2; shift 2;;
-- 
2.1.0


From 778477c7a67043c747f20c08a7d9fa0c8fcef43d Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:03:31 +0100
Subject: [PATCH 12/16] lxc-centos: fix tab/space mixup in help text.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-centos.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
index ee34289..6610a1b 100644
--- a/templates/lxc-centos.in
+++ b/templates/lxc-centos.in
@@ -699,7 +699,7 @@ do
         -n|--name)      name=$2; shift 2;;
         -c|--clean)     clean=1; shift 1;;
         -R|--release)   release=$2; shift 2;;
-	--repo)		repo="$2"; shift 2;;
+        --repo)         repo="$2"; shift 2;;
         -a|--arch)      newarch=$2; shift 2;;
         --fqdn)         utsname=$2; shift 2;;
         --)             shift 1; break ;;
-- 
2.1.0


From a0a754c78e2b34edd23826c6674501f5b166ffd8 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:03:53 +0100
Subject: [PATCH 13/16] lxc-centos: protect possibly unset variable with quotes
 for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-centos.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
index 6610a1b..c7d2b89 100644
--- a/templates/lxc-centos.in
+++ b/templates/lxc-centos.in
@@ -887,7 +887,7 @@ fi
 
 configure_centos_init
 
-if [ ! -z $clean ]; then
+if [ ! -z "$clean" ]; then
     clean || exit 1
     exit 0
 fi
-- 
2.1.0


From fbb71f821c9269f2f36119e1b5c526b800e8ffa2 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:00:06 +0100
Subject: [PATCH 14/16] lxc-fedora: fix parsing of option "--clean": it takes
 no argument

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-fedora.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index adfaab2..7789a02 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -1215,7 +1215,7 @@ do
         -p|--path)      path=$2; shift 2;;
         --rootfs)       rootfs=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
-        -c|--clean)     clean=$2; shift 2;;
+        -c|--clean)     clean=1; shift 1;;
         -R|--release)   release=$2; shift 2;;
         -a|--arch)      newarch=$2; shift 2;;
         --fqdn)         utsname=$2; shift 2;;
-- 
2.1.0


From 017310aff1f45d6467ab1f88a0696eba9cf0004a Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:01:18 +0100
Subject: [PATCH 15/16] lxc-fedora: protect possibly unset variable with quotes
 for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-fedora.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index 7789a02..8d8b0b7 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -1415,7 +1415,7 @@ then
     configure_fedora_init
 fi
 
-if [ ! -z $clean ]; then
+if [ ! -z "$clean" ]; then
     clean || exit 1
     exit 0
 fi
-- 
2.1.0


From 854bee3acf6d9bdbe23de4b77fe606d9777df9ef Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:22:18 +0100
Subject: [PATCH 16/16] lxc-fedora: let help text fit into 80 columns

by breaking and shortening some lines.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-fedora.in | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index 8d8b0b7..210f2e7 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -1184,15 +1184,18 @@ usage()
     cat <<EOF
 usage:
     $1 -n|--name=<container_name>
-        [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>] [--fqdn=<network name of container>] [-a|--arch=<arch of the container>]
+        [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>]
+        [--fqdn=<network name of container>] [-a|--arch=<arch of the container>]
         [-h|--help]
 Mandatory args:
-  -n,--name         container name, used to as an identifier for that container from now on
+  -n,--name         container name, used to as an identifier for that container
 Optional args:
-  -p,--path         path to where the container will be created, defaults to @LXCPATH at . The container config will go under @LXCPATH@ in that case
+  -p,--path         path to where the container will be created,
+                    defaults to @LXCPATH at .
   --rootfs          path for actual rootfs.
   -c,--clean        clean the cache
-  -R,--release      Fedora release for the new container. if the host is Fedora, then it will default to the host's release.
+  -R,--release      Fedora release for the new container.
+                    Defaults to host's release if the host is Fedora.
      --fqdn         fully qualified domain name (FQDN) for DNS and system naming
   -a,--arch         Define what arch the container will be [i686,x86_64]
   -h,--help         print this help
-- 
2.1.0



-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150110/7d80d439/attachment.sig>

From obnox at samba.org  Sat Jan 10 12:12:06 2015
From: obnox at samba.org (Michael Adam)
Date: Sat, 10 Jan 2015 13:12:06 +0100
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150110120836.GA8528@obnox.de>
References: <20150108100516.GK2958@obnox.de> <20150108101652.GL2958@obnox.de>
 <20150110040505.GJ10641@ubuntumail>
 <20150110120836.GA8528@obnox.de>
Message-ID: <20150110121206.GB8528@obnox.de>

On 2015-01-10 at 13:08 +0100, Michael Adam wrote:
> On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
> 
> > The less controversial one is adding mask-tmp to the fedora template.
> > It looks fine to me, but that should go separately to mwarfield, our
> > fedora template maintainer :)
> 
> I had notified mhw of my patches on irc, but apparently he is
> currently very busy.
> 
> For a start, following is an update of the uncontroversial fix
> patches, i.e. the fix patche without the path ones, and without
> the mask-tmp patch.

And here comes the mask-tmp patch.
It needs to be applied onto the previous fix-patchset.


From 9589dca113535ed2f4faad89db2fab33bb8a9d7e Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:25:24 +0100
Subject: [PATCH] lxc-fedora: add a new option --mask-tmp

This will configure the container to prevent the standard
behaviour of over-mounting /tmp with tmpfs, which can be
undesirable in some cases.

My personal use case is vagrant-lxc in combination with
vagrant-cachier.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-fedora.in | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index 210f2e7..49e14eb 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -372,6 +372,12 @@ configure_fedora_systemd()
     chroot ${rootfs_path} ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
     # Make systemd honor SIGPWR
     chroot ${rootfs_path} ln -s /usr/lib/systemd/system/halt.target /etc/systemd/system/sigpwr.target
+
+    # if desired, prevent systemd from over-mounting /tmp with tmpfs
+    if [ $masktmp -eq 1 ]; then
+        chroot ${rootfs_path} ln -s /dev/null /etc/systemd/system/tmp.mount
+    fi
+
     #dependency on a device unit fails it specially that we disabled udev
     # sed -i 's/After=dev-%i.device/After=/' ${rootfs_path}/lib/systemd/system/getty\@.service
     #
@@ -1186,6 +1192,7 @@ usage:
     $1 -n|--name=<container_name>
         [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>]
         [--fqdn=<network name of container>] [-a|--arch=<arch of the container>]
+        [--mask-tmp]
         [-h|--help]
 Mandatory args:
   -n,--name         container name, used to as an identifier for that container
@@ -1198,18 +1205,21 @@ Optional args:
                     Defaults to host's release if the host is Fedora.
      --fqdn         fully qualified domain name (FQDN) for DNS and system naming
   -a,--arch         Define what arch the container will be [i686,x86_64]
+  --mask-tmp        Prevent systemd from over-mounting /tmp with tmpfs.
   -h,--help         print this help
 EOF
     return 0
 }
 
-options=$(getopt -o a:hp:n:cR: -l help,path:,rootfs:,name:,clean,release:,arch:,fqdn: -- "$@")
+options=$(getopt -o a:hp:n:cR: -l help,path:,rootfs:,name:,clean,release:,arch:,fqdn:,mask-tmp -- "$@")
 if [ $? -ne 0 ]; then
     usage $(basename $0)
     exit 1
 fi
 
 arch=$(uname -m)
+masktmp=0
+
 eval set -- "$options"
 while true
 do
@@ -1222,6 +1232,7 @@ do
         -R|--release)   release=$2; shift 2;;
         -a|--arch)      newarch=$2; shift 2;;
         --fqdn)         utsname=$2; shift 2;;
+        --mask-tmp)     masktmp=1; shift 1;;
         --)             shift 1; break ;;
         *)              break ;;
     esac
-- 
2.1.0


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150110/3b8f7ab0/attachment.sig>

From obnox at samba.org  Sat Jan 10 12:18:36 2015
From: obnox at samba.org (Michael Adam)
Date: Sat, 10 Jan 2015 13:18:36 +0100
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150110040505.GJ10641@ubuntumail>
References: <20150108100516.GK2958@obnox.de> <20150108101652.GL2958@obnox.de>
 <20150110040505.GJ10641@ubuntumail>
Message-ID: <20150110121836.GC8528@obnox.de>

On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
> 
> Actually a patch to remove '-p|--path' from the
> help statement in all other templates would be appreciated.

Ok, I was just about to send such an add-on patchset,
but first one more thought:

Doesn't the same apply to the -n|--name parameter?

And what about the --rootfs switch that some
of the templates (like archlinux) take?

Cheers - Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150110/96d2e35a/attachment.sig>

From serge.hallyn at ubuntu.com  Sat Jan 10 15:59:18 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Sat, 10 Jan 2015 15:59:18 +0000
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150110121836.GC8528@obnox.de>
References: <20150108100516.GK2958@obnox.de> <20150108101652.GL2958@obnox.de>
 <20150110040505.GJ10641@ubuntumail>
 <20150110121836.GC8528@obnox.de>
Message-ID: <20150110155918.GL10641@ubuntumail>

Quoting Michael Adam (obnox at samba.org):
> On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
> > 
> > Actually a patch to remove '-p|--path' from the
> > help statement in all other templates would be appreciated.
> 
> Ok, I was just about to send such an add-on patchset,
> but first one more thought:
> 
> Doesn't the same apply to the -n|--name parameter?
> 
> And what about the --rootfs switch that some
> of the templates (like archlinux) take?

Yup, good point, I think it does.

From serge.hallyn at ubuntu.com  Sat Jan 10 16:00:44 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Sat, 10 Jan 2015 16:00:44 +0000
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150110121206.GB8528@obnox.de>
References: <20150108100516.GK2958@obnox.de> <20150108101652.GL2958@obnox.de>
 <20150110040505.GJ10641@ubuntumail>
 <20150110120836.GA8528@obnox.de> <20150110121206.GB8528@obnox.de>
Message-ID: <20150110160044.GM10641@ubuntumail>

Quoting Michael Adam (obnox at samba.org):
> On 2015-01-10 at 13:08 +0100, Michael Adam wrote:
> > On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
> > 
> > > The less controversial one is adding mask-tmp to the fedora template.
> > > It looks fine to me, but that should go separately to mwarfield, our
> > > fedora template maintainer :)
> > 
> > I had notified mhw of my patches on irc, but apparently he is
> > currently very busy.
> > 
> > For a start, following is an update of the uncontroversial fix
> > patches, i.e. the fix patche without the path ones, and without
> > the mask-tmp patch.
> 
> And here comes the mask-tmp patch.
> It needs to be applied onto the previous fix-patchset.
> 
> 
> From 9589dca113535ed2f4faad89db2fab33bb8a9d7e Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:25:24 +0100
> Subject: [PATCH] lxc-fedora: add a new option --mask-tmp
> 
> This will configure the container to prevent the standard
> behaviour of over-mounting /tmp with tmpfs, which can be
> undesirable in some cases.
> 
> My personal use case is vagrant-lxc in combination with
> vagrant-cachier.
> 
> Signed-off-by: Michael Adam <obnox at samba.org>

Looks good to me, thanks.  Let's give Michael a bit of time to object, but

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  templates/lxc-fedora.in | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
> index 210f2e7..49e14eb 100644
> --- a/templates/lxc-fedora.in
> +++ b/templates/lxc-fedora.in
> @@ -372,6 +372,12 @@ configure_fedora_systemd()
>      chroot ${rootfs_path} ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
>      # Make systemd honor SIGPWR
>      chroot ${rootfs_path} ln -s /usr/lib/systemd/system/halt.target /etc/systemd/system/sigpwr.target
> +
> +    # if desired, prevent systemd from over-mounting /tmp with tmpfs
> +    if [ $masktmp -eq 1 ]; then
> +        chroot ${rootfs_path} ln -s /dev/null /etc/systemd/system/tmp.mount
> +    fi
> +
>      #dependency on a device unit fails it specially that we disabled udev
>      # sed -i 's/After=dev-%i.device/After=/' ${rootfs_path}/lib/systemd/system/getty\@.service
>      #
> @@ -1186,6 +1192,7 @@ usage:
>      $1 -n|--name=<container_name>
>          [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>]
>          [--fqdn=<network name of container>] [-a|--arch=<arch of the container>]
> +        [--mask-tmp]
>          [-h|--help]
>  Mandatory args:
>    -n,--name         container name, used to as an identifier for that container
> @@ -1198,18 +1205,21 @@ Optional args:
>                      Defaults to host's release if the host is Fedora.
>       --fqdn         fully qualified domain name (FQDN) for DNS and system naming
>    -a,--arch         Define what arch the container will be [i686,x86_64]
> +  --mask-tmp        Prevent systemd from over-mounting /tmp with tmpfs.
>    -h,--help         print this help
>  EOF
>      return 0
>  }
>  
> -options=$(getopt -o a:hp:n:cR: -l help,path:,rootfs:,name:,clean,release:,arch:,fqdn: -- "$@")
> +options=$(getopt -o a:hp:n:cR: -l help,path:,rootfs:,name:,clean,release:,arch:,fqdn:,mask-tmp -- "$@")
>  if [ $? -ne 0 ]; then
>      usage $(basename $0)
>      exit 1
>  fi
>  
>  arch=$(uname -m)
> +masktmp=0
> +
>  eval set -- "$options"
>  while true
>  do
> @@ -1222,6 +1232,7 @@ do
>          -R|--release)   release=$2; shift 2;;
>          -a|--arch)      newarch=$2; shift 2;;
>          --fqdn)         utsname=$2; shift 2;;
> +        --mask-tmp)     masktmp=1; shift 1;;
>          --)             shift 1; break ;;
>          *)              break ;;
>      esac
> -- 
> 2.1.0
> 
> 



> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From noreply at github.com  Sat Jan 10 16:08:34 2015
From: noreply at github.com (GitHub)
Date: Sat, 10 Jan 2015 08:08:34 -0800
Subject: [lxc-devel] [lxc/lxc] e4d4da: lxc-debian: fix parsing of option
 "--clean": it ta...
Message-ID: <54b14e8244e4f_2dfa3f9a5d3e92c05442f@hookshot-fe5-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: e4d4da621109307eb065ce3578fb1e0753157b74
      https://github.com/lxc/lxc/commit/e4d4da621109307eb065ce3578fb1e0753157b74
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-debian.in

  Log Message:
  -----------
  lxc-debian: fix parsing of option "--clean": it takes no argument.

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: a64da4c358976823cf7dbd9b35b6c4e65e776d32
      https://github.com/lxc/lxc/commit/a64da4c358976823cf7dbd9b35b6c4e65e776d32
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-debian.in

  Log Message:
  -----------
  lxc-debian: document "--clean" in the usage.

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 227c560065b22f84e4e41724486863c31b77ac01
      https://github.com/lxc/lxc/commit/227c560065b22f84e4e41724486863c31b77ac01
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-debian.in

  Log Message:
  -----------
  lxc-debian: protect possibly unset variable with quotes for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 1111674232c2e93ddc2c165f3d43df8fe050ac82
      https://github.com/lxc/lxc/commit/1111674232c2e93ddc2c165f3d43df8fe050ac82
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-opensuse.in

  Log Message:
  -----------
  lxc-opensuse: fix tab/whitespace mixup in usage text.

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: eb4cd29636a136c867c43937670a1c6295cb18b0
      https://github.com/lxc/lxc/commit/eb4cd29636a136c867c43937670a1c6295cb18b0
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-opensuse.in

  Log Message:
  -----------
  lxc-opensuse: fix parsing of option "--clean": it takes no argument

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: b5a285ea8fde10254f3b6d1743cec372a2d01605
      https://github.com/lxc/lxc/commit/b5a285ea8fde10254f3b6d1743cec372a2d01605
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-opensuse.in

  Log Message:
  -----------
  lxc-opensuse: protect possibly unset variable with quotes in -z check

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 217535de29d88d64ed3b8c7093e23d954b9545ca
      https://github.com/lxc/lxc/commit/217535de29d88d64ed3b8c7093e23d954b9545ca
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-altlinux.in

  Log Message:
  -----------
  lxc-altlinux: fix parsing of option "--clean": it takes no argument

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 4986f1c435636a69193ac90452b10075122d9005
      https://github.com/lxc/lxc/commit/4986f1c435636a69193ac90452b10075122d9005
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-altlinux.in

  Log Message:
  -----------
  lxc-altlinux: protect possibly unset variable with quotes for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: fe9d4df40a978c643285e15dd99a2187a1bcfec9
      https://github.com/lxc/lxc/commit/fe9d4df40a978c643285e15dd99a2187a1bcfec9
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-openmandriva.in

  Log Message:
  -----------
  lxc-openmandriva: fix parsing of option "--clean": it takes no argument

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: c4834f3c12f6a34224a494787a7f3cd4c2147e9d
      https://github.com/lxc/lxc/commit/c4834f3c12f6a34224a494787a7f3cd4c2147e9d
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-openmandriva.in

  Log Message:
  -----------
  lxc-openmandriva: protect possibly unset variable with quotes in -z check

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 6976826fed04d006608f87ba902a8517358c15ec
      https://github.com/lxc/lxc/commit/6976826fed04d006608f87ba902a8517358c15ec
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-centos.in

  Log Message:
  -----------
  lxc-centos: fix parsing of option "--clean": it takes no argument

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 2ae8252a4f046a8839a70da6a2271e20e8216b99
      https://github.com/lxc/lxc/commit/2ae8252a4f046a8839a70da6a2271e20e8216b99
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-centos.in

  Log Message:
  -----------
  lxc-centos: fix tab/space mixup in help text.

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: a2780518da9102cda2d261bd866237710559d348
      https://github.com/lxc/lxc/commit/a2780518da9102cda2d261bd866237710559d348
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-centos.in

  Log Message:
  -----------
  lxc-centos: protect possibly unset variable with quotes for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 98d316e29af90f1b2084fc3c8c4c4e0316b894c5
      https://github.com/lxc/lxc/commit/98d316e29af90f1b2084fc3c8c4c4e0316b894c5
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-fedora.in

  Log Message:
  -----------
  lxc-fedora: fix parsing of option "--clean": it takes no argument

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 9aed78fad15fe35c53d1a6af8147fca7018e147f
      https://github.com/lxc/lxc/commit/9aed78fad15fe35c53d1a6af8147fca7018e147f
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-fedora.in

  Log Message:
  -----------
  lxc-fedora: protect possibly unset variable with quotes for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: fccc348be453c3991db351f336dbe9da8e861e97
      https://github.com/lxc/lxc/commit/fccc348be453c3991db351f336dbe9da8e861e97
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-10 (Sat, 10 Jan 2015)

  Changed paths:
    M templates/lxc-fedora.in

  Log Message:
  -----------
  lxc-fedora: let help text fit into 80 columns

by breaking and shortening some lines.

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/bb2afd6038b6...fccc348be453

From serge.hallyn at ubuntu.com  Sat Jan 10 16:09:41 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Sat, 10 Jan 2015 16:09:41 +0000
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150110120836.GA8528@obnox.de>
References: <20150108100516.GK2958@obnox.de> <20150108101652.GL2958@obnox.de>
 <20150110040505.GJ10641@ubuntumail>
 <20150110120836.GA8528@obnox.de>
Message-ID: <20150110160941.GN10641@ubuntumail>

Quoting Michael Adam (obnox at samba.org):
> Hi Serge,
> 
> Thanks for your comments.
> 
> On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
> > Hi,
> > 
> > thanks.
> > 
> > the trivial ones look almost all correct to me - the only worry I have
> > is about adding -p to the help output.  -p is not meant to be used by
> > users, only by lxc-create in calling the templates.  It looks like you
> > only added that to the ubuntu template (so that's the only part of those
> > that I object to).
> 
> Not quite: Added to ubuntu and debian templates, because it was
> not documented there, and fixed the printed paths in archlinux,
> centos and fedora.
> 
> It also seems that templates for fedora, centos and friends treat
> the path parameter differently than debian and ubuntu in that
> they do provide a default. Debian and ubuntu templates don't
> and fail if --path is not specified.
> 
> > Actually a patch to remove '-p|--path' from the
> > help statement in all other templates would be appreciated.
> 
> Ok, so the reasoning is that the template script should only
> be called from lxc-create and that lxc-create adds the --path
> parameter to the call, correct?

Yeah...  Of course there may be people who do run the templates
by hand.  But we've lost time with bug reports that turned out
to be people passing --path to lxc-create and getting unexpected
results...

I suppose we could detect whether running under lxc-create (maybe
look at whether stdin is a tty or just have lxc-create pass a
'--noninteractive' argument), and have templates print out the other help only
if interactive?

> > The less controversial one is adding mask-tmp to the fedora template.
> > It looks fine to me, but that should go separately to mwarfield, our
> > fedora template maintainer :)
> 
> I had notified mhw of my patches on irc, but apparently he is
> currently very busy.
> 
> For a start, following is an update of the uncontroversial fix
> patches, i.e. the fix patche without the path ones, and without
> the mask-tmp patch.
> 
> Cheers - Michael

Looks good, all of them

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> From d7c0574f6deae345ddaa58e9cd3d85018d1a6908 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 09:32:39 +0100
> Subject: [PATCH 01/16] lxc-debian: fix parsing of option "--clean": it takes
>  no argument.
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-debian.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
> index a9a1652..603894f 100644
> --- a/templates/lxc-debian.in
> +++ b/templates/lxc-debian.in
> @@ -475,7 +475,7 @@ do
>             --)                shift 1; break ;;
>  
>          -a|--arch)            arch=$2; shift 2;;
> -        -c|--clean)           clean=$2; shift 1;;
> +        -c|--clean)           clean=1; shift 1;;
>             --mirror)          MIRROR=$2; shift 2;;
>          -n|--name)            name=$2; shift 2;;
>             --packages)        packages=$2; shift 2;;
> -- 
> 2.1.0
> 
> 
> From 31347d5bd8f405f42e17d375de85b92c72963a65 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 09:38:48 +0100
> Subject: [PATCH 02/16] lxc-debian: document "--clean" in the usage.
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-debian.in | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
> index 603894f..d1e4edd 100644
> --- a/templates/lxc-debian.in
> +++ b/templates/lxc-debian.in
> @@ -438,6 +438,7 @@ usage()
>  {
>      cat <<EOF
>  $1 -h|--help -p|--path=<path> [-a|--arch] [-c|--clean] [--mirror=<mirror>] [-r|--release=<release>] [--security-mirror=<security mirror>]
> +clean: purge the download cache after installation
>  arch: the container architecture (e.g. amd64): defaults to host arch
>  release: the debian release (e.g. wheezy): defaults to current stable
>  mirror: debain mirror to use during installation
> -- 
> 2.1.0
> 
> 
> From 48f3faa90ee6e599281ca7e09fa6386961db9067 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 09:58:09 +0100
> Subject: [PATCH 03/16] lxc-debian: protect possibly unset variable with quotes
>  for -z check
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-debian.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
> index d1e4edd..65093f3 100644
> --- a/templates/lxc-debian.in
> +++ b/templates/lxc-debian.in
> @@ -573,7 +573,7 @@ configure_debian_systemd $path $rootfs
>  
>  post_process ${rootfs} ${release} ${arch} ${hostarch} ${packages}
>  
> -if [ ! -z $clean ]; then
> +if [ ! -z "$clean" ]; then
>      clean || exit 1
>      exit 0
>  fi
> -- 
> 2.1.0
> 
> 
> From 4be2378d34aa89b39a04d3379d340212499e0075 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:34:49 +0100
> Subject: [PATCH 04/16] lxc-opensuse: fix tab/whitespace mixup in usage text.
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-opensuse.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
> index f727250..89971da 100644
> --- a/templates/lxc-opensuse.in
> +++ b/templates/lxc-opensuse.in
> @@ -403,7 +403,7 @@ do
>          -p|--path)      path=$2; shift 2;;
>          --rootfs)       rootfs=$2; shift 2;;
>          -n|--name)      name=$2; shift 2;;
> -	-r|--release)   DISTRO=$2; shift 2;;
> +        -r|--release)   DISTRO=$2; shift 2;;
>          -c|--clean)     clean=$2; shift 2;;
>          --)             shift 1; break ;;
>          *)              break ;;
> -- 
> 2.1.0
> 
> 
> From 9523398ff4a28b3c819c8cd26108807ce64c9330 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:35:20 +0100
> Subject: [PATCH 05/16] lxc-opensuse: fix parsing of option "--clean": it takes
>  no argument
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-opensuse.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
> index 89971da..20ffdbd 100644
> --- a/templates/lxc-opensuse.in
> +++ b/templates/lxc-opensuse.in
> @@ -404,7 +404,7 @@ do
>          --rootfs)       rootfs=$2; shift 2;;
>          -n|--name)      name=$2; shift 2;;
>          -r|--release)   DISTRO=$2; shift 2;;
> -        -c|--clean)     clean=$2; shift 2;;
> +        -c|--clean)     clean=1; shift 1;;
>          --)             shift 1; break ;;
>          *)              break ;;
>      esac
> -- 
> 2.1.0
> 
> 
> From 1c847d4c71c79a6bcade46f9743fdb9006fe79bc Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:36:06 +0100
> Subject: [PATCH 06/16] lxc-opensuse: protect possibly unset variable with
>  quotes in -z check
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-opensuse.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
> index 20ffdbd..bb015c8 100644
> --- a/templates/lxc-opensuse.in
> +++ b/templates/lxc-opensuse.in
> @@ -489,7 +489,7 @@ if [ $? -ne 0 ]; then
>      exit 1
>  fi
>  
> -if [ ! -z $clean ]; then
> +if [ ! -z "$clean" ]; then
>      clean || exit 1
>      exit 0
>  fi
> -- 
> 2.1.0
> 
> 
> From e91db6d594ff522a8915477797138daa26d201a9 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:43:12 +0100
> Subject: [PATCH 07/16] lxc-altlinux: fix parsing of option "--clean": it takes
>  no argument
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-altlinux.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-altlinux.in b/templates/lxc-altlinux.in
> index 1c5084e..9e78125 100644
> --- a/templates/lxc-altlinux.in
> +++ b/templates/lxc-altlinux.in
> @@ -398,7 +398,7 @@ do
>          --rootfs)       rootfs_path=$2; shift 2;;
>          -n|--name)      name=$2; shift 2;;
>          -P|--profile)   profile=$2; shift 2;;
> -        -c|--clean)     clean=$2; shift 2;;
> +        -c|--clean)     clean=1; shift 1;;
>          -R|--release)   release=$2; shift 2;;
>          -4|--ipv4)      ipv4=$2; shift 2;;
>          -6|--ipv6)      ipv6=$2; shift 2;;
> -- 
> 2.1.0
> 
> 
> From 932ec3418d5b3a2c8f8713fd6f86946671e74598 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:43:52 +0100
> Subject: [PATCH 08/16] lxc-altlinux: protect possibly unset variable with
>  quotes for -z check
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-altlinux.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-altlinux.in b/templates/lxc-altlinux.in
> index 9e78125..ac4527b 100644
> --- a/templates/lxc-altlinux.in
> +++ b/templates/lxc-altlinux.in
> @@ -478,7 +478,7 @@ if [ $? -ne 0 ]; then
>      exit 1
>  fi
>  
> -if [ ! -z $clean ]; then
> +if [ ! -z "$clean" ]; then
>      clean || exit 1
>      exit 0
>  fi
> -- 
> 2.1.0
> 
> 
> From ff67ced9bfb6965f8372138fa9f0ffe300d2fbc3 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:48:40 +0100
> Subject: [PATCH 09/16] lxc-openmandriva: fix parsing of option "--clean": it
>  takes no argument
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-openmandriva.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-openmandriva.in b/templates/lxc-openmandriva.in
> index 45e2efa..4656177 100644
> --- a/templates/lxc-openmandriva.in
> +++ b/templates/lxc-openmandriva.in
> @@ -377,7 +377,7 @@ do
>          --rootfs)       rootfs_path=$2; shift 2;;
>          -n|--name)      name=$2; shift 2;;
>          -P|--profile)   profile=$2; shift 2;;
> -        -c|--clean)     clean=$2; shift 2;;
> +        -c|--clean)     clean=1; shift 1;;
>          -R|--release)   release=$2; shift 2;;
>          -A|--arch)      arch=$2; shift 2;;
>          -4|--ipv4)      ipv4=$2; shift 2;;
> -- 
> 2.1.0
> 
> 
> From 890cb7e0c19da78d8ed5758ea0cce10b790bda39 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:49:19 +0100
> Subject: [PATCH 10/16] lxc-openmandriva: protect possibly unset variable with
>  quotes in -z check
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-openmandriva.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-openmandriva.in b/templates/lxc-openmandriva.in
> index 4656177..be8023e 100644
> --- a/templates/lxc-openmandriva.in
> +++ b/templates/lxc-openmandriva.in
> @@ -483,7 +483,7 @@ if [ $? -ne 0 ]; then
>      exit 1
>  fi
>  
> -if [ ! -z $clean ]; then
> +if [ ! -z "$clean" ]; then
>      clean || exit 1
>      exit 0
>  fi
> -- 
> 2.1.0
> 
> 
> From 07ce7a2617686de304addbacdec1ae417eb63433 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:03:05 +0100
> Subject: [PATCH 11/16] lxc-centos: fix parsing of option "--clean": it takes
>  no argument
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-centos.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
> index ee88178..ee34289 100644
> --- a/templates/lxc-centos.in
> +++ b/templates/lxc-centos.in
> @@ -697,7 +697,7 @@ do
>          -p|--path)      path=$2; shift 2;;
>          --rootfs)       rootfs=$2; shift 2;;
>          -n|--name)      name=$2; shift 2;;
> -        -c|--clean)     clean=$2; shift 2;;
> +        -c|--clean)     clean=1; shift 1;;
>          -R|--release)   release=$2; shift 2;;
>  	--repo)		repo="$2"; shift 2;;
>          -a|--arch)      newarch=$2; shift 2;;
> -- 
> 2.1.0
> 
> 
> From 778477c7a67043c747f20c08a7d9fa0c8fcef43d Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:03:31 +0100
> Subject: [PATCH 12/16] lxc-centos: fix tab/space mixup in help text.
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-centos.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
> index ee34289..6610a1b 100644
> --- a/templates/lxc-centos.in
> +++ b/templates/lxc-centos.in
> @@ -699,7 +699,7 @@ do
>          -n|--name)      name=$2; shift 2;;
>          -c|--clean)     clean=1; shift 1;;
>          -R|--release)   release=$2; shift 2;;
> -	--repo)		repo="$2"; shift 2;;
> +        --repo)         repo="$2"; shift 2;;
>          -a|--arch)      newarch=$2; shift 2;;
>          --fqdn)         utsname=$2; shift 2;;
>          --)             shift 1; break ;;
> -- 
> 2.1.0
> 
> 
> From a0a754c78e2b34edd23826c6674501f5b166ffd8 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:03:53 +0100
> Subject: [PATCH 13/16] lxc-centos: protect possibly unset variable with quotes
>  for -z check
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-centos.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
> index 6610a1b..c7d2b89 100644
> --- a/templates/lxc-centos.in
> +++ b/templates/lxc-centos.in
> @@ -887,7 +887,7 @@ fi
>  
>  configure_centos_init
>  
> -if [ ! -z $clean ]; then
> +if [ ! -z "$clean" ]; then
>      clean || exit 1
>      exit 0
>  fi
> -- 
> 2.1.0
> 
> 
> From fbb71f821c9269f2f36119e1b5c526b800e8ffa2 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:00:06 +0100
> Subject: [PATCH 14/16] lxc-fedora: fix parsing of option "--clean": it takes
>  no argument
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-fedora.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
> index adfaab2..7789a02 100644
> --- a/templates/lxc-fedora.in
> +++ b/templates/lxc-fedora.in
> @@ -1215,7 +1215,7 @@ do
>          -p|--path)      path=$2; shift 2;;
>          --rootfs)       rootfs=$2; shift 2;;
>          -n|--name)      name=$2; shift 2;;
> -        -c|--clean)     clean=$2; shift 2;;
> +        -c|--clean)     clean=1; shift 1;;
>          -R|--release)   release=$2; shift 2;;
>          -a|--arch)      newarch=$2; shift 2;;
>          --fqdn)         utsname=$2; shift 2;;
> -- 
> 2.1.0
> 
> 
> From 017310aff1f45d6467ab1f88a0696eba9cf0004a Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:01:18 +0100
> Subject: [PATCH 15/16] lxc-fedora: protect possibly unset variable with quotes
>  for -z check
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-fedora.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
> index 7789a02..8d8b0b7 100644
> --- a/templates/lxc-fedora.in
> +++ b/templates/lxc-fedora.in
> @@ -1415,7 +1415,7 @@ then
>      configure_fedora_init
>  fi
>  
> -if [ ! -z $clean ]; then
> +if [ ! -z "$clean" ]; then
>      clean || exit 1
>      exit 0
>  fi
> -- 
> 2.1.0
> 
> 
> From 854bee3acf6d9bdbe23de4b77fe606d9777df9ef Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:22:18 +0100
> Subject: [PATCH 16/16] lxc-fedora: let help text fit into 80 columns
> 
> by breaking and shortening some lines.
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-fedora.in | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
> index 8d8b0b7..210f2e7 100644
> --- a/templates/lxc-fedora.in
> +++ b/templates/lxc-fedora.in
> @@ -1184,15 +1184,18 @@ usage()
>      cat <<EOF
>  usage:
>      $1 -n|--name=<container_name>
> -        [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>] [--fqdn=<network name of container>] [-a|--arch=<arch of the container>]
> +        [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>]
> +        [--fqdn=<network name of container>] [-a|--arch=<arch of the container>]
>          [-h|--help]
>  Mandatory args:
> -  -n,--name         container name, used to as an identifier for that container from now on
> +  -n,--name         container name, used to as an identifier for that container
>  Optional args:
> -  -p,--path         path to where the container will be created, defaults to @LXCPATH at . The container config will go under @LXCPATH@ in that case
> +  -p,--path         path to where the container will be created,
> +                    defaults to @LXCPATH at .
>    --rootfs          path for actual rootfs.
>    -c,--clean        clean the cache
> -  -R,--release      Fedora release for the new container. if the host is Fedora, then it will default to the host's release.
> +  -R,--release      Fedora release for the new container.
> +                    Defaults to host's release if the host is Fedora.
>       --fqdn         fully qualified domain name (FQDN) for DNS and system naming
>    -a,--arch         Define what arch the container will be [i686,x86_64]
>    -h,--help         print this help
> -- 
> 2.1.0
> 
> 
> 



> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From serge.hallyn at ubuntu.com  Sat Jan 10 16:13:55 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Sat, 10 Jan 2015 16:13:55 +0000
Subject: [lxc-devel] Bump: Failure with authorisation of update-manager
 in Ubuntu Desktop-Container
In-Reply-To: <54AE268A.8000403@DNB.DE>
References: <CA+B82AwHhwZFet58vx2pJJ7Va+X0TkQVfh1ffaHpc7mtXpyJ+g@mail.gmail.com>
 <54AE268A.8000403@DNB.DE>
Message-ID: <20150110161355.GO10641@ubuntumail>

Quoting Guido Jäkel (G.Jaekel at DNB.DE):
> Hi Dev's,
> 
> may anyone please help me to solve this issue?
> 
> Guido
> 
> On 04.01.2015 20:01, Guido Jäkel wrote on [lxc-user]:
> >My goal here is to set up a Ubuntu Desktop Container ...
> >[...]
> >After a a few tweaks, this already runs very well...
> >[...]> But now I stuck at an issue concerning the GUI versions of software management: The apt commandline tools work, but the GUI program update-manager shows the error message "You are not allowed to perform this action" and fail to work. However, if i start it with 'gksudo update-manager', there is no such message.
> > 
> > In the same way, the software-manager or other GUI methods to install/remove software is not working. May anybody please have a hint what might be missing in the container setup or have to be tweaked inside?

So you have ubuntu desktop running in a unprivileged container?  Exactly how are
you logging in - you have a tty on the host which runs x in the container?  vnc?
x2go?  spice?

I assume there's nothing in syslog or /var/log/audit/audit.log?  Can you strace
update-manager and grep -e "(EPERM|EACCES)" ?

-serge

From obnox at samba.org  Sat Jan 10 17:28:26 2015
From: obnox at samba.org (Michael Adam)
Date: Sat, 10 Jan 2015 18:28:26 +0100
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150110155918.GL10641@ubuntumail>
References: <20150108100516.GK2958@obnox.de> <20150108101652.GL2958@obnox.de>
 <20150110040505.GJ10641@ubuntumail>
 <20150110121836.GC8528@obnox.de>
 <20150110155918.GL10641@ubuntumail>
Message-ID: <20150110172826.GE8528@obnox.de>

On 2015-01-10 at 15:59 +0000, Serge Hallyn wrote:
> Quoting Michael Adam (obnox at samba.org):
> > On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
> > > 
> > > Actually a patch to remove '-p|--path' from the
> > > help statement in all other templates would be appreciated.
> > 
> > Ok, I was just about to send such an add-on patchset,
> > but first one more thought:
> > 
> > Doesn't the same apply to the -n|--name parameter?
> > 
> > And what about the --rootfs switch that some
> > of the templates (like archlinux) take?
> 
> Yup, good point, I think it does.

So then, there are two different approaches:

1) document all options for the sake of completeness,
   marking some of them as "intended for internal use only"

2) hide those internal options from the usage text.

I am personally not 100% certain what I would favour, but
slightly inclining towards option 1.

I am happy to do patches for either variant, but will
wait for more comments on that first.

Cheers - Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150110/a6526433/attachment.sig>

From riyakhanna1983 at gmail.com  Sat Jan 10 17:35:47 2015
From: riyakhanna1983 at gmail.com (riya khanna)
Date: Sat, 10 Jan 2015 11:35:47 -0600
Subject: [lxc-devel] lxc-start fails
In-Reply-To: <20150110041347.GK10641@ubuntumail>
References: <CALRD3qJctrW=K4_0Dy20EWGJqW+gCv6GMv2sNL20rRRXOwrz5g@mail.gmail.com>
 <20150109141238.GB9897@ubuntumail>
 <CALRD3qKo82AmzJGN1g5b75MwSb_o9C=Q=oN0oTehMgmYmd56AQ@mail.gmail.com>
 <20150109215539.GD10641@ubuntumail>
 <CALRD3qL5U1U8NkRk1C4LsmBWX=PrWj-jrRhPQL23Fw=ZO9KRQg@mail.gmail.com>
 <20150110033647.GI10641@ubuntumail>
 <CALRD3qKULutVq-G2R1LKDQ5XT_9jPfjK7toiRDLj6qv7-2GuFw@mail.gmail.com>
 <20150110041347.GK10641@ubuntumail>
Message-ID: <CALRD3qKJ_1M==VZvrSQCjL_3svS5ZXxH1DypoWnwYOFn1bGWzA@mail.gmail.com>

I'm trying to run an android container (as root) on a busy box based host.

"netstat -xp | grep lxc" shows nothing

Running 3.17 kernel

# uname -a
Linux (none) 3.17.0-07555-g119c35e #331 PREEMPT armv7l GNU/Linux

Using busy box shell

# echo $SHELL
/bin/sh

Thanks for your help!

On Fri, Jan 9, 2015 at 10:13 PM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
>>       lxc-start 1420861068.913 ERROR    lxc_monitor -
>> monitor.c:lxc_monitor_open:208 - connect : backing off 10
>
> Please tell us more about your system.  Busybox based.  What sort of kernel,
> and what sort of security features built in?  What does 'netstat -xp | grep lxc'
> show?  If it lists a process, what does /proc/$pid/status and /proc/$pid/attr/current
> show for both its pid, and your shell ($$) ?
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From riyakhanna1983 at gmail.com  Sat Jan 10 17:41:15 2015
From: riyakhanna1983 at gmail.com (riya khanna)
Date: Sat, 10 Jan 2015 11:41:15 -0600
Subject: [lxc-devel] lxc-start fails
In-Reply-To: <CALRD3qKJ_1M==VZvrSQCjL_3svS5ZXxH1DypoWnwYOFn1bGWzA@mail.gmail.com>
References: <CALRD3qJctrW=K4_0Dy20EWGJqW+gCv6GMv2sNL20rRRXOwrz5g@mail.gmail.com>
 <20150109141238.GB9897@ubuntumail>
 <CALRD3qKo82AmzJGN1g5b75MwSb_o9C=Q=oN0oTehMgmYmd56AQ@mail.gmail.com>
 <20150109215539.GD10641@ubuntumail>
 <CALRD3qL5U1U8NkRk1C4LsmBWX=PrWj-jrRhPQL23Fw=ZO9KRQg@mail.gmail.com>
 <20150110033647.GI10641@ubuntumail>
 <CALRD3qKULutVq-G2R1LKDQ5XT_9jPfjK7toiRDLj6qv7-2GuFw@mail.gmail.com>
 <20150110041347.GK10641@ubuntumail>
 <CALRD3qKJ_1M==VZvrSQCjL_3svS5ZXxH1DypoWnwYOFn1bGWzA@mail.gmail.com>
Message-ID: <CALRD3q+h6BDOzO+b12j=OaLUSLPXL1+7RBk0b5ctTKVcxvc2Vw@mail.gmail.com>

Like I said earlier as well, the container _does_ start just fine, but
I see these messages:

lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 10
lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 50
lxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 100
lxc-start: monitor.c: lxc_monitor_open: 213 connect : Connection refused
lxc-start: lxc_start.c: main: 345 The container failed to start.
lxc-start: lxc_start.c: main: 347 To get more details, run the
container in foreground mode.
lxc-start: lxc_start.c: main: 349 Additional information can be
obtained by setting the --logfile and --logpriority options.

On Sat, Jan 10, 2015 at 11:35 AM, riya khanna <riyakhanna1983 at gmail.com> wrote:
> I'm trying to run an android container (as root) on a busy box based host.
>
> "netstat -xp | grep lxc" shows nothing
>
> Running 3.17 kernel
>
> # uname -a
> Linux (none) 3.17.0-07555-g119c35e #331 PREEMPT armv7l GNU/Linux
>
> Using busy box shell
>
> # echo $SHELL
> /bin/sh
>
> Thanks for your help!
>
> On Fri, Jan 9, 2015 at 10:13 PM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
>>>       lxc-start 1420861068.913 ERROR    lxc_monitor -
>>> monitor.c:lxc_monitor_open:208 - connect : backing off 10
>>
>> Please tell us more about your system.  Busybox based.  What sort of kernel,
>> and what sort of security features built in?  What does 'netstat -xp | grep lxc'
>> show?  If it lists a process, what does /proc/$pid/status and /proc/$pid/attr/current
>> show for both its pid, and your shell ($$) ?
>> _______________________________________________
>> lxc-devel mailing list
>> lxc-devel at lists.linuxcontainers.org
>> http://lists.linuxcontainers.org/listinfo/lxc-devel

From G.Jaekel at DNB.DE  Sun Jan 11 11:01:46 2015
From: G.Jaekel at DNB.DE (=?UTF-8?B?R3VpZG8gSsOka2Vs?=)
Date: Sun, 11 Jan 2015 12:01:46 +0100
Subject: [lxc-devel] Bump: Failure with authorisation of update-manager
 in Ubuntu Desktop-Container
In-Reply-To: <20150110161355.GO10641@ubuntumail>
References: <CA+B82AwHhwZFet58vx2pJJ7Va+X0TkQVfh1ffaHpc7mtXpyJ+g@mail.gmail.com>
 <54AE268A.8000403@DNB.DE> <20150110161355.GO10641@ubuntumail>
Message-ID: <54B2581A.9000706@DNB.DE>

On 10.01.2015 17:13, Serge Hallyn wrote:
> Quoting Guido Jäkel (G.Jaekel at DNB.DE):
>> Hi Dev's,
>>
>> may anyone please help me to solve this issue?
>>
>> Guido
>>
>> On 04.01.2015 20:01, Guido Jäkel wrote on [lxc-user]:
>>> My goal here is to set up a Ubuntu Desktop Container ...
>>> [...]
>>> After a a few tweaks, this already runs very well...
>>> [...]> But now I stuck at an issue concerning the GUI versions of software management: The apt commandline tools work, but the GUI program update-manager shows the error message "You are not allowed to perform this action" and fail to work. However, if i start it with 'gksudo update-manager', there is no such message.
>>>
>>> In the same way, the software-manager or other GUI methods to install/remove software is not working. May anybody please have a hint what might be missing in the container setup or have to be tweaked inside?
> 
> So you have ubuntu desktop running in a unprivileged container?  Exactly how are
> you logging in - you have a tty on the host which runs x in the container?  vnc?
> x2go?  spice?

No, this my own Gentoo home server and the Ubuntu container is started by root. It have direct access to the video card (because the host just use the console for emergencies and is managed by ssh), the tty7 and the input dev's (keyboard and mouse). Please refer to my first posting in lxc-user at 2015-01-04 for some details.

Actually, this email is written inside the Ubuntu Container.



> I assume there's nothing in syslog or /var/log/audit/audit.log?

There is no /var/log/audit/ inside the container. I've appended the container's syslog for a startup. The most noticable lines in /var/log/syslog are

	Jan 11 10:50:04 celly gnome-session[1333]: WARNING: Could not get session id for session. Check that logind is properly installed and pam_systemd is getting used at login.
	Jan 11 10:50:06 celly gnome-session[1333]: GLib-CRITICAL: g_environ_setenv: assertion 'value != NULL' failed

I'm used to maintain Unix servers, but don't have any deeper understanding of desktop mechanisms. But the keywords "gnome session" and "pam" sounds very suspicious to me.



> Can you strace update-manager and grep -e "(EPERM|EACCES)" ?

Because of the lists atachement limit, I've send to trace to your private mail. Slowed down by the strace, before the error alert box I see a message in the dialog box that it's waiting for authorisation for some time. You meant 'grep -E ...' for sure, I get

	stat("/root/.synaptic/synaptic.conf", 0x7fff5d4b9aa0) = -1 EACCES (Permission denied)
	access("/var/cache/apt/", W_OK)         = -1 EACCES (Permission denied)
	open("/var/lib/update-manager/meta-release-lts", O_WRONLY|O_CREAT|O_APPEND|O_CLOEXEC, 0666) = -1 EACCES (Permission denied)
	open("/var/lib/dpkg/lock", O_RDWR|O_CREAT|O_NOFOLLOW, 0640) = -1 EACCES (Permission denied)
	access("/var/cache/apt/", W_OK)         = -1 EACCES (Permission denied)
	open("/var/lib/dpkg/lock", O_RDWR|O_CREAT|O_NOFOLLOW, 0640) = -1 EACCES (Permission denied)
	access("/var/cache/apt/", W_OK)         = -1 EACCES (Permission denied)

but also the following looks suspect because the name of the container is "celly" and the source of cloning is "nelly".

	socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC, 0) = 3
	connect(3, {sa_family=AF_LOCAL, sun_path=@"/tmp/.X11-unix/X0"}, 20) = 0
	getpeername(3, {sa_family=AF_LOCAL, sun_path=@"/tmp/.X11-unix/X0"}, [20]) = 0
->	uname({sys="Linux", node="celly", ...}) = 0
	access("/home/gjaekel/.Xauthority", R_OK) = 0
	open("/home/gjaekel/.Xauthority", O_RDONLY) = 4
	fstat(4, {st_mode=S_IFREG|0600, st_size=250, ...}) = 0
	mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81e051e000
->	read(4, "\1\0\0\5nelly\0\0011\0\22MIT-MAGIC-COOKIE-1"..., 4096) = 250
	read(4, "", 4096)                       = 0
	close(4)  

Might the problem based on the fact, that i simply just copy to much files? I take a snapshot of the rootfs from running system "nelly" using 'rsync -au <src> <dst>' ...


greetings

Guido

-------------- next part --------------
A non-text attachment was scrubbed...
Name: syslog.startup.bz2
Type: application/x-bzip
Size: 2872 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150111/3b8acb5c/attachment.bin>

From serge.hallyn at ubuntu.com  Mon Jan 12 20:41:38 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 12 Jan 2015 20:41:38 +0000
Subject: [lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the overlayfs
	workdir option
Message-ID: <20150112204138.GU10641@ubuntumail>

We fixed this some time ago for basic lxc-start, but never did
lxc-start-ephemeral.

Since the lxc-start patches were pushed, Miklos has given us a
way to detect whether we need the workdir= option.  So the
bdev.c code could be simplified to check for "overlay\n" in
/proc/filesystems just as lxc-start-ephemeral does.  This
patch doesn't do that.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/lxc-start-ephemeral.in | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
index c999e74..bf3f121 100644
--- a/src/lxc/lxc-start-ephemeral.in
+++ b/src/lxc/lxc-start-ephemeral.in
@@ -219,6 +219,14 @@ for entry in args.cdir:
         dst_path = "%s/rootfs/%s" % (dest_path, src_path)
         overlay_dirs += [(src_path, dst_path)]
 
+# do we have the new overlay fs which requires workdir, or the older
+# overlayfs which does not?
+have_new_overlay = False
+with open("/proc/filesystems", "r") as fd:
+    for line in fd.readlines():
+        if line == "nodev\toverlay\n":
+            have_new_overlay = True
+
 # Generate pre-mount script
 with open(os.path.join(dest_path, "pre-mount"), "w+") as fd:
     os.fchmod(fd.fileno(), 0o755)
@@ -231,16 +239,31 @@ LXC_NAME="%s"
     count = 0
     for entry in overlay_dirs:
         target = "%s/delta%s" % (dest_path, count)
+        workdir = "%s/work%s" % (dest_path, count)
         fd.write("mkdir -p %s %s\n" % (target, entry[1]))
+        if have_new_overlay:
+            fd.write("mkdir -p %s\n" % workdir)
 
         if args.storage_type == "tmpfs":
             fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (target))
+            if have_new_overlay:
+                fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (workdir))
 
         fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], target))
         fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
+        if have_new_overlay:
+            fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], workdir))
 
         if args.union_type == "overlayfs":
-            fd.write("mount -n -t overlayfs"
+            if have_new_overlay:
+                fd.write("mount -n -t overlayfs"
+                     " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
+                         target,
+                         entry[0],
+                         workdir,
+                         entry[1]))
+            else:
+                fd.write("mount -n -t overlayfs"
                      " -oupperdir=%s,lowerdir=%s none %s\n" % (
                          target,
                          entry[0],
-- 
2.1.0


From stgraber at ubuntu.com  Mon Jan 12 21:21:35 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Mon, 12 Jan 2015 16:21:35 -0500
Subject: [lxc-devel] [PATCH 1/1] set close-all-fds by default
In-Reply-To: <20150109163342.GA10183@ubuntumail>
References: <20150109163342.GA10183@ubuntumail>
Message-ID: <20150112212135.GE24962@dakara>

On Fri, Jan 09, 2015 at 04:33:42PM +0000, Serge Hallyn wrote:
> When containers request to be daemonized, close-all-fd is
> set to true.  But when we switched ot daemonize-by-default we didn't
> set close-all-fd by default.
> 
> Fix that.  In order to do that we have to always have a lxc_conf
> object.  As a consequence, after this patch we can drop a bunch
> of checks for c->lxc_conf existing.  We should consider removing
> those.  This patch does not do that.
> 
> This should close https://github.com/lxc/lxc/issues/354
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/lxccontainer.c | 17 ++++++++++++-----
>  1 file changed, 12 insertions(+), 5 deletions(-)
> 
> diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
> index 406cead..878c483 100644
> --- a/src/lxc/lxccontainer.c
> +++ b/src/lxc/lxccontainer.c
> @@ -457,6 +457,14 @@ static bool lxcapi_load_config(struct lxc_container *c, const char *alt_file)
>  	return ret;
>  }
>  
> +static void do_set_daemonize(struct lxc_container *c, bool state)
> +{
> +	c->daemonize = state;
> +	/* daemonize implies close_all_fds so set it */
> +	if (state)
> +		c->lxc_conf->close_all_fds = 1;
> +}
> +
>  static bool lxcapi_want_daemonize(struct lxc_container *c, bool state)
>  {
>  	if (!c || !c->lxc_conf)
> @@ -465,10 +473,7 @@ static bool lxcapi_want_daemonize(struct lxc_container *c, bool state)
>  		ERROR("Error getting mem lock");
>  		return false;
>  	}
> -	c->daemonize = state;
> -	/* daemonize implies close_all_fds so set it */
> -	if (state == 1)
> -		c->lxc_conf->close_all_fds = 1;
> +	do_set_daemonize(c, state);
>  	container_mem_unlock(c);
>  	return true;
>  }
> @@ -4098,7 +4103,9 @@ struct lxc_container *lxc_container_new(const char *name, const char *configpath
>  		container_destroy(c);
>  		lxcapi_clear_config(c);
>  	}
> -	c->daemonize = true;
> +	if (!c->lxc_conf)
> +		c->lxc_conf = lxc_conf_init();
> +	do_set_daemonize(c, true);
>  	c->pidfile = NULL;
>  
>  	// assign the member functions
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150112/ed6160f2/attachment.sig>

From stgraber at ubuntu.com  Mon Jan 12 21:22:02 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Mon, 12 Jan 2015 16:22:02 -0500
Subject: [lxc-devel] [PATCH 1/1] Fix reversed args in mount call
In-Reply-To: <20150109220028.GE10641@ubuntumail>
References: <20150109220028.GE10641@ubuntumail>
Message-ID: <20150112212202.GF24962@dakara>

On Fri, Jan 09, 2015 at 10:00:28PM +0000, Serge Hallyn wrote:
> Riya Khanna reported that with a ramfs rootfs the mount to make
> / rprivate was returning -EFAULT.  NULL was being passed as the
> mount target.  Pass "/" instead.
> 
> Reported-by: riya khanna <riyakhanna1983 at gmail.com>>
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/conf.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index 72181dd..9072002 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -1513,7 +1513,7 @@ int prepare_ramfs_root(char *root)
>  		return -1;
>  	}
>  
> -	if (mount(".", NULL, NULL, MS_REC | MS_PRIVATE, NULL)) {
> +	if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
>  		SYSERROR("Failed to make . rprivate");
>  		return -1;
>  	}
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150112/632e511c/attachment.sig>

From stgraber at ubuntu.com  Mon Jan 12 21:25:17 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Mon, 12 Jan 2015 16:25:17 -0500
Subject: [lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the
 overlayfs workdir option
In-Reply-To: <20150112204138.GU10641@ubuntumail>
References: <20150112204138.GU10641@ubuntumail>
Message-ID: <20150112212517.GG24962@dakara>

On Mon, Jan 12, 2015 at 08:41:38PM +0000, Serge Hallyn wrote:
> We fixed this some time ago for basic lxc-start, but never did
> lxc-start-ephemeral.
> 
> Since the lxc-start patches were pushed, Miklos has given us a
> way to detect whether we need the workdir= option.  So the
> bdev.c code could be simplified to check for "overlay\n" in
> /proc/filesystems just as lxc-start-ephemeral does.  This
> patch doesn't do that.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> ---
>  src/lxc/lxc-start-ephemeral.in | 25 ++++++++++++++++++++++++-
>  1 file changed, 24 insertions(+), 1 deletion(-)
> 
> diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
> index c999e74..bf3f121 100644
> --- a/src/lxc/lxc-start-ephemeral.in
> +++ b/src/lxc/lxc-start-ephemeral.in
> @@ -219,6 +219,14 @@ for entry in args.cdir:
>          dst_path = "%s/rootfs/%s" % (dest_path, src_path)
>          overlay_dirs += [(src_path, dst_path)]
>  
> +# do we have the new overlay fs which requires workdir, or the older
> +# overlayfs which does not?
> +have_new_overlay = False
> +with open("/proc/filesystems", "r") as fd:
> +    for line in fd.readlines():

"for line in fd" should be less memory hungry than reading the whole
file, splitting it and storing the result in a list.

> +        if line == "nodev\toverlay\n":
> +            have_new_overlay = True

Does that mean that we should also be mounting it as "overlay" rather
than "overlayfs"?

> +
>  # Generate pre-mount script
>  with open(os.path.join(dest_path, "pre-mount"), "w+") as fd:
>      os.fchmod(fd.fileno(), 0o755)
> @@ -231,16 +239,31 @@ LXC_NAME="%s"
>      count = 0
>      for entry in overlay_dirs:
>          target = "%s/delta%s" % (dest_path, count)
> +        workdir = "%s/work%s" % (dest_path, count)
>          fd.write("mkdir -p %s %s\n" % (target, entry[1]))
> +        if have_new_overlay:
> +            fd.write("mkdir -p %s\n" % workdir)
>  
>          if args.storage_type == "tmpfs":
>              fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (target))
> +            if have_new_overlay:
> +                fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (workdir))
>  
>          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], target))
>          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
> +        if have_new_overlay:
> +            fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], workdir))
>  
>          if args.union_type == "overlayfs":
> -            fd.write("mount -n -t overlayfs"
> +            if have_new_overlay:
> +                fd.write("mount -n -t overlayfs"
> +                     " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
> +                         target,
> +                         entry[0],
> +                         workdir,
> +                         entry[1]))
> +            else:
> +                fd.write("mount -n -t overlayfs"
>                       " -oupperdir=%s,lowerdir=%s none %s\n" % (
>                           target,
>                           entry[0],
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150112/2a187eab/attachment.sig>

From stgraber at ubuntu.com  Mon Jan 12 21:31:52 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Mon, 12 Jan 2015 16:31:52 -0500
Subject: [lxc-devel] [PATCH 1/2] autodev: switch strategies (v2)
In-Reply-To: <20150109213817.GC10641@ubuntumail>
References: <20150109193614.GF10330@ubuntumail>
 <20150109202626.GB10641@ubuntumail>
 <20150109213817.GC10641@ubuntumail>
Message-ID: <20150112213152.GH24962@dakara>

On Fri, Jan 09, 2015 at 09:38:18PM +0000, Serge Hallyn wrote:
> Do not keep container devs under /dev/.lxc.  Instead, always
> keep them in a small tmpfs mounted at $(mounted_root)/dev.
> 
> The tmpfs is mounted in the container monitor's namespace.  This
> means that at every reboot it will get re-created.  It seems to
> me this better replicates what happens on a real host.
> 
> If we want devices persisting across reboots, then perhaps we can
> implement a $lxcpath/$name/keepdev directory containing devices to
> bind into the container at each startup.
> 
> Changelog (v2): don't bother with the $lxcpath/$name/rootfs.dev
> 	directory, just mount the tmpfs straight into the container.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> ---
>  src/lxc/conf.c  | 318 ++++++--------------------------------------------------
>  src/lxc/start.c |   1 -
>  2 files changed, 31 insertions(+), 288 deletions(-)
> 
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index 72181dd..dad79ab 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -94,10 +94,7 @@
>  
>  lxc_log_define(lxc_conf, lxc);
>  
> -#define MAXHWLEN    18
> -#define MAXINDEXLEN 20
> -#define MAXMTULEN   16
> -#define MAXLINELEN  128
> +#define LINELEN 4096
>  
>  #if HAVE_SYS_CAPABILITY_H
>  #ifndef CAP_SETFCAP
> @@ -295,9 +292,6 @@ static struct caps_opt caps_opt[] = {
>  static struct caps_opt caps_opt[] = {};
>  #endif
>  
> -const char *dev_base_path = "/dev/.lxc";
> -const char *dev_user_path = "/dev/.lxc/user";
> -
>  static int run_buffer(char *buffer)
>  {
>  	struct lxc_popen_FILE *f;
> @@ -1092,247 +1086,55 @@ fail:
>  }
>  
>  /*
> - * Check to see if a directory has something mounted on it and,
> - * if it does, return the fstype.
> - *
> - * Code largely based on detect_shared_rootfs below
> - *
> - * Returns: # of matching entries in /proc/self/mounts
> - * 	if != 0 fstype is filled with the last filesystem value.
> - * 	if == 0 no matches found, fstype unchanged.
> - *
> - * ToDo: Maybe return the mount options in another parameter...
> + * Just create a path for /dev under $lxcpath/$name and in rootfs
> + * If we hit an error, log it but don't fail yet.
>   */
> -
> -#define LINELEN 4096
> -#define MAX_FSTYPE_LEN 128
> -static int mount_check_fs( const char *dir, char *fstype )
> +static void create_devdir(const char *path)
>  {
> -	char buf[LINELEN], *p;
> -	struct stat s;
> -	FILE *f;
> -	int found_fs = 0;
> -	char *p2;
> -
> -	DEBUG("entering mount_check_fs for %s", dir);
> -
> -	if ( 0 != access(dir, F_OK) || 0 != stat(dir, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		return 0;
> -	}
> -
> -	f = fopen("/proc/self/mounts", "r");
> -	if (!f)
> -		return 0;
> -	while (fgets(buf, LINELEN, f)) {
> -		p = index(buf, ' ');
> -		if( !p )
> -			continue;
> -		*p = '\0';
> -		p2 = p + 1;
> -
> -		p = index(p2, ' ');
> -		if( !p )
> -			continue;
> -		*p = '\0';
> -
> -		/* Compare the directory in the entry to desired */
> -		if( strcmp( p2, dir ) ) {
> -			continue;
> -		}
> -
> -		p2 = p + 1;
> -		p = index( p2, ' ');
> -		if( !p )
> -			continue;
> -		*p = '\0';
> -
> -		++found_fs;
> -
> -		if( fstype ) {
> -			strncpy( fstype, p2, MAX_FSTYPE_LEN - 1 );
> -			fstype [ MAX_FSTYPE_LEN - 1 ] = '\0';
> -		}
> -	}
> -
> -	fclose(f);
> -
> -	DEBUG("mount_check_fs returning %d last %s", found_fs, fstype);
> -
> -	return found_fs;
> -}
> -
> -/*
> - * Locate a devtmpfs mount (should be on /dev) and create a container
> - * subdirectory on it which we can then bind mount to the container
> - * /dev instead of mounting a tmpfs there.
> - * If we fail, return NULL.
> - * Else return the pointer to the name buffer with the string to
> - * the devtmpfs subdirectory.
> - */
> -
> -static char *mk_devtmpfs(const char *name, char *path, const char *lxcpath)
> -{
> -	int ret;
> -	struct stat s;
> -	char tmp_path[MAXPATHLEN];
> -	char fstype[MAX_FSTYPE_LEN];
> -	uint64_t hash;
> -
> -	if ( 0 != access(dev_base_path, F_OK) || 0 != stat(dev_base_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		/* This is just making /dev/.lxc it better work or we're done */
> -		ret = mkdir(dev_base_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
> -		if ( ret ) {
> -			SYSERROR( "Unable to create /dev/.lxc for autodev" );
> -			return NULL;
> -		}
> -	}
> -
> -	/*
> -	 * Programmers notes:
> -	 * 	We can not do mounts in this area of code that we want
> -	 * 	to be visible in the host.  Consequently, /dev/.lxc must
> -	 * 	be set up earlier if we need a tmpfs mounted there.
> -	 * 	That only affects the rare cases where autodev is enabled
> -	 * 	for a container and devtmpfs is not mounted on /dev in the
> -	 * 	host.  In that case, we'll fall back to the old method
> -	 * 	of mounting a tmpfs in the container and have no visibility
> -	 * 	into the container /dev.
> -	 */
> -	if( ! mount_check_fs( "/dev", fstype )
> -		|| strcmp( "devtmpfs", fstype ) ) {
> -		/* Either /dev was not mounted or was not devtmpfs */
> -
> -		if ( ! mount_check_fs( "/dev/.lxc", NULL ) ) {
> -			/*
> -			 * /dev/.lxc is not already mounted
> -			 * Doing a mount here does no good, since
> -			 * it's not visible in the host.
> -			 */
> -
> -			ERROR("/dev/.lxc is not setup - taking fallback" );
> -			return NULL;
> -		}
> -	}
> -
> -	if ( 0 != access(dev_user_path, F_OK) || 0 != stat(dev_user_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		/*
> -		 * This is making /dev/.lxc/user path for non-priv users.
> -		 * If this doesn't work, we'll have to fall back in the
> -		 * case of non-priv users.  It's mode 1777 like /tmp.
> -		 */
> -		ret = mkdir(dev_user_path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
> -		if ( ret ) {
> -			/* Issue an error but don't fail yet! */
> -			ERROR("Unable to create /dev/.lxc/user");
> -		}
> -		/* Umask tends to screw us up here */
> -		chmod(dev_user_path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
> -	}
> -
> -	/*
> -	 * Since the container name must be unique within a given
> -	 * lxcpath, we're going to use a hash of the path
> -	 * /lxcpath/name as our hash name in /dev/.lxc/
> -	 */
> -
> -	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s", lxcpath, name);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> -		return NULL;
> -
> -	hash = fnv_64a_buf(tmp_path, ret, FNV1A_64_INIT);
> -
> -	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_base_path, name, hash);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> -		return NULL;
> -
> -	if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		ret = mkdir(tmp_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
> -		if ( ret ) {
> -			/* Something must have failed with the dev_base_path...
> -			 * Maybe unpriv user.  Try dev_user_path now... */
> -			INFO("Setup in /dev/.lxc failed.  Trying /dev/.lxc/user." );
> -
> -			ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_user_path, name, hash);
> -			if (ret < 0 || ret >= MAXPATHLEN)
> -				return NULL;
> -
> -			if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -				ret = mkdir(tmp_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
> -				if ( ret ) {
> -					ERROR("Container /dev setup in host /dev failed - taking fallback" );
> -					return NULL;
> -				}
> -			}
> -		}
> -	}
> -
> -	strcpy( path, tmp_path );
> -	return path;
> +	int ret = mkdir(path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
> +	if (ret) /* Issue an error but don't fail yet! */
> +		SYSERROR("Unable to create devpath %s", path);
> +	ret = chmod(path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
> +	if (ret)
> +		SYSERROR("Failed to chown devpath %s", path);
> +	INFO("Created %s", path);
>  }
>  
> -/*
> - * Do we want to add options for max size of /dev and a file to
> - * specify which devices to create?
> - */
>  static int mount_autodev(const char *name, char *root, const char *lxcpath)
>  {
>  	int ret;
> -	struct stat s;
> -	char path[MAXPATHLEN];
> -	char host_path[MAXPATHLEN];
> -	char devtmpfs_path[MAXPATHLEN];
> +	size_t clen;
> +	char *path;
>  
>  	INFO("Mounting /dev under %s", root);
>  
> -	ret = snprintf(host_path, MAXPATHLEN, "%s/%s/rootfs.dev", lxcpath, name);
> -	if (ret < 0 || ret > MAXPATHLEN)
> -		return -1;
> +	/* $(root) + "/dev/pts" + '\0' */
> +	clen = strlen(root) + 9;
> +	path = alloca(clen);
>  
> -	ret = snprintf(path, MAXPATHLEN, "%s/dev", root);
> -	if (ret < 0 || ret > MAXPATHLEN)
> +	ret = snprintf(path, clen, "%s/dev", root);
> +	if (ret < 0 || ret >= clen)
>  		return -1;
>  
> -	if (mk_devtmpfs( name, devtmpfs_path, lxcpath ) ) {
> -		/*
> -		 * Get rid of old links and directoriess
> -		 * This could be either a symlink and we remove it,
> -		 * or an empty directory and we remove it,
> -		 * or non-existent and we don't care,
> -		 * or a non-empty directory, and we will then emit an error
> -		 * but we will not fail out the process.
> -		 */
> -		unlink( host_path );
> -		rmdir( host_path );
> -		ret = symlink(devtmpfs_path, host_path);
> -
> -		if ( ret < 0 ) {
> -			SYSERROR("WARNING: Failed to create symlink '%s'->'%s'", host_path, devtmpfs_path);
> -		}
> -		DEBUG("Bind mounting %s to %s", devtmpfs_path , path );
> -		ret = mount(devtmpfs_path, path, NULL, MS_BIND, 0 );
> -	} else {
> -		/* Only mount a tmpfs on here if we don't already a mount */
> -		if ( ! mount_check_fs( host_path, NULL ) ) {
> -			DEBUG("Mounting tmpfs to %s", host_path );
> -			ret = mount("none", path, "tmpfs", 0, "size=100000,mode=755");
> -		} else {
> -			/* This allows someone to manually set up a mount */
> -			DEBUG("Bind mounting %s to %s", host_path, path );
> -			ret = mount(host_path , path, NULL, MS_BIND, 0 );
> -		}
> +	/* Create $(mounted_rootfs/dev), and * mount a small tmpfs onto it */
> +	if (!dir_exists(path))
> +		create_devdir(path);

So I'm not sure how others feel but I usually try to have LXC do as
little changes to the rootfs as possible. Here, while I agree that /dev
pretty much has to exist for any Linux system to make any kind of sense,
I think I'd still prefer that we log a WARNING and skip autodev setup
entirely in that case (so starting the container without /dev).

> +	if (0 != mount("none", path, "tmpfs", 0, "size=100000,mode=755")) {

Nitpicking but can we be a bit consistent and have those tests the other
way around? (mount... != 0)

> +		SYSERROR("Failed mounting tmpfs onto %s\n", path);
> +		return false;
>  	}
> -	if (ret) {
> -		SYSERROR("Failed to mount /dev at %s", root);
> -		return -1;
> -	}
> -	ret = snprintf(path, MAXPATHLEN, "%s/dev/pts", root);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> +
> +	INFO("Mounted tmpfs onto %s",  path);
> +
> +	ret = snprintf(path, clen, "%s/dev/pts", root);
> +	if (ret < 0 || ret >= clen)
>  		return -1;
> +
>  	/*
>  	 * If we are running on a devtmpfs mapping, dev/pts may already exist.
>  	 * If not, then create it and exit if that fails...
>  	 */
> -	if ( 0 != access(path, F_OK) || 0 != stat(path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> +	if (!dir_exists(path)) {
>  		ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
>  		if (ret) {
>  			SYSERROR("Failed to create /dev/pts in container");
> @@ -1395,64 +1197,6 @@ static int setup_autodev(const char *root)
>  	return 0;
>  }
>  
> -/*
> - * Locate allocated devtmpfs mount and purge it.
> - * path lookup mostly taken from mk_devtmpfs
> - */
> -int lxc_delete_autodev(struct lxc_handler *handler)
> -{
> -	int ret;
> -	struct stat s;
> -	struct lxc_conf *lxc_conf = handler->conf;
> -	const char *name = handler->name;
> -	const char *lxcpath = handler->lxcpath;
> -	char tmp_path[MAXPATHLEN];
> -	uint64_t hash;
> -
> -	if ( lxc_conf->autodev <= 0 )
> -		return 0;
> -
> -	/* don't clean on reboot */
> -	if ( lxc_conf->reboot == 1 )
> -		return 0;
> -
> -	/*
> -	 * Use the same logic as mk_devtmpfs to compute candidate
> -	 * path for cleanup.
> -	 */
> -
> -	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s", lxcpath, name);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> -		return -1;
> -
> -	hash = fnv_64a_buf(tmp_path, ret, FNV1A_64_INIT);
> -
> -	/* Probe /dev/.lxc/<container name>.<hash> */
> -	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_base_path, name, hash);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> -		return -1;
> -
> -	if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		/* Probe /dev/.lxc/user/<container name>.<hash> */
> -		ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_user_path, name, hash);
> -		if (ret < 0 || ret >= MAXPATHLEN)
> -			return -1;
> -
> -		if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -			WARN("Failed to locate autodev /dev/.lxc and /dev/.lxc/user." );
> -			return -1;
> -		}
> -	}
> -
> -	/* Do the cleanup */
> -	INFO("Cleaning %s", tmp_path );
> -	if ( 0 != lxc_rmdir_onedev(tmp_path, NULL) ) {
> -		ERROR("Failed to cleanup autodev" );
> -	}
> -
> -	return 0;
> -}
> -
>  static int setup_rootfs(struct lxc_conf *conf)
>  {
>  	const struct lxc_rootfs *rootfs = &conf->rootfs;
> diff --git a/src/lxc/start.c b/src/lxc/start.c
> index cd78665..98905a3 100644
> --- a/src/lxc/start.c
> +++ b/src/lxc/start.c
> @@ -477,7 +477,6 @@ void lxc_fini(const char *name, struct lxc_handler *handler)
>  
>  	lxc_console_delete(&handler->conf->console);
>  	lxc_delete_tty(&handler->conf->tty_info);
> -	lxc_delete_autodev(handler);
>  	close(handler->conf->maincmd_fd);
>  	handler->conf->maincmd_fd = -1;
>  	free(handler->name);
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150112/ce891fbc/attachment.sig>

From stgraber at ubuntu.com  Mon Jan 12 21:33:43 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Mon, 12 Jan 2015 16:33:43 -0500
Subject: [lxc-devel] [PATCH 2/2] fill_autodev: bind-mount if mknod fails
In-Reply-To: <20150109193836.GA10641@ubuntumail>
References: <20150109193614.GF10330@ubuntumail>
 <20150109193836.GA10641@ubuntumail>
Message-ID: <20150112213343.GI24962@dakara>

On Fri, Jan 09, 2015 at 07:38:36PM +0000, Serge Hallyn wrote:
> First, rename setup_autodev to fill_autodev, since all it
> does is populate it, not fully set it up.
> 
> Secondly, if mknod of a device fails, then try bind-mounting
> it from the host rather than failing immediately.
> 
> Note that this isn't an urgent patch because the common.userns
> configuration hook already specifies bind,create=file mount
> entries for all the devices we would want.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/conf.c | 25 +++++++++++++++++++++----
>  1 file changed, 21 insertions(+), 4 deletions(-)
> 
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index 822f08d..665631b 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -1197,7 +1197,7 @@ static const struct lxc_devs lxc_devs[] = {
>  	{ "console",	S_IFCHR | S_IRUSR | S_IWUSR,	       5, 1	},
>  };
>  
> -static int setup_autodev(const char *root)
> +static int fill_autodev(const char *root)
>  {
>  	int ret;
>  	char path[MAXPATHLEN];
> @@ -1221,8 +1221,25 @@ static int setup_autodev(const char *root)
>  			return -1;
>  		ret = mknod(path, d->mode, makedev(d->maj, d->min));
>  		if (ret && errno != EEXIST) {
> -			SYSERROR("Error creating %s", d->name);
> -			return -1;
> +			char hostpath[MAXPATHLEN];
> +			FILE *pathfile;
> +
> +			// Unprivileged containers cannot create devices, so
> +			// bind mount the device from the host
> +			ret = snprintf(hostpath, MAXPATHLEN, "/dev/%s", d->name);
> +			if (ret < 0 || ret >= MAXPATHLEN)
> +				return -1;
> +			pathfile = fopen(path, "wb");
> +			if (!pathfile) {
> +				SYSERROR("Failed to create device mount target '%s'", path);
> +				return -1;
> +			}
> +			fclose(pathfile);
> +			if (mount(hostpath, path, 0, MS_BIND, NULL) != 0) {
> +				SYSERROR("Failed bind mounting device %s from host into container",
> +					d->name);
> +				return -1;
> +			}
>  		}
>  	}
>  	umask(cmask);
> @@ -3889,7 +3906,7 @@ int lxc_setup(struct lxc_handler *handler)
>  			ERROR("failed to run autodev hooks for container '%s'.", name);
>  			return -1;
>  		}
> -		if (setup_autodev(lxc_conf->rootfs.mount)) {
> +		if (fill_autodev(lxc_conf->rootfs.mount)) {
>  			ERROR("failed to populate /dev in the container");
>  			return -1;
>  		}
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150112/158bb000/attachment.sig>

From noreply at github.com  Mon Jan 12 22:17:57 2015
From: noreply at github.com (GitHub)
Date: Mon, 12 Jan 2015 14:17:57 -0800
Subject: [lxc-devel] [lxc/lxc] 1f7645: set close-all-fds by default
Message-ID: <54b44815c53e_46c33fb03ced72a09228d@hookshot-fe6-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 1f76453a74f555e30384591567d87b5b4dac7e21
      https://github.com/lxc/lxc/commit/1f76453a74f555e30384591567d87b5b4dac7e21
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M src/lxc/lxccontainer.c

  Log Message:
  -----------
  set close-all-fds by default

When containers request to be daemonized, close-all-fd is
set to true.  But when we switched ot daemonize-by-default we didn't
set close-all-fd by default.

Fix that.  In order to do that we have to always have a lxc_conf
object.  As a consequence, after this patch we can drop a bunch
of checks for c->lxc_conf existing.  We should consider removing
those.  This patch does not do that.

This should close https://github.com/lxc/lxc/issues/354

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 88322f776c8411048217add42d15d610b28317e2
      https://github.com/lxc/lxc/commit/88322f776c8411048217add42d15d610b28317e2
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M src/lxc/conf.c

  Log Message:
  -----------
  Fix reversed args in mount call

Riya Khanna reported that with a ramfs rootfs the mount to make
/ rprivate was returning -EFAULT.  NULL was being passed as the
mount target.  Pass "/" instead.

Reported-by: riya khanna <riyakhanna1983 at gmail.com>>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/fccc348be453...88322f776c84

From serge.hallyn at ubuntu.com  Mon Jan 12 23:54:36 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 12 Jan 2015 23:54:36 +0000
Subject: [lxc-devel] [PATCH 1/2] autodev: switch strategies (v3)
Message-ID: <20150112235436.GA14742@ubuntumail>

Do not keep container devs under /dev/.lxc.  Instead, always
keep them in a small tmpfs mounted at $(mounted_root)/dev.

The tmpfs is mounted in the container monitor's namespace.  This
means that at every reboot it will get re-created.  It seems to
me this better replicates what happens on a real host.

If we want devices persisting across reboots, then perhaps we can
implement a $lxcpath/$name/keepdev directory containing devices to
bind into the container at each startup.

Changelog (v2): don't bother with the $lxcpath/$name/rootfs.dev
	directory, just mount the tmpfs straight into the container.

Changelog (v3): Don't create /dev if it doesn't exist

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/conf.c  | 312 +++++---------------------------------------------------
 src/lxc/start.c |   1 -
 2 files changed, 24 insertions(+), 289 deletions(-)

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 72181dd..dff5020 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -94,10 +94,7 @@
 
 lxc_log_define(lxc_conf, lxc);
 
-#define MAXHWLEN    18
-#define MAXINDEXLEN 20
-#define MAXMTULEN   16
-#define MAXLINELEN  128
+#define LINELEN 4096
 
 #if HAVE_SYS_CAPABILITY_H
 #ifndef CAP_SETFCAP
@@ -295,9 +292,6 @@ static struct caps_opt caps_opt[] = {
 static struct caps_opt caps_opt[] = {};
 #endif
 
-const char *dev_base_path = "/dev/.lxc";
-const char *dev_user_path = "/dev/.lxc/user";
-
 static int run_buffer(char *buffer)
 {
 	struct lxc_popen_FILE *f;
@@ -1092,247 +1086,47 @@ fail:
 }
 
 /*
- * Check to see if a directory has something mounted on it and,
- * if it does, return the fstype.
- *
- * Code largely based on detect_shared_rootfs below
- *
- * Returns: # of matching entries in /proc/self/mounts
- * 	if != 0 fstype is filled with the last filesystem value.
- * 	if == 0 no matches found, fstype unchanged.
- *
- * ToDo: Maybe return the mount options in another parameter...
- */
-
-#define LINELEN 4096
-#define MAX_FSTYPE_LEN 128
-static int mount_check_fs( const char *dir, char *fstype )
-{
-	char buf[LINELEN], *p;
-	struct stat s;
-	FILE *f;
-	int found_fs = 0;
-	char *p2;
-
-	DEBUG("entering mount_check_fs for %s", dir);
-
-	if ( 0 != access(dir, F_OK) || 0 != stat(dir, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		return 0;
-	}
-
-	f = fopen("/proc/self/mounts", "r");
-	if (!f)
-		return 0;
-	while (fgets(buf, LINELEN, f)) {
-		p = index(buf, ' ');
-		if( !p )
-			continue;
-		*p = '\0';
-		p2 = p + 1;
-
-		p = index(p2, ' ');
-		if( !p )
-			continue;
-		*p = '\0';
-
-		/* Compare the directory in the entry to desired */
-		if( strcmp( p2, dir ) ) {
-			continue;
-		}
-
-		p2 = p + 1;
-		p = index( p2, ' ');
-		if( !p )
-			continue;
-		*p = '\0';
-
-		++found_fs;
-
-		if( fstype ) {
-			strncpy( fstype, p2, MAX_FSTYPE_LEN - 1 );
-			fstype [ MAX_FSTYPE_LEN - 1 ] = '\0';
-		}
-	}
-
-	fclose(f);
-
-	DEBUG("mount_check_fs returning %d last %s", found_fs, fstype);
-
-	return found_fs;
-}
-
-/*
- * Locate a devtmpfs mount (should be on /dev) and create a container
- * subdirectory on it which we can then bind mount to the container
- * /dev instead of mounting a tmpfs there.
- * If we fail, return NULL.
- * Else return the pointer to the name buffer with the string to
- * the devtmpfs subdirectory.
+ * Just create a path for /dev under $lxcpath/$name and in rootfs
+ * If we hit an error, log it but don't fail yet.
  */
-
-static char *mk_devtmpfs(const char *name, char *path, const char *lxcpath)
+static int mount_autodev(const char *name, char *root, const char *lxcpath)
 {
 	int ret;
-	struct stat s;
-	char tmp_path[MAXPATHLEN];
-	char fstype[MAX_FSTYPE_LEN];
-	uint64_t hash;
-
-	if ( 0 != access(dev_base_path, F_OK) || 0 != stat(dev_base_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		/* This is just making /dev/.lxc it better work or we're done */
-		ret = mkdir(dev_base_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
-		if ( ret ) {
-			SYSERROR( "Unable to create /dev/.lxc for autodev" );
-			return NULL;
-		}
-	}
+	size_t clen;
+	char *path;
 
-	/*
-	 * Programmers notes:
-	 * 	We can not do mounts in this area of code that we want
-	 * 	to be visible in the host.  Consequently, /dev/.lxc must
-	 * 	be set up earlier if we need a tmpfs mounted there.
-	 * 	That only affects the rare cases where autodev is enabled
-	 * 	for a container and devtmpfs is not mounted on /dev in the
-	 * 	host.  In that case, we'll fall back to the old method
-	 * 	of mounting a tmpfs in the container and have no visibility
-	 * 	into the container /dev.
-	 */
-	if( ! mount_check_fs( "/dev", fstype )
-		|| strcmp( "devtmpfs", fstype ) ) {
-		/* Either /dev was not mounted or was not devtmpfs */
+	INFO("Mounting /dev under %s", root);
 
-		if ( ! mount_check_fs( "/dev/.lxc", NULL ) ) {
-			/*
-			 * /dev/.lxc is not already mounted
-			 * Doing a mount here does no good, since
-			 * it's not visible in the host.
-			 */
+	/* $(root) + "/dev/pts" + '\0' */
+	clen = strlen(root) + 9;
+	path = alloca(clen);
 
-			ERROR("/dev/.lxc is not setup - taking fallback" );
-			return NULL;
-		}
-	}
+	ret = snprintf(path, clen, "%s/dev", root);
+	if (ret < 0 || ret >= clen)
+		return -1;
 
-	if ( 0 != access(dev_user_path, F_OK) || 0 != stat(dev_user_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		/*
-		 * This is making /dev/.lxc/user path for non-priv users.
-		 * If this doesn't work, we'll have to fall back in the
-		 * case of non-priv users.  It's mode 1777 like /tmp.
-		 */
-		ret = mkdir(dev_user_path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
-		if ( ret ) {
-			/* Issue an error but don't fail yet! */
-			ERROR("Unable to create /dev/.lxc/user");
-		}
-		/* Umask tends to screw us up here */
-		chmod(dev_user_path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
+	if (!dir_exists(path)) {
+		WARN("No /dev on container rootfs.");
+		WARN("Proceeding without autodev setup");
+		return 0;
 	}
 
-	/*
-	 * Since the container name must be unique within a given
-	 * lxcpath, we're going to use a hash of the path
-	 * /lxcpath/name as our hash name in /dev/.lxc/
-	 */
-
-	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s", lxcpath, name);
-	if (ret < 0 || ret >= MAXPATHLEN)
-		return NULL;
-
-	hash = fnv_64a_buf(tmp_path, ret, FNV1A_64_INIT);
-
-	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_base_path, name, hash);
-	if (ret < 0 || ret >= MAXPATHLEN)
-		return NULL;
-
-	if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		ret = mkdir(tmp_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
-		if ( ret ) {
-			/* Something must have failed with the dev_base_path...
-			 * Maybe unpriv user.  Try dev_user_path now... */
-			INFO("Setup in /dev/.lxc failed.  Trying /dev/.lxc/user." );
-
-			ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_user_path, name, hash);
-			if (ret < 0 || ret >= MAXPATHLEN)
-				return NULL;
-
-			if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-				ret = mkdir(tmp_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
-				if ( ret ) {
-					ERROR("Container /dev setup in host /dev failed - taking fallback" );
-					return NULL;
-				}
-			}
-		}
+	if (mount("none", path, "tmpfs", 0, "size=100000,mode=755")) {
+		SYSERROR("Failed mounting tmpfs onto %s\n", path);
+		return false;
 	}
 
-	strcpy( path, tmp_path );
-	return path;
-}
-
-/*
- * Do we want to add options for max size of /dev and a file to
- * specify which devices to create?
- */
-static int mount_autodev(const char *name, char *root, const char *lxcpath)
-{
-	int ret;
-	struct stat s;
-	char path[MAXPATHLEN];
-	char host_path[MAXPATHLEN];
-	char devtmpfs_path[MAXPATHLEN];
-
-	INFO("Mounting /dev under %s", root);
-
-	ret = snprintf(host_path, MAXPATHLEN, "%s/%s/rootfs.dev", lxcpath, name);
-	if (ret < 0 || ret > MAXPATHLEN)
-		return -1;
+	INFO("Mounted tmpfs onto %s",  path);
 
-	ret = snprintf(path, MAXPATHLEN, "%s/dev", root);
-	if (ret < 0 || ret > MAXPATHLEN)
+	ret = snprintf(path, clen, "%s/dev/pts", root);
+	if (ret < 0 || ret >= clen)
 		return -1;
 
-	if (mk_devtmpfs( name, devtmpfs_path, lxcpath ) ) {
-		/*
-		 * Get rid of old links and directoriess
-		 * This could be either a symlink and we remove it,
-		 * or an empty directory and we remove it,
-		 * or non-existent and we don't care,
-		 * or a non-empty directory, and we will then emit an error
-		 * but we will not fail out the process.
-		 */
-		unlink( host_path );
-		rmdir( host_path );
-		ret = symlink(devtmpfs_path, host_path);
-
-		if ( ret < 0 ) {
-			SYSERROR("WARNING: Failed to create symlink '%s'->'%s'", host_path, devtmpfs_path);
-		}
-		DEBUG("Bind mounting %s to %s", devtmpfs_path , path );
-		ret = mount(devtmpfs_path, path, NULL, MS_BIND, 0 );
-	} else {
-		/* Only mount a tmpfs on here if we don't already a mount */
-		if ( ! mount_check_fs( host_path, NULL ) ) {
-			DEBUG("Mounting tmpfs to %s", host_path );
-			ret = mount("none", path, "tmpfs", 0, "size=100000,mode=755");
-		} else {
-			/* This allows someone to manually set up a mount */
-			DEBUG("Bind mounting %s to %s", host_path, path );
-			ret = mount(host_path , path, NULL, MS_BIND, 0 );
-		}
-	}
-	if (ret) {
-		SYSERROR("Failed to mount /dev at %s", root);
-		return -1;
-	}
-	ret = snprintf(path, MAXPATHLEN, "%s/dev/pts", root);
-	if (ret < 0 || ret >= MAXPATHLEN)
-		return -1;
 	/*
 	 * If we are running on a devtmpfs mapping, dev/pts may already exist.
 	 * If not, then create it and exit if that fails...
 	 */
-	if ( 0 != access(path, F_OK) || 0 != stat(path, &s) || 0 == S_ISDIR(s.st_mode) ) {
+	if (!dir_exists(path)) {
 		ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
 		if (ret) {
 			SYSERROR("Failed to create /dev/pts in container");
@@ -1395,64 +1189,6 @@ static int setup_autodev(const char *root)
 	return 0;
 }
 
-/*
- * Locate allocated devtmpfs mount and purge it.
- * path lookup mostly taken from mk_devtmpfs
- */
-int lxc_delete_autodev(struct lxc_handler *handler)
-{
-	int ret;
-	struct stat s;
-	struct lxc_conf *lxc_conf = handler->conf;
-	const char *name = handler->name;
-	const char *lxcpath = handler->lxcpath;
-	char tmp_path[MAXPATHLEN];
-	uint64_t hash;
-
-	if ( lxc_conf->autodev <= 0 )
-		return 0;
-
-	/* don't clean on reboot */
-	if ( lxc_conf->reboot == 1 )
-		return 0;
-
-	/*
-	 * Use the same logic as mk_devtmpfs to compute candidate
-	 * path for cleanup.
-	 */
-
-	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s", lxcpath, name);
-	if (ret < 0 || ret >= MAXPATHLEN)
-		return -1;
-
-	hash = fnv_64a_buf(tmp_path, ret, FNV1A_64_INIT);
-
-	/* Probe /dev/.lxc/<container name>.<hash> */
-	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_base_path, name, hash);
-	if (ret < 0 || ret >= MAXPATHLEN)
-		return -1;
-
-	if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-		/* Probe /dev/.lxc/user/<container name>.<hash> */
-		ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_user_path, name, hash);
-		if (ret < 0 || ret >= MAXPATHLEN)
-			return -1;
-
-		if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
-			WARN("Failed to locate autodev /dev/.lxc and /dev/.lxc/user." );
-			return -1;
-		}
-	}
-
-	/* Do the cleanup */
-	INFO("Cleaning %s", tmp_path );
-	if ( 0 != lxc_rmdir_onedev(tmp_path, NULL) ) {
-		ERROR("Failed to cleanup autodev" );
-	}
-
-	return 0;
-}
-
 static int setup_rootfs(struct lxc_conf *conf)
 {
 	const struct lxc_rootfs *rootfs = &conf->rootfs;
diff --git a/src/lxc/start.c b/src/lxc/start.c
index cd78665..98905a3 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -477,7 +477,6 @@ void lxc_fini(const char *name, struct lxc_handler *handler)
 
 	lxc_console_delete(&handler->conf->console);
 	lxc_delete_tty(&handler->conf->tty_info);
-	lxc_delete_autodev(handler);
 	close(handler->conf->maincmd_fd);
 	handler->conf->maincmd_fd = -1;
 	free(handler->name);
-- 
2.1.0


From serge.hallyn at ubuntu.com  Mon Jan 12 23:56:28 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 12 Jan 2015 23:56:28 +0000
Subject: [lxc-devel] [PATCH 2/2] fill_autodev: bind-mount if mknod fails (v3)
In-Reply-To: <20150112235436.GA14742@ubuntumail>
References: <20150112235436.GA14742@ubuntumail>
Message-ID: <20150112235628.GB14742@ubuntumail>

First, rename setup_autodev to fill_autodev, since all it
does is populate it, not fully set it up.

Secondly, if mknod of a device fails, then try bind-mounting
it from the host rather than failing immediately.

Note that this isn't an urgent patch because the common.userns
configuration hook already specifies bind,create=file mount
entries for all the devices we would want.

Changelog (v3): ignore if /dev doesn't exist

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/conf.c | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index dff5020..19efe72 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -1155,7 +1155,7 @@ static const struct lxc_devs lxc_devs[] = {
 	{ "console",	S_IFCHR | S_IRUSR | S_IWUSR,	       5, 1	},
 };
 
-static int setup_autodev(const char *root)
+static int fill_autodev(const char *root)
 {
 	int ret;
 	char path[MAXPATHLEN];
@@ -1170,6 +1170,9 @@ static int setup_autodev(const char *root)
 		return -1;
 	}
 
+	if (!dir_exists(path))  // ignore, just don't try to fill in
+		return 0;
+
 	INFO("Populating /dev under %s", root);
 	cmask = umask(S_IXUSR | S_IXGRP | S_IXOTH);
 	for (i = 0; i < sizeof(lxc_devs) / sizeof(lxc_devs[0]); i++) {
@@ -1179,8 +1182,25 @@ static int setup_autodev(const char *root)
 			return -1;
 		ret = mknod(path, d->mode, makedev(d->maj, d->min));
 		if (ret && errno != EEXIST) {
-			SYSERROR("Error creating %s", d->name);
-			return -1;
+			char hostpath[MAXPATHLEN];
+			FILE *pathfile;
+
+			// Unprivileged containers cannot create devices, so
+			// bind mount the device from the host
+			ret = snprintf(hostpath, MAXPATHLEN, "/dev/%s", d->name);
+			if (ret < 0 || ret >= MAXPATHLEN)
+				return -1;
+			pathfile = fopen(path, "wb");
+			if (!pathfile) {
+				SYSERROR("Failed to create device mount target '%s'", path);
+				return -1;
+			}
+			fclose(pathfile);
+			if (mount(hostpath, path, 0, MS_BIND, NULL) != 0) {
+				SYSERROR("Failed bind mounting device %s from host into container",
+					d->name);
+				return -1;
+			}
 		}
 	}
 	umask(cmask);
@@ -3847,7 +3867,7 @@ int lxc_setup(struct lxc_handler *handler)
 			ERROR("failed to run autodev hooks for container '%s'.", name);
 			return -1;
 		}
-		if (setup_autodev(lxc_conf->rootfs.mount)) {
+		if (fill_autodev(lxc_conf->rootfs.mount)) {
 			ERROR("failed to populate /dev in the container");
 			return -1;
 		}
-- 
2.1.0


From serge.hallyn at ubuntu.com  Tue Jan 13 00:00:51 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Tue, 13 Jan 2015 00:00:51 +0000
Subject: [lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the
 overlayfs workdir option
In-Reply-To: <20150112212517.GG24962@dakara>
References: <20150112204138.GU10641@ubuntumail> <20150112212517.GG24962@dakara>
Message-ID: <20150113000051.GC14742@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> On Mon, Jan 12, 2015 at 08:41:38PM +0000, Serge Hallyn wrote:
> > We fixed this some time ago for basic lxc-start, but never did
> > lxc-start-ephemeral.
> > 
> > Since the lxc-start patches were pushed, Miklos has given us a
> > way to detect whether we need the workdir= option.  So the
> > bdev.c code could be simplified to check for "overlay\n" in
> > /proc/filesystems just as lxc-start-ephemeral does.  This
> > patch doesn't do that.
> > 
> > Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> > ---
> >  src/lxc/lxc-start-ephemeral.in | 25 ++++++++++++++++++++++++-
> >  1 file changed, 24 insertions(+), 1 deletion(-)
> > 
> > diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
> > index c999e74..bf3f121 100644
> > --- a/src/lxc/lxc-start-ephemeral.in
> > +++ b/src/lxc/lxc-start-ephemeral.in
> > @@ -219,6 +219,14 @@ for entry in args.cdir:
> >          dst_path = "%s/rootfs/%s" % (dest_path, src_path)
> >          overlay_dirs += [(src_path, dst_path)]
> >  
> > +# do we have the new overlay fs which requires workdir, or the older
> > +# overlayfs which does not?
> > +have_new_overlay = False
> > +with open("/proc/filesystems", "r") as fd:
> > +    for line in fd.readlines():
> 
> "for line in fd" should be less memory hungry than reading the whole
> file, splitting it and storing the result in a list.
> 
> > +        if line == "nodev\toverlay\n":
> > +            have_new_overlay = True
> 
> Does that mean that we should also be mounting it as "overlay" rather
> than "overlayfs"?

Hm, good point.  'overlayfs' was working for me on ubuntu, but there
I also have two /proc/filesystems entries, one overlay and one overlayfs.
So yeah it should be changed.  That'll need to be fixed in bdev.c too then.

> >  # Generate pre-mount script
> >  with open(os.path.join(dest_path, "pre-mount"), "w+") as fd:
> >      os.fchmod(fd.fileno(), 0o755)
> > @@ -231,16 +239,31 @@ LXC_NAME="%s"
> >      count = 0
> >      for entry in overlay_dirs:
> >          target = "%s/delta%s" % (dest_path, count)
> > +        workdir = "%s/work%s" % (dest_path, count)
> >          fd.write("mkdir -p %s %s\n" % (target, entry[1]))
> > +        if have_new_overlay:
> > +            fd.write("mkdir -p %s\n" % workdir)
> >  
> >          if args.storage_type == "tmpfs":
> >              fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (target))
> > +            if have_new_overlay:
> > +                fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (workdir))
> >  
> >          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], target))
> >          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
> > +        if have_new_overlay:
> > +            fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], workdir))
> >  
> >          if args.union_type == "overlayfs":
> > -            fd.write("mount -n -t overlayfs"
> > +            if have_new_overlay:
> > +                fd.write("mount -n -t overlayfs"
> > +                     " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
> > +                         target,
> > +                         entry[0],
> > +                         workdir,
> > +                         entry[1]))
> > +            else:
> > +                fd.write("mount -n -t overlayfs"
> >                       " -oupperdir=%s,lowerdir=%s none %s\n" % (
> >                           target,
> >                           entry[0],
> > -- 
> > 2.1.0
> > 
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> 
> -- 
> Stéphane Graber
> Ubuntu developer
> http://www.ubuntu.com



> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From serge.hallyn at ubuntu.com  Tue Jan 13 00:08:37 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Tue, 13 Jan 2015 00:08:37 +0000
Subject: [lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the overlayfs
 workdir option (v2)
Message-ID: <20150113000837.GD14742@ubuntumail>

We fixed this some time ago for basic lxc-start, but never did
lxc-start-ephemeral.

Since the lxc-start patches were pushed, Miklos has given us a
way to detect whether we need the workdir= option.  So the
bdev.c code could be simplified to check for "overlay\n" in
/proc/filesystems just as lxc-start-ephemeral does.  This
patch doesn't do that.

Changelog (v2):
	1. use 'overlay' fstype for new overlay upstream module
	2. avoid using unneeded readlines().

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/lxc-start-ephemeral.in | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
index c999e74..36e2579 100644
--- a/src/lxc/lxc-start-ephemeral.in
+++ b/src/lxc/lxc-start-ephemeral.in
@@ -219,6 +219,14 @@ for entry in args.cdir:
         dst_path = "%s/rootfs/%s" % (dest_path, src_path)
         overlay_dirs += [(src_path, dst_path)]
 
+# do we have the new overlay fs which requires workdir, or the older
+# overlayfs which does not?
+have_new_overlay = False
+with open("/proc/filesystems", "r") as fd:
+    for line in fd:
+        if line == "nodev\toverlay\n":
+            have_new_overlay = True
+
 # Generate pre-mount script
 with open(os.path.join(dest_path, "pre-mount"), "w+") as fd:
     os.fchmod(fd.fileno(), 0o755)
@@ -231,16 +239,31 @@ LXC_NAME="%s"
     count = 0
     for entry in overlay_dirs:
         target = "%s/delta%s" % (dest_path, count)
+        workdir = "%s/work%s" % (dest_path, count)
         fd.write("mkdir -p %s %s\n" % (target, entry[1]))
+        if have_new_overlay:
+            fd.write("mkdir -p %s\n" % workdir)
 
         if args.storage_type == "tmpfs":
             fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (target))
+            if have_new_overlay:
+                fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (workdir))
 
         fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], target))
         fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
+        if have_new_overlay:
+            fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], workdir))
 
         if args.union_type == "overlayfs":
-            fd.write("mount -n -t overlayfs"
+            if have_new_overlay:
+                fd.write("mount -n -t overlay"
+                     " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
+                         target,
+                         entry[0],
+                         workdir,
+                         entry[1]))
+            else:
+                fd.write("mount -n -t overlayfs"
                      " -oupperdir=%s,lowerdir=%s none %s\n" % (
                          target,
                          entry[0],
-- 
2.1.0


From noreply at github.com  Tue Jan 13 04:25:13 2015
From: noreply at github.com (GitHub)
Date: Mon, 12 Jan 2015 20:25:13 -0800
Subject: [lxc-devel] [lxc/lxc] d2f31a: containertests: don't expect NULL
	lxc_conf
Message-ID: <54b49e29c61a0_1e783fe6f404b29c10857d@hookshot-fe4-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: d2f31a576b9364e8852d12642dfa11acb6197125
      https://github.com/lxc/lxc/commit/d2f31a576b9364e8852d12642dfa11acb6197125
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M src/tests/containertests.c

  Log Message:
  -----------
  containertests: don't expect NULL lxc_conf

Because we never have that any more

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>



From noreply at github.com  Tue Jan 13 05:12:06 2015
From: noreply at github.com (GitHub)
Date: Mon, 12 Jan 2015 21:12:06 -0800
Subject: [lxc-devel] [lxc/lxc] a2739d: Revert "set close-all-fds by default"
Message-ID: <54b4a92635756_3d793f88fa59d2c0530c6@hookshot-fe6-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: a2739df5e4da120daa7443f4de882a1a054b5316
      https://github.com/lxc/lxc/commit/a2739df5e4da120daa7443f4de882a1a054b5316
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M src/lxc/lxccontainer.c

  Log Message:
  -----------
  Revert "set close-all-fds by default"

it has unfortunate reprecussions elsewhere, and the needed fix
can be done another way

This reverts commit 1f76453a74f555e30384591567d87b5b4dac7e21.


  Commit: db2930e17441d39caaa61b52ecf4116504107a26
      https://github.com/lxc/lxc/commit/db2930e17441d39caaa61b52ecf4116504107a26
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-12 (Mon, 12 Jan 2015)

  Changed paths:
    M src/lxc/lxccontainer.c

  Log Message:
  -----------
  decide whether daemonize implies close_all_fds at start

This isn't the perfect fix.  In fact close_all_fds shouldn't be stored
in the lxc_conf.  But this will fix the tests short-term.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/d2f31a576b93...db2930e17441

From serge.hallyn at ubuntu.com  Tue Jan 13 06:02:26 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Tue, 13 Jan 2015 06:02:26 +0000
Subject: [lxc-devel] [PATCH 1/1] close-all-fds: fix behavior
Message-ID: <20150113060226.GE14742@ubuntumail>

We want to close all inherited fds in three cases - one, if a container
is daemonized.  Two, if the user specifies -C on the lxc-start command
line.  Three, in src/lxc/monitor.c.  The presence of -C is passed in the
lxc_conf may not always exist.

One call to lxc_check_inherited was being done from lxc_start(), which
doesn't know whether we are daemonized.  Move that call to its caller,
lxcapi_start(), which does know.

Pass an explicit closeall boolean as second argument to lxc_check_inherited.
If it is true, then all fds are closed.  If it is false, then we check
the lxc_conf->close_all_fds.

With this, all tests pass, and the logic appears correct.

Note that when -C is not true, then we only warn about inherited fds,
but we do not abort the container start.  This appears to have ben the case
since commit 92c7f6295518 in 2011.  Unfortunately the referenced URL with
the justification is no longer valid.  We may want to consider becoming
stricter about this again.  (Note that the commit did say "for now")

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/execute.c      |  2 +-
 src/lxc/lxccontainer.c | 11 +++++++++--
 src/lxc/monitor.c      |  2 +-
 src/lxc/start.c        | 19 ++++++++++++++-----
 src/lxc/start.h        |  3 ++-
 5 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/src/lxc/execute.c b/src/lxc/execute.c
index b78bcbf..a0f7ff1 100644
--- a/src/lxc/execute.c
+++ b/src/lxc/execute.c
@@ -118,7 +118,7 @@ int lxc_execute(const char *name, char *const argv[], int quiet,
 		.quiet = quiet
 	};
 
-	if (lxc_check_inherited(conf, -1))
+	if (lxc_check_inherited(conf, false, -1))
 		return -1;
 
 	conf->is_execute = 1;
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 0d36687..7ed8717 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -606,7 +606,6 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
 	* while container is running...
 	*/
 	if (daemonize) {
-		conf->close_all_fds = 1;
 		lxc_monitord_spawn(c->config_path);
 
 		pid_t pid = fork();
@@ -634,7 +633,7 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
 			SYSERROR("Error chdir()ing to /.");
 			return false;
 		}
-		lxc_check_inherited(conf, -1);
+		lxc_check_inherited(conf, true, -1);
 		close(0);
 		close(1);
 		close(2);
@@ -673,6 +672,13 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
 
 reboot:
 	conf->reboot = 0;
+
+	if (lxc_check_inherited(conf, daemonize, -1)) {
+		ERROR("Inherited fds found");
+		ret = 1;
+		goto out;
+	}
+
 	ret = lxc_start(c->name, argv, conf, c->config_path);
 	c->error_num = ret;
 
@@ -682,6 +688,7 @@ reboot:
 		goto reboot;
 	}
 
+out:
 	if (c->pidfile) {
 		unlink(c->pidfile);
 		free(c->pidfile);
diff --git a/src/lxc/monitor.c b/src/lxc/monitor.c
index f6d36a9..1e1c094 100644
--- a/src/lxc/monitor.c
+++ b/src/lxc/monitor.c
@@ -331,7 +331,7 @@ int lxc_monitord_spawn(const char *lxcpath)
 		SYSERROR("failed to setsid");
 		exit(EXIT_FAILURE);
 	}
-	lxc_check_inherited(NULL, pipefd[1]);
+	lxc_check_inherited(NULL, true, pipefd[1]);
 	close(0);
 	close(1);
 	close(2);
diff --git a/src/lxc/start.c b/src/lxc/start.c
index cd78665..f9bff51 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -170,12 +170,24 @@ static int match_fd(int fd)
 	return (fd == 0 || fd == 1 || fd == 2);
 }
 
-int lxc_check_inherited(struct lxc_conf *conf, int fd_to_ignore)
+/*
+ * Check for any fds we need to close
+ * * if fd_to_ignore != -1, then if we find that fd open we will ignore it.
+ * * By default we warn about open fds we find.
+ * * If closeall is true, we will close open fds.
+ * * If lxc-start was passed "-C", then conf->close_all_fds will be true,
+ *     in which case we also close all open fds.
+ * * A daemonized container will always pass closeall=true.
+ */
+int lxc_check_inherited(struct lxc_conf *conf, bool closeall, int fd_to_ignore)
 {
 	struct dirent dirent, *direntp;
 	int fd, fddir;
 	DIR *dir;
 
+	if (conf && conf->close_all_fds)
+		closeall = true;
+
 restart:
 	dir = opendir("/proc/self/fd");
 	if (!dir) {
@@ -203,7 +215,7 @@ restart:
 		if (match_fd(fd))
 			continue;
 
-		if (conf == NULL || conf->close_all_fds) {
+		if (closeall) {
 			close(fd);
 			closedir(dir);
 			INFO("closed inherited fd %d", fd);
@@ -1187,9 +1199,6 @@ int lxc_start(const char *name, char *const argv[], struct lxc_conf *conf,
 		.argv = argv,
 	};
 
-	if (lxc_check_inherited(conf, -1))
-		return -1;
-
 	conf->need_utmp_watch = 1;
 	return __lxc_start(name, conf, &start_ops, &start_arg, lxcpath);
 }
diff --git a/src/lxc/start.h b/src/lxc/start.h
index 7c75b16..d39b3b4 100644
--- a/src/lxc/start.h
+++ b/src/lxc/start.h
@@ -25,6 +25,7 @@
 
 #include <signal.h>
 #include <sys/param.h>
+#include <stdbool.h>
 
 #include "config.h"
 #include "state.h"
@@ -81,7 +82,7 @@ extern void lxc_abort(const char *name, struct lxc_handler *handler);
 extern struct lxc_handler *lxc_init(const char *name, struct lxc_conf *, const char *);
 extern void lxc_fini(const char *name, struct lxc_handler *handler);
 
-extern int lxc_check_inherited(struct lxc_conf *conf, int fd_to_ignore);
+extern int lxc_check_inherited(struct lxc_conf *conf, bool closeall, int fd_to_ignore);
 int __lxc_start(const char *, struct lxc_conf *, struct lxc_operations *,
 		void *, const char *);
 
-- 
2.1.3


From karma at jazz.email.ne.jp  Tue Jan 13 08:23:29 2015
From: karma at jazz.email.ne.jp (KATOH Yasufumi)
Date: Tue, 13 Jan 2015 17:23:29 +0900
Subject: [lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the
	overlayfs workdir option (v2)
In-Reply-To: <20150113000837.GD14742@ubuntumail>
References: <20150113000837.GD14742@ubuntumail>
Message-ID: <87ppajm6m6.wl%karma@jazz.email.ne.jp>

Hi,

I tested on kernel 3.18.1 with your patch. It works fine, but there is
one problem.

>>> On Tue, 13 Jan 2015 00:08:37 +0000
    in message   "[lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the overlayfs workdir option (v2)"
                  Serge Hallyn-san wrote:

> We fixed this some time ago for basic lxc-start, but never did
> lxc-start-ephemeral.

> Since the lxc-start patches were pushed, Miklos has given us a
> way to detect whether we need the workdir= option.  So the
> bdev.c code could be simplified to check for "overlay\n" in
> /proc/filesystems just as lxc-start-ephemeral does.  This
> patch doesn't do that.



> Changelog (v2):
> 	1. use 'overlay' fstype for new overlay upstream module
> 	2. avoid using unneeded readlines().

> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> ---
>  src/lxc/lxc-start-ephemeral.in | 25 ++++++++++++++++++++++++-
>  1 file changed, 24 insertions(+), 1 deletion(-)

> diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
> index c999e74..36e2579 100644
> --- a/src/lxc/lxc-start-ephemeral.in
> +++ b/src/lxc/lxc-start-ephemeral.in
> @@ -219,6 +219,14 @@ for entry in args.cdir:
>          dst_path = "%s/rootfs/%s" % (dest_path, src_path)
>          overlay_dirs += [(src_path, dst_path)]
 
> +# do we have the new overlay fs which requires workdir, or the older
> +# overlayfs which does not?
> +have_new_overlay = False
> +with open("/proc/filesystems", "r") as fd:
> +    for line in fd:
> +        if line == "nodev\toverlay\n":
> +            have_new_overlay = True

When the overlayfs is module, and the module is not loaded at this
moment, "have_new_overlay" is False and the mount will fail.

We need to load the overlayfs module before the check.

> +
>  # Generate pre-mount script
>  with open(os.path.join(dest_path, "pre-mount"), "w+") as fd:
>      os.fchmod(fd.fileno(), 0o755)
> @@ -231,16 +239,31 @@ LXC_NAME="%s"
>      count = 0
>      for entry in overlay_dirs:
>          target = "%s/delta%s" % (dest_path, count)
> +        workdir = "%s/work%s" % (dest_path, count)
>          fd.write("mkdir -p %s %s\n" % (target, entry[1]))
> +        if have_new_overlay:
> +            fd.write("mkdir -p %s\n" % workdir)
 
>          if args.storage_type == "tmpfs":
>              fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (target))
> +            if have_new_overlay:
> +                fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (workdir))
 
>          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], target))
>          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
> +        if have_new_overlay:
> +            fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], workdir))
 
>          if args.union_type == "overlayfs":
> -            fd.write("mount -n -t overlayfs"
> +            if have_new_overlay:
> +                fd.write("mount -n -t overlay"
> +                     " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
> +                         target,
> +                         entry[0],
> +                         workdir,
> +                         entry[1]))
> +            else:
> +                fd.write("mount -n -t overlayfs"
>                       " -oupperdir=%s,lowerdir=%s none %s\n" % (
>                           target,
>                           entry[0],
> -- 
> 2.1.0

> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Tue Jan 13 14:42:24 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Tue, 13 Jan 2015 14:42:24 +0000
Subject: [lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the
 overlayfs workdir option (v2)
In-Reply-To: <87ppajm6m6.wl%karma@jazz.email.ne.jp>
References: <20150113000837.GD14742@ubuntumail>
 <87ppajm6m6.wl%karma@jazz.email.ne.jp>
Message-ID: <20150113144224.GC15152@ubuntumail>

Quoting KATOH Yasufumi (karma at jazz.email.ne.jp):
> Hi,
> 
> I tested on kernel 3.18.1 with your patch. It works fine, but there is
> one problem.
> 
> >>> On Tue, 13 Jan 2015 00:08:37 +0000
>     in message   "[lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the overlayfs workdir option (v2)"
>                   Serge Hallyn-san wrote:
> 
> > We fixed this some time ago for basic lxc-start, but never did
> > lxc-start-ephemeral.
> 
> > Since the lxc-start patches were pushed, Miklos has given us a
> > way to detect whether we need the workdir= option.  So the
> > bdev.c code could be simplified to check for "overlay\n" in
> > /proc/filesystems just as lxc-start-ephemeral does.  This
> > patch doesn't do that.
> 
> 
> 
> > Changelog (v2):
> > 	1. use 'overlay' fstype for new overlay upstream module
> > 	2. avoid using unneeded readlines().
> 
> > Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> > ---
> >  src/lxc/lxc-start-ephemeral.in | 25 ++++++++++++++++++++++++-
> >  1 file changed, 24 insertions(+), 1 deletion(-)
> 
> > diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
> > index c999e74..36e2579 100644
> > --- a/src/lxc/lxc-start-ephemeral.in
> > +++ b/src/lxc/lxc-start-ephemeral.in
> > @@ -219,6 +219,14 @@ for entry in args.cdir:
> >          dst_path = "%s/rootfs/%s" % (dest_path, src_path)
> >          overlay_dirs += [(src_path, dst_path)]
>  
> > +# do we have the new overlay fs which requires workdir, or the older
> > +# overlayfs which does not?
> > +have_new_overlay = False
> > +with open("/proc/filesystems", "r") as fd:
> > +    for line in fd:
> > +        if line == "nodev\toverlay\n":
> > +            have_new_overlay = True
> 
> When the overlayfs is module, and the module is not loaded at this
> moment, "have_new_overlay" is False and the mount will fail.
> 
> We need to load the overlayfs module before the check.

Yeah I thought of that when I started, then I guess ended up
ignoring it.  What would be the cleanest way to do this in
python?  Stéphane?

> > +
> >  # Generate pre-mount script
> >  with open(os.path.join(dest_path, "pre-mount"), "w+") as fd:
> >      os.fchmod(fd.fileno(), 0o755)
> > @@ -231,16 +239,31 @@ LXC_NAME="%s"
> >      count = 0
> >      for entry in overlay_dirs:
> >          target = "%s/delta%s" % (dest_path, count)
> > +        workdir = "%s/work%s" % (dest_path, count)
> >          fd.write("mkdir -p %s %s\n" % (target, entry[1]))
> > +        if have_new_overlay:
> > +            fd.write("mkdir -p %s\n" % workdir)
>  
> >          if args.storage_type == "tmpfs":
> >              fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (target))
> > +            if have_new_overlay:
> > +                fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (workdir))
>  
> >          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], target))
> >          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
> > +        if have_new_overlay:
> > +            fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], workdir))
>  
> >          if args.union_type == "overlayfs":
> > -            fd.write("mount -n -t overlayfs"
> > +            if have_new_overlay:
> > +                fd.write("mount -n -t overlay"
> > +                     " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
> > +                         target,
> > +                         entry[0],
> > +                         workdir,
> > +                         entry[1]))
> > +            else:
> > +                fd.write("mount -n -t overlayfs"
> >                       " -oupperdir=%s,lowerdir=%s none %s\n" % (
> >                           target,
> >                           entry[0],
> > -- 
> > 2.1.0
> 
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Tue Jan 13 14:49:22 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Tue, 13 Jan 2015 14:49:22 +0000
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150110172826.GE8528@obnox.de>
References: <20150108100516.GK2958@obnox.de> <20150108101652.GL2958@obnox.de>
 <20150110040505.GJ10641@ubuntumail>
 <20150110121836.GC8528@obnox.de>
 <20150110155918.GL10641@ubuntumail>
 <20150110172826.GE8528@obnox.de>
Message-ID: <20150113144922.GF15152@ubuntumail>

Quoting Michael Adam (obnox at samba.org):
> On 2015-01-10 at 15:59 +0000, Serge Hallyn wrote:
> > Quoting Michael Adam (obnox at samba.org):
> > > On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
> > > > 
> > > > Actually a patch to remove '-p|--path' from the
> > > > help statement in all other templates would be appreciated.
> > > 
> > > Ok, I was just about to send such an add-on patchset,
> > > but first one more thought:
> > > 
> > > Doesn't the same apply to the -n|--name parameter?
> > > 
> > > And what about the --rootfs switch that some
> > > of the templates (like archlinux) take?
> > 
> > Yup, good point, I think it does.
> 
> So then, there are two different approaches:
> 
> 1) document all options for the sake of completeness,
>    marking some of them as "intended for internal use only"
> 
> 2) hide those internal options from the usage text.
> 
> I am personally not 100% certain what I would favour, but
> slightly inclining towards option 1.
> 
> I am happy to do patches for either variant, but will
> wait for more comments on that first.

Does anyone else have any opinion?

I guess I'd favor having them show up at the bottom of the
template's usage() statement, prefaced by

For internal use only (do not pass to lxc-create):

From stgraber at ubuntu.com  Tue Jan 13 14:51:23 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Tue, 13 Jan 2015 09:51:23 -0500
Subject: [lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the
 overlayfs workdir option (v2)
In-Reply-To: <20150113144224.GC15152@ubuntumail>
References: <20150113000837.GD14742@ubuntumail>
 <87ppajm6m6.wl%karma@jazz.email.ne.jp>
 <20150113144224.GC15152@ubuntumail>
Message-ID: <20150113145123.GK24962@dakara>

On Tue, Jan 13, 2015 at 02:42:24PM +0000, Serge Hallyn wrote:
> Quoting KATOH Yasufumi (karma at jazz.email.ne.jp):
> > Hi,
> > 
> > I tested on kernel 3.18.1 with your patch. It works fine, but there is
> > one problem.
> > 
> > >>> On Tue, 13 Jan 2015 00:08:37 +0000
> >     in message   "[lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the overlayfs workdir option (v2)"
> >                   Serge Hallyn-san wrote:
> > 
> > > We fixed this some time ago for basic lxc-start, but never did
> > > lxc-start-ephemeral.
> > 
> > > Since the lxc-start patches were pushed, Miklos has given us a
> > > way to detect whether we need the workdir= option.  So the
> > > bdev.c code could be simplified to check for "overlay\n" in
> > > /proc/filesystems just as lxc-start-ephemeral does.  This
> > > patch doesn't do that.
> > 
> > 
> > 
> > > Changelog (v2):
> > > 	1. use 'overlay' fstype for new overlay upstream module
> > > 	2. avoid using unneeded readlines().
> > 
> > > Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> > > ---
> > >  src/lxc/lxc-start-ephemeral.in | 25 ++++++++++++++++++++++++-
> > >  1 file changed, 24 insertions(+), 1 deletion(-)
> > 
> > > diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
> > > index c999e74..36e2579 100644
> > > --- a/src/lxc/lxc-start-ephemeral.in
> > > +++ b/src/lxc/lxc-start-ephemeral.in
> > > @@ -219,6 +219,14 @@ for entry in args.cdir:
> > >          dst_path = "%s/rootfs/%s" % (dest_path, src_path)
> > >          overlay_dirs += [(src_path, dst_path)]
> >  
> > > +# do we have the new overlay fs which requires workdir, or the older
> > > +# overlayfs which does not?
> > > +have_new_overlay = False
> > > +with open("/proc/filesystems", "r") as fd:
> > > +    for line in fd:
> > > +        if line == "nodev\toverlay\n":
> > > +            have_new_overlay = True
> > 
> > When the overlayfs is module, and the module is not loaded at this
> > moment, "have_new_overlay" is False and the mount will fail.
> > 
> > We need to load the overlayfs module before the check.
> 
> Yeah I thought of that when I started, then I guess ended up
> ignoring it.  What would be the cleanest way to do this in
> python?  Stéphane?

if os.geteuid() == 0:
    with open(os.devnull, "w") as devnull:
        subprocess.call(["modprobe", "overlay"], stdout=devnull, stderr=devnull)
        subprocess.call(["modprobe", "overlayfs"], stdout=devnull, stderr=devnull)

That's about as clean as I can think of. That's also entirely ignoring
any failure since we may be euid 0 and have those built into the kernel
or not present at all or not have cap_sys_module or be in a uid mapped
namespace, all of which would cause a failure.

> 
> > > +
> > >  # Generate pre-mount script
> > >  with open(os.path.join(dest_path, "pre-mount"), "w+") as fd:
> > >      os.fchmod(fd.fileno(), 0o755)
> > > @@ -231,16 +239,31 @@ LXC_NAME="%s"
> > >      count = 0
> > >      for entry in overlay_dirs:
> > >          target = "%s/delta%s" % (dest_path, count)
> > > +        workdir = "%s/work%s" % (dest_path, count)
> > >          fd.write("mkdir -p %s %s\n" % (target, entry[1]))
> > > +        if have_new_overlay:
> > > +            fd.write("mkdir -p %s\n" % workdir)
> >  
> > >          if args.storage_type == "tmpfs":
> > >              fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (target))
> > > +            if have_new_overlay:
> > > +                fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (workdir))
> >  
> > >          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], target))
> > >          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
> > > +        if have_new_overlay:
> > > +            fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], workdir))
> >  
> > >          if args.union_type == "overlayfs":
> > > -            fd.write("mount -n -t overlayfs"
> > > +            if have_new_overlay:
> > > +                fd.write("mount -n -t overlay"
> > > +                     " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
> > > +                         target,
> > > +                         entry[0],
> > > +                         workdir,
> > > +                         entry[1]))
> > > +            else:
> > > +                fd.write("mount -n -t overlayfs"
> > >                       " -oupperdir=%s,lowerdir=%s none %s\n" % (
> > >                           target,
> > >                           entry[0],
> > > -- 
> > > 2.1.0
> > 
> > > _______________________________________________
> > > lxc-devel mailing list
> > > lxc-devel at lists.linuxcontainers.org
> > > http://lists.linuxcontainers.org/listinfo/lxc-devel
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150113/d2d630fe/attachment.sig>

From stgraber at ubuntu.com  Tue Jan 13 14:53:28 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Tue, 13 Jan 2015 09:53:28 -0500
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150113144922.GF15152@ubuntumail>
References: <20150108100516.GK2958@obnox.de> <20150108101652.GL2958@obnox.de>
 <20150110040505.GJ10641@ubuntumail>
 <20150110121836.GC8528@obnox.de>
 <20150110155918.GL10641@ubuntumail>
 <20150110172826.GE8528@obnox.de>
 <20150113144922.GF15152@ubuntumail>
Message-ID: <20150113145328.GL24962@dakara>

On Tue, Jan 13, 2015 at 02:49:22PM +0000, Serge Hallyn wrote:
> Quoting Michael Adam (obnox at samba.org):
> > On 2015-01-10 at 15:59 +0000, Serge Hallyn wrote:
> > > Quoting Michael Adam (obnox at samba.org):
> > > > On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
> > > > > 
> > > > > Actually a patch to remove '-p|--path' from the
> > > > > help statement in all other templates would be appreciated.
> > > > 
> > > > Ok, I was just about to send such an add-on patchset,
> > > > but first one more thought:
> > > > 
> > > > Doesn't the same apply to the -n|--name parameter?
> > > > 
> > > > And what about the --rootfs switch that some
> > > > of the templates (like archlinux) take?
> > > 
> > > Yup, good point, I think it does.
> > 
> > So then, there are two different approaches:
> > 
> > 1) document all options for the sake of completeness,
> >    marking some of them as "intended for internal use only"
> > 
> > 2) hide those internal options from the usage text.
> > 
> > I am personally not 100% certain what I would favour, but
> > slightly inclining towards option 1.
> > 
> > I am happy to do patches for either variant, but will
> > wait for more comments on that first.
> 
> Does anyone else have any opinion?
> 
> I guess I'd favor having them show up at the bottom of the
> template's usage() statement, prefaced by
> 
> For internal use only (do not pass to lxc-create):

When I wrote the download template, I added them to the usage but in a
separate section:

"""
LXC internal arguments (do not pass manually!):
[ --name <name> ]: The container name
[ --path <path> ]: The path to the container
[ --rootfs <rootfs> ]: The path to the container's rootfs
[ --mapped-uid <map> ]: A uid map (user namespaces)
[ --mapped-gid <map> ]: A gid map (user namespaces)
"""

Complete download template usage is:

"""
LXC container image downloader

Required arguments:
[ -d | --dist <distribution> ]: The name of the distribution
[ -r | --release <release> ]: Release name/version
[ -a | --arch <architecture> ]: Architecture of the container

Optional arguments:
[ -h | --help ]: This help message
[ -l | --list ]: List all available images
[ --variant <variant> ]: Variant of the image (default: "default")
[ --server <server> ]: Image server (default: "images.linuxcontainers.org")
[ --keyid <keyid> ]: GPG keyid (default: 0x...)
[ --keyserver <keyserver> ]: GPG keyserver to use
[ --no-validate ]: Disable GPG validation (not recommended)
[ --flush-cache ]: Flush the local copy (if present)
[ --force-cache ]; Force the use of the local copy even if expired

LXC internal arguments (do not pass manually!):
[ --name <name> ]: The container name
[ --path <path> ]: The path to the container
[ --rootfs <rootfs> ]: The path to the container's rootfs
[ --mapped-uid <map> ]: A uid map (user namespaces)
[ --mapped-gid <map> ]: A gid map (user namespaces)
"""

Maybe something like that would work for the other templates too?

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150113/2e244d84/attachment.sig>

From adam.ryczkowski at statystyka.net  Tue Jan 13 14:57:32 2015
From: adam.ryczkowski at statystyka.net (Adam Ryczkowski)
Date: Tue, 13 Jan 2015 15:57:32 +0100
Subject: [lxc-devel] What environment variables are needed to run
	unprivileged lxc-start?
Message-ID: <54B5325C.1050803@statystyka.net>

I want to write a Puppet manifest for managing unprivileged lxc 
containers on Ubuntu. Puppet by default strips all environment variables 
when calls external programs, such as lxc-start.
Does anyone knows, what environment variables are needed to run lxc 
container (apart from $HOME, which is needed for lxc-create)?


Adam


From serge.hallyn at ubuntu.com  Tue Jan 13 17:15:16 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Tue, 13 Jan 2015 17:15:16 +0000
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150113145328.GL24962@dakara>
References: <20150108100516.GK2958@obnox.de> <20150108101652.GL2958@obnox.de>
 <20150110040505.GJ10641@ubuntumail>
 <20150110121836.GC8528@obnox.de>
 <20150110155918.GL10641@ubuntumail>
 <20150110172826.GE8528@obnox.de>
 <20150113144922.GF15152@ubuntumail> <20150113145328.GL24962@dakara>
Message-ID: <20150113171516.GB15944@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> On Tue, Jan 13, 2015 at 02:49:22PM +0000, Serge Hallyn wrote:
> > Quoting Michael Adam (obnox at samba.org):
> > > On 2015-01-10 at 15:59 +0000, Serge Hallyn wrote:
> > > > Quoting Michael Adam (obnox at samba.org):
> > > > > On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
> > > > > > 
> > > > > > Actually a patch to remove '-p|--path' from the
> > > > > > help statement in all other templates would be appreciated.
> > > > > 
> > > > > Ok, I was just about to send such an add-on patchset,
> > > > > but first one more thought:
> > > > > 
> > > > > Doesn't the same apply to the -n|--name parameter?
> > > > > 
> > > > > And what about the --rootfs switch that some
> > > > > of the templates (like archlinux) take?
> > > > 
> > > > Yup, good point, I think it does.
> > > 
> > > So then, there are two different approaches:
> > > 
> > > 1) document all options for the sake of completeness,
> > >    marking some of them as "intended for internal use only"
> > > 
> > > 2) hide those internal options from the usage text.
> > > 
> > > I am personally not 100% certain what I would favour, but
> > > slightly inclining towards option 1.
> > > 
> > > I am happy to do patches for either variant, but will
> > > wait for more comments on that first.
> > 
> > Does anyone else have any opinion?
> > 
> > I guess I'd favor having them show up at the bottom of the
> > template's usage() statement, prefaced by
> > 
> > For internal use only (do not pass to lxc-create):
> 
> When I wrote the download template, I added them to the usage but in a
> separate section:
> 
> """
> LXC internal arguments (do not pass manually!):
> [ --name <name> ]: The container name
> [ --path <path> ]: The path to the container
> [ --rootfs <rootfs> ]: The path to the container's rootfs
> [ --mapped-uid <map> ]: A uid map (user namespaces)
> [ --mapped-gid <map> ]: A gid map (user namespaces)
> """
> 
> Complete download template usage is:
> 
> """
> LXC container image downloader
> 
> Required arguments:
> [ -d | --dist <distribution> ]: The name of the distribution
> [ -r | --release <release> ]: Release name/version
> [ -a | --arch <architecture> ]: Architecture of the container
> 
> Optional arguments:
> [ -h | --help ]: This help message
> [ -l | --list ]: List all available images
> [ --variant <variant> ]: Variant of the image (default: "default")
> [ --server <server> ]: Image server (default: "images.linuxcontainers.org")
> [ --keyid <keyid> ]: GPG keyid (default: 0x...)
> [ --keyserver <keyserver> ]: GPG keyserver to use
> [ --no-validate ]: Disable GPG validation (not recommended)
> [ --flush-cache ]: Flush the local copy (if present)
> [ --force-cache ]; Force the use of the local copy even if expired
> 
> LXC internal arguments (do not pass manually!):
> [ --name <name> ]: The container name
> [ --path <path> ]: The path to the container
> [ --rootfs <rootfs> ]: The path to the container's rootfs
> [ --mapped-uid <map> ]: A uid map (user namespaces)
> [ --mapped-gid <map> ]: A gid map (user namespaces)
> """
> 
> Maybe something like that would work for the other templates too?

That looks good.

We also could put those in a function in a
/usr/share/lxc/templates/helpers file

From serge.hallyn at ubuntu.com  Tue Jan 13 17:16:12 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Tue, 13 Jan 2015 17:16:12 +0000
Subject: [lxc-devel] What environment variables are needed to run
 unprivileged lxc-start?
In-Reply-To: <54B5325C.1050803@statystyka.net>
References: <54B5325C.1050803@statystyka.net>
Message-ID: <20150113171612.GC15944@ubuntumail>

Quoting Adam Ryczkowski (adam.ryczkowski at statystyka.net):
> I want to write a Puppet manifest for managing unprivileged lxc
> containers on Ubuntu. Puppet by default strips all environment
> variables when calls external programs, such as lxc-start.
> Does anyone knows, what environment variables are needed to run lxc
> container (apart from $HOME, which is needed for lxc-create)?

Probably looking at src/tests/lxc-test-unpriv should give you
an idea as it has to do basically that.

From dwight.engen at oracle.com  Tue Jan 13 17:18:11 2015
From: dwight.engen at oracle.com (Dwight Engen)
Date: Tue, 13 Jan 2015 12:18:11 -0500
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150113145328.GL24962@dakara>
References: <20150108100516.GK2958@obnox.de> <20150108101652.GL2958@obnox.de>
 <20150110040505.GJ10641@ubuntumail>
 <20150110121836.GC8528@obnox.de>
 <20150110155918.GL10641@ubuntumail>
 <20150110172826.GE8528@obnox.de>
 <20150113144922.GF15152@ubuntumail> <20150113145328.GL24962@dakara>
Message-ID: <20150113121811.00db25d9@Delphi.home>

On Tue, 13 Jan 2015 09:53:28 -0500
Stéphane Graber <stgraber at ubuntu.com> wrote:

> On Tue, Jan 13, 2015 at 02:49:22PM +0000, Serge Hallyn wrote:
> > Quoting Michael Adam (obnox at samba.org):
> > > On 2015-01-10 at 15:59 +0000, Serge Hallyn wrote:
> > > > Quoting Michael Adam (obnox at samba.org):
> > > > > On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
> > > > > > 
> > > > > > Actually a patch to remove '-p|--path' from the
> > > > > > help statement in all other templates would be appreciated.
> > > > > 
> > > > > Ok, I was just about to send such an add-on patchset,
> > > > > but first one more thought:
> > > > > 
> > > > > Doesn't the same apply to the -n|--name parameter?
> > > > > 
> > > > > And what about the --rootfs switch that some
> > > > > of the templates (like archlinux) take?
> > > > 
> > > > Yup, good point, I think it does.
> > > 
> > > So then, there are two different approaches:
> > > 
> > > 1) document all options for the sake of completeness,
> > >    marking some of them as "intended for internal use only"
> > > 
> > > 2) hide those internal options from the usage text.
> > > 
> > > I am personally not 100% certain what I would favour, but
> > > slightly inclining towards option 1.
> > > 
> > > I am happy to do patches for either variant, but will
> > > wait for more comments on that first.
> > 
> > Does anyone else have any opinion?
> > 
> > I guess I'd favor having them show up at the bottom of the
> > template's usage() statement, prefaced by
> > 
> > For internal use only (do not pass to lxc-create):
> 
> When I wrote the download template, I added them to the usage but in a
> separate section:
> 
> """
> LXC internal arguments (do not pass manually!):
> [ --name <name> ]: The container name
> [ --path <path> ]: The path to the container
> [ --rootfs <rootfs> ]: The path to the container's rootfs
> [ --mapped-uid <map> ]: A uid map (user namespaces)
> [ --mapped-gid <map> ]: A gid map (user namespaces)
> """
> 
> Complete download template usage is:
> 
> """
> LXC container image downloader
> 
> Required arguments:
> [ -d | --dist <distribution> ]: The name of the distribution
> [ -r | --release <release> ]: Release name/version
> [ -a | --arch <architecture> ]: Architecture of the container
> 
> Optional arguments:
> [ -h | --help ]: This help message
> [ -l | --list ]: List all available images
> [ --variant <variant> ]: Variant of the image (default: "default")
> [ --server <server> ]: Image server (default:
> "images.linuxcontainers.org") [ --keyid <keyid> ]: GPG keyid
> (default: 0x...) [ --keyserver <keyserver> ]: GPG keyserver to use
> [ --no-validate ]: Disable GPG validation (not recommended)
> [ --flush-cache ]: Flush the local copy (if present)
> [ --force-cache ]; Force the use of the local copy even if expired
> 
> LXC internal arguments (do not pass manually!):
> [ --name <name> ]: The container name
> [ --path <path> ]: The path to the container
> [ --rootfs <rootfs> ]: The path to the container's rootfs
> [ --mapped-uid <map> ]: A uid map (user namespaces)
> [ --mapped-gid <map> ]: A gid map (user namespaces)
> """
> 
> Maybe something like that would work for the other templates too?

+1

From serge.hallyn at ubuntu.com  Tue Jan 13 18:07:23 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Tue, 13 Jan 2015 18:07:23 +0000
Subject: [lxc-devel] What environment variables are needed to run
 unprivileged lxc-start?
In-Reply-To: <20150113171612.GC15944@ubuntumail>
References: <54B5325C.1050803@statystyka.net>
 <20150113171612.GC15944@ubuntumail>
Message-ID: <20150113180723.GD15944@ubuntumail>

Quoting Serge Hallyn (serge.hallyn at ubuntu.com):
> Quoting Adam Ryczkowski (adam.ryczkowski at statystyka.net):
> > I want to write a Puppet manifest for managing unprivileged lxc
> > containers on Ubuntu. Puppet by default strips all environment
> > variables when calls external programs, such as lxc-start.
> > Does anyone knows, what environment variables are needed to run lxc
> > container (apart from $HOME, which is needed for lxc-create)?
> 
> Probably looking at src/tests/lxc-test-unpriv should give you
> an idea as it has to do basically that.

It'd probably be worth adding that list to the lxc-start manpage.
Seems like it may be only XDG_RUNTIME_DIR and HOME.

From obnox at samba.org  Tue Jan 13 21:27:08 2015
From: obnox at samba.org (Michael Adam)
Date: Tue, 13 Jan 2015 22:27:08 +0100
Subject: [lxc-devel] [PATCH] clarify explanation of veth
Message-ID: <20150113212708.GA2519@obnox.de>

Hi,

This find a patch that (for me) clarifies
the explanation of the veth network type in
the lxc.container.conf manpage.

Cheers - Michael


From a188f5b5c603e62237066eaad17bc35f73a46e32 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Tue, 13 Jan 2015 22:24:07 +0100
Subject: [PATCH] doc: clarify the description of the veth network type in the
 manpage.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 doc/lxc.container.conf.sgml.in | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/doc/lxc.container.conf.sgml.in b/doc/lxc.container.conf.sgml.in
index 6d4daac..8652373 100644
--- a/doc/lxc.container.conf.sgml.in
+++ b/doc/lxc.container.conf.sgml.in
@@ -267,20 +267,20 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
             </para>
 
             <para>
-              <option>veth:</option> a peer network device is created
-              with one side assigned to the container and the other
-              side is attached to a bridge specified by
-              the <option>lxc.network.link</option>. If the bridge is
-              not specified, then the veth pair device will be created
-              but not attached to any bridge. Otherwise, the bridge
-              has to be setup before on the
-              system, <command>lxc</command> won't handle any
-              configuration outside of the container.  By
-              default <command>lxc</command> choose a name for the
+              <option>veth:</option> a virtual ethernet pair
+              device is created with one side assigned to the container
+              and the other side attached to a bridge specified by
+              the <option>lxc.network.link</option> option.
+              If the bridge is not specified, then the veth pair device
+              will be created but not attached to any bridge.
+              Otherwise, the bridge has to be created on the system
+              before starting the container.
+              <command>lxc</command> won't handle any
+              configuration outside of the container.
+              By default, <command>lxc</command> chooses a name for the
               network device belonging to the outside of the
-              container, this name is handled
-              by <command>lxc</command>, but if you wish to handle
-              this name yourself, you can tell <command>lxc</command>
+              container, but if you wish to handle
+              this name yourselves, you can tell <command>lxc</command>
               to set a specific name with
               the <option>lxc.network.veth.pair</option> option (except for
               unprivileged containers where this option is ignored for security
-- 
2.1.0

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150113/4572734f/attachment.sig>

From obnox at samba.org  Tue Jan 13 21:31:29 2015
From: obnox at samba.org (Michael Adam)
Date: Tue, 13 Jan 2015 22:31:29 +0100
Subject: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora,
 plus some template script fixes
In-Reply-To: <20150113171516.GB15944@ubuntumail>
References: <20150108100516.GK2958@obnox.de> <20150108101652.GL2958@obnox.de>
 <20150110040505.GJ10641@ubuntumail>
 <20150110121836.GC8528@obnox.de>
 <20150110155918.GL10641@ubuntumail>
 <20150110172826.GE8528@obnox.de>
 <20150113144922.GF15152@ubuntumail> <20150113145328.GL24962@dakara>
 <20150113171516.GB15944@ubuntumail>
Message-ID: <20150113213129.GB2519@obnox.de>

On 2015-01-13 at 17:15 +0000, Serge Hallyn wrote:
> Quoting Stéphane Graber (stgraber at ubuntu.com):
> > On Tue, Jan 13, 2015 at 02:49:22PM +0000, Serge Hallyn wrote:
> > > Quoting Michael Adam (obnox at samba.org):
> > > > 
> > > > I am happy to do patches for either variant, but will
> > > > wait for more comments on that first.
> > > 
> > > Does anyone else have any opinion?
> > > 
> > > I guess I'd favor having them show up at the bottom of the
> > > template's usage() statement, prefaced by
> > > 
> > > For internal use only (do not pass to lxc-create):
> > 
> > When I wrote the download template, I added them to the usage but in a
> > separate section:
> > 
> > """
> > LXC internal arguments (do not pass manually!):
> > [ --name <name> ]: The container name
> > [ --path <path> ]: The path to the container
> > [ --rootfs <rootfs> ]: The path to the container's rootfs
> > [ --mapped-uid <map> ]: A uid map (user namespaces)
> > [ --mapped-gid <map> ]: A gid map (user namespaces)
> > """
> > 
> > Complete download template usage is:
> > 
> > """
> > LXC container image downloader
> > 
> > Required arguments:
> > [ -d | --dist <distribution> ]: The name of the distribution
> > [ -r | --release <release> ]: Release name/version
> > [ -a | --arch <architecture> ]: Architecture of the container
> > 
> > Optional arguments:
> > [ -h | --help ]: This help message
> > [ -l | --list ]: List all available images
> > [ --variant <variant> ]: Variant of the image (default: "default")
> > [ --server <server> ]: Image server (default: "images.linuxcontainers.org")
> > [ --keyid <keyid> ]: GPG keyid (default: 0x...)
> > [ --keyserver <keyserver> ]: GPG keyserver to use
> > [ --no-validate ]: Disable GPG validation (not recommended)
> > [ --flush-cache ]: Flush the local copy (if present)
> > [ --force-cache ]; Force the use of the local copy even if expired
> > 
> > LXC internal arguments (do not pass manually!):
> > [ --name <name> ]: The container name
> > [ --path <path> ]: The path to the container
> > [ --rootfs <rootfs> ]: The path to the container's rootfs
> > [ --mapped-uid <map> ]: A uid map (user namespaces)
> > [ --mapped-gid <map> ]: A gid map (user namespaces)
> > """
> > 
> > Maybe something like that would work for the other templates too?
> 
> That looks good.

I agree and will follow up with patches.

> We also could put those in a function in a
> /usr/share/lxc/templates/helpers file

Good idea, but I have the impression that not all of
the templates currently support all of these options.
I need to look more. Will probably provide the per-template
patches first, and possibly reconsile later.

Cheers - Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150113/3c86a5ba/attachment.sig>

From serge.hallyn at ubuntu.com  Wed Jan 14 18:37:33 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Wed, 14 Jan 2015 18:37:33 +0000
Subject: [lxc-devel] cgfs vs unified hierachy
Message-ID: <20150114183733.GC17400@ubuntumail>

Hi,

Yesterday I was testing a small patch to test containers with the cgroup
namespace patchset from Aditya (cc:d).  Currently that features only
works with the unified hierarchy, so my first step was actually to make
containers work at all with a unified hierarchy.  I hit several issues
which I worked around, but am hoping someone else will send a proper fix
for.

Firstly, in order to test this yourself, use a recent enough kernel (I
used three 3.18 kernels - the stock Ubuntu Vivid kernel, a hand-build
3.18-rc7, and a hand-build kernel from
https://github.com/adityakali/linux/tree/cgroupns_v3).  Boot with the
option cgroup__DEVEL__legacy_files_on_dfl, and do a mount like

mkdir -p /sys/fs/cgroup/unified
mount -t cgroup -o __DEVEL__sane_behavior cgroup /sys/fs/cgroup/unified

early on.

So on with the issues:

1. Hierarchy_num in /proc/cgroups and /proc/self/cgroup start at 0.
lxc appears to depend on them starting with 1.  I worked around it by
bumping the hierarchy_num that we read by one :)

2. In unified hierarchy we cannot create tasks in a cgroup which will
have sub-cgroups.  So when creating a cg for /lxc/c1, we will want to
make /lxc/c1 owned by the container, but put the container into
/lxc/c1/leaf.  I worked around this by just making /lxc/c1 a leaf
node, which is not acceptable for a real solution.

3. Every cgroup we create which is not a leaf node will need its
cgroup.subtree_cgroups file filled with "+cpu +cpuset +cpuacct..."
(I worked around this for /lxc with a function that reads
cgroup.controllers, prepends every word with '+', and writes that
to cgroup.subtree_cgroups - iow i hardcoded it for /lxc, but we
need to do it more generally for all non-leaf nodes)

4. Tasks file no longer exists, so we will need to use cgroup.procs.

-serge

PS - the good news is it did work, I ended up with a container in
cgroup /lxc/t1 which saw itself as being under /.

PS2 - I do hope that cgroupns can be made to work with non-unified
hierarchies.  While lxc should definately be fixed to support the
unified hierarchy, it seems clear that older userspace in containers on
newer hosts will have problems - for instance (let's say) a Ubuntu Trusty
container running on a Ubuntu vivid system with unified hierarchy will
have serious issues, if only because of the cgroup.subtree_cgroups file
and lack of tasks file.

PS3 - I didn't test unprivileged containers, but did test unprivileged
clone(CLONE_NEWCG) by hand, so at least that bit works.  I expect other
problems in unified hierarchy due to capable() vs ns_capable() calls)

From stgraber at ubuntu.com  Thu Jan 15 22:08:20 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 15 Jan 2015 17:08:20 -0500
Subject: [lxc-devel] [PATCH] clarify explanation of veth
In-Reply-To: <20150113212708.GA2519@obnox.de>
References: <20150113212708.GA2519@obnox.de>
Message-ID: <20150115220820.GL3574@dakara>

On Tue, Jan 13, 2015 at 10:27:08PM +0100, Michael Adam wrote:
> Hi,
> 
> This find a patch that (for me) clarifies
> the explanation of the veth network type in
> the lxc.container.conf manpage.
> 
> Cheers - Michael
> 
> 
> From a188f5b5c603e62237066eaad17bc35f73a46e32 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Tue, 13 Jan 2015 22:24:07 +0100
> Subject: [PATCH] doc: clarify the description of the veth network type in the
>  manpage.
> 
> Signed-off-by: Michael Adam <obnox at samba.org>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  doc/lxc.container.conf.sgml.in | 26 +++++++++++++-------------
>  1 file changed, 13 insertions(+), 13 deletions(-)
> 
> diff --git a/doc/lxc.container.conf.sgml.in b/doc/lxc.container.conf.sgml.in
> index 6d4daac..8652373 100644
> --- a/doc/lxc.container.conf.sgml.in
> +++ b/doc/lxc.container.conf.sgml.in
> @@ -267,20 +267,20 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
>              </para>
>  
>              <para>
> -              <option>veth:</option> a peer network device is created
> -              with one side assigned to the container and the other
> -              side is attached to a bridge specified by
> -              the <option>lxc.network.link</option>. If the bridge is
> -              not specified, then the veth pair device will be created
> -              but not attached to any bridge. Otherwise, the bridge
> -              has to be setup before on the
> -              system, <command>lxc</command> won't handle any
> -              configuration outside of the container.  By
> -              default <command>lxc</command> choose a name for the
> +              <option>veth:</option> a virtual ethernet pair
> +              device is created with one side assigned to the container
> +              and the other side attached to a bridge specified by
> +              the <option>lxc.network.link</option> option.
> +              If the bridge is not specified, then the veth pair device
> +              will be created but not attached to any bridge.
> +              Otherwise, the bridge has to be created on the system
> +              before starting the container.
> +              <command>lxc</command> won't handle any
> +              configuration outside of the container.
> +              By default, <command>lxc</command> chooses a name for the
>                network device belonging to the outside of the
> -              container, this name is handled
> -              by <command>lxc</command>, but if you wish to handle
> -              this name yourself, you can tell <command>lxc</command>
> +              container, but if you wish to handle
> +              this name yourselves, you can tell <command>lxc</command>
>                to set a specific name with
>                the <option>lxc.network.veth.pair</option> option (except for
>                unprivileged containers where this option is ignored for security
> -- 
> 2.1.0
> 



> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150115/171c2f55/attachment.sig>

From stgraber at ubuntu.com  Thu Jan 15 22:09:25 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 15 Jan 2015 17:09:25 -0500
Subject: [lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the
 overlayfs workdir option (v2)
In-Reply-To: <20150113000837.GD14742@ubuntumail>
References: <20150113000837.GD14742@ubuntumail>
Message-ID: <20150115220925.GM3574@dakara>

On Tue, Jan 13, 2015 at 12:08:37AM +0000, Serge Hallyn wrote:
> We fixed this some time ago for basic lxc-start, but never did
> lxc-start-ephemeral.
> 
> Since the lxc-start patches were pushed, Miklos has given us a
> way to detect whether we need the workdir= option.  So the
> bdev.c code could be simplified to check for "overlay\n" in
> /proc/filesystems just as lxc-start-ephemeral does.  This
> patch doesn't do that.
> 
> Changelog (v2):
> 	1. use 'overlay' fstype for new overlay upstream module
> 	2. avoid using unneeded readlines().
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/lxc-start-ephemeral.in | 25 ++++++++++++++++++++++++-
>  1 file changed, 24 insertions(+), 1 deletion(-)
> 
> diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
> index c999e74..36e2579 100644
> --- a/src/lxc/lxc-start-ephemeral.in
> +++ b/src/lxc/lxc-start-ephemeral.in
> @@ -219,6 +219,14 @@ for entry in args.cdir:
>          dst_path = "%s/rootfs/%s" % (dest_path, src_path)
>          overlay_dirs += [(src_path, dst_path)]
>  
> +# do we have the new overlay fs which requires workdir, or the older
> +# overlayfs which does not?
> +have_new_overlay = False
> +with open("/proc/filesystems", "r") as fd:
> +    for line in fd:
> +        if line == "nodev\toverlay\n":
> +            have_new_overlay = True
> +
>  # Generate pre-mount script
>  with open(os.path.join(dest_path, "pre-mount"), "w+") as fd:
>      os.fchmod(fd.fileno(), 0o755)
> @@ -231,16 +239,31 @@ LXC_NAME="%s"
>      count = 0
>      for entry in overlay_dirs:
>          target = "%s/delta%s" % (dest_path, count)
> +        workdir = "%s/work%s" % (dest_path, count)
>          fd.write("mkdir -p %s %s\n" % (target, entry[1]))
> +        if have_new_overlay:
> +            fd.write("mkdir -p %s\n" % workdir)
>  
>          if args.storage_type == "tmpfs":
>              fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (target))
> +            if have_new_overlay:
> +                fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (workdir))
>  
>          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], target))
>          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
> +        if have_new_overlay:
> +            fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], workdir))
>  
>          if args.union_type == "overlayfs":
> -            fd.write("mount -n -t overlayfs"
> +            if have_new_overlay:
> +                fd.write("mount -n -t overlay"
> +                     " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
> +                         target,
> +                         entry[0],
> +                         workdir,
> +                         entry[1]))
> +            else:
> +                fd.write("mount -n -t overlayfs"
>                       " -oupperdir=%s,lowerdir=%s none %s\n" % (
>                           target,
>                           entry[0],
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150115/392135ec/attachment.sig>

From stgraber at ubuntu.com  Thu Jan 15 22:11:05 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 15 Jan 2015 17:11:05 -0500
Subject: [lxc-devel] [PATCH 1/1] close-all-fds: fix behavior
In-Reply-To: <20150113060226.GE14742@ubuntumail>
References: <20150113060226.GE14742@ubuntumail>
Message-ID: <20150115221105.GN3574@dakara>

On Tue, Jan 13, 2015 at 06:02:26AM +0000, Serge Hallyn wrote:
> We want to close all inherited fds in three cases - one, if a container
> is daemonized.  Two, if the user specifies -C on the lxc-start command
> line.  Three, in src/lxc/monitor.c.  The presence of -C is passed in the
> lxc_conf may not always exist.
> 
> One call to lxc_check_inherited was being done from lxc_start(), which
> doesn't know whether we are daemonized.  Move that call to its caller,
> lxcapi_start(), which does know.
> 
> Pass an explicit closeall boolean as second argument to lxc_check_inherited.
> If it is true, then all fds are closed.  If it is false, then we check
> the lxc_conf->close_all_fds.
> 
> With this, all tests pass, and the logic appears correct.
> 
> Note that when -C is not true, then we only warn about inherited fds,
> but we do not abort the container start.  This appears to have ben the case
> since commit 92c7f6295518 in 2011.  Unfortunately the referenced URL with
> the justification is no longer valid.  We may want to consider becoming
> stricter about this again.  (Note that the commit did say "for now")
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/execute.c      |  2 +-
>  src/lxc/lxccontainer.c | 11 +++++++++--
>  src/lxc/monitor.c      |  2 +-
>  src/lxc/start.c        | 19 ++++++++++++++-----
>  src/lxc/start.h        |  3 ++-
>  5 files changed, 27 insertions(+), 10 deletions(-)
> 
> diff --git a/src/lxc/execute.c b/src/lxc/execute.c
> index b78bcbf..a0f7ff1 100644
> --- a/src/lxc/execute.c
> +++ b/src/lxc/execute.c
> @@ -118,7 +118,7 @@ int lxc_execute(const char *name, char *const argv[], int quiet,
>  		.quiet = quiet
>  	};
>  
> -	if (lxc_check_inherited(conf, -1))
> +	if (lxc_check_inherited(conf, false, -1))
>  		return -1;
>  
>  	conf->is_execute = 1;
> diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
> index 0d36687..7ed8717 100644
> --- a/src/lxc/lxccontainer.c
> +++ b/src/lxc/lxccontainer.c
> @@ -606,7 +606,6 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
>  	* while container is running...
>  	*/
>  	if (daemonize) {
> -		conf->close_all_fds = 1;
>  		lxc_monitord_spawn(c->config_path);
>  
>  		pid_t pid = fork();
> @@ -634,7 +633,7 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
>  			SYSERROR("Error chdir()ing to /.");
>  			return false;
>  		}
> -		lxc_check_inherited(conf, -1);
> +		lxc_check_inherited(conf, true, -1);
>  		close(0);
>  		close(1);
>  		close(2);
> @@ -673,6 +672,13 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
>  
>  reboot:
>  	conf->reboot = 0;
> +
> +	if (lxc_check_inherited(conf, daemonize, -1)) {
> +		ERROR("Inherited fds found");
> +		ret = 1;
> +		goto out;
> +	}
> +
>  	ret = lxc_start(c->name, argv, conf, c->config_path);
>  	c->error_num = ret;
>  
> @@ -682,6 +688,7 @@ reboot:
>  		goto reboot;
>  	}
>  
> +out:
>  	if (c->pidfile) {
>  		unlink(c->pidfile);
>  		free(c->pidfile);
> diff --git a/src/lxc/monitor.c b/src/lxc/monitor.c
> index f6d36a9..1e1c094 100644
> --- a/src/lxc/monitor.c
> +++ b/src/lxc/monitor.c
> @@ -331,7 +331,7 @@ int lxc_monitord_spawn(const char *lxcpath)
>  		SYSERROR("failed to setsid");
>  		exit(EXIT_FAILURE);
>  	}
> -	lxc_check_inherited(NULL, pipefd[1]);
> +	lxc_check_inherited(NULL, true, pipefd[1]);
>  	close(0);
>  	close(1);
>  	close(2);
> diff --git a/src/lxc/start.c b/src/lxc/start.c
> index cd78665..f9bff51 100644
> --- a/src/lxc/start.c
> +++ b/src/lxc/start.c
> @@ -170,12 +170,24 @@ static int match_fd(int fd)
>  	return (fd == 0 || fd == 1 || fd == 2);
>  }
>  
> -int lxc_check_inherited(struct lxc_conf *conf, int fd_to_ignore)
> +/*
> + * Check for any fds we need to close
> + * * if fd_to_ignore != -1, then if we find that fd open we will ignore it.
> + * * By default we warn about open fds we find.
> + * * If closeall is true, we will close open fds.
> + * * If lxc-start was passed "-C", then conf->close_all_fds will be true,
> + *     in which case we also close all open fds.
> + * * A daemonized container will always pass closeall=true.
> + */
> +int lxc_check_inherited(struct lxc_conf *conf, bool closeall, int fd_to_ignore)
>  {
>  	struct dirent dirent, *direntp;
>  	int fd, fddir;
>  	DIR *dir;
>  
> +	if (conf && conf->close_all_fds)
> +		closeall = true;
> +
>  restart:
>  	dir = opendir("/proc/self/fd");
>  	if (!dir) {
> @@ -203,7 +215,7 @@ restart:
>  		if (match_fd(fd))
>  			continue;
>  
> -		if (conf == NULL || conf->close_all_fds) {
> +		if (closeall) {
>  			close(fd);
>  			closedir(dir);
>  			INFO("closed inherited fd %d", fd);
> @@ -1187,9 +1199,6 @@ int lxc_start(const char *name, char *const argv[], struct lxc_conf *conf,
>  		.argv = argv,
>  	};
>  
> -	if (lxc_check_inherited(conf, -1))
> -		return -1;
> -
>  	conf->need_utmp_watch = 1;
>  	return __lxc_start(name, conf, &start_ops, &start_arg, lxcpath);
>  }
> diff --git a/src/lxc/start.h b/src/lxc/start.h
> index 7c75b16..d39b3b4 100644
> --- a/src/lxc/start.h
> +++ b/src/lxc/start.h
> @@ -25,6 +25,7 @@
>  
>  #include <signal.h>
>  #include <sys/param.h>
> +#include <stdbool.h>
>  
>  #include "config.h"
>  #include "state.h"
> @@ -81,7 +82,7 @@ extern void lxc_abort(const char *name, struct lxc_handler *handler);
>  extern struct lxc_handler *lxc_init(const char *name, struct lxc_conf *, const char *);
>  extern void lxc_fini(const char *name, struct lxc_handler *handler);
>  
> -extern int lxc_check_inherited(struct lxc_conf *conf, int fd_to_ignore);
> +extern int lxc_check_inherited(struct lxc_conf *conf, bool closeall, int fd_to_ignore);
>  int __lxc_start(const char *, struct lxc_conf *, struct lxc_operations *,
>  		void *, const char *);
>  
> -- 
> 2.1.3
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150115/53edcb75/attachment.sig>

From noreply at github.com  Thu Jan 15 22:12:26 2015
From: noreply at github.com (GitHub)
Date: Thu, 15 Jan 2015 14:12:26 -0800
Subject: [lxc-devel] [lxc/lxc] 38005c: doc: clarify the description of the
 veth network t...
Message-ID: <54b83b4a98d61_2d503fba6153d29c284f3@hookshot-fe4-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 38005c5436d8a929141b7e8c0314dc5fd1c403f1
      https://github.com/lxc/lxc/commit/38005c5436d8a929141b7e8c0314dc5fd1c403f1
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-15 (Thu, 15 Jan 2015)

  Changed paths:
    M doc/lxc.container.conf.sgml.in

  Log Message:
  -----------
  doc: clarify the description of the veth network type in the  manpage.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 4799a1e7eced77ae8ef48579b81aa71127958a61
      https://github.com/lxc/lxc/commit/4799a1e7eced77ae8ef48579b81aa71127958a61
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-15 (Thu, 15 Jan 2015)

  Changed paths:
    M src/lxc/lxc-start-ephemeral.in

  Log Message:
  -----------
  lxc-start-ephemeral: handle the overlayfs workdir option (v2)

We fixed this some time ago for basic lxc-start, but never did
lxc-start-ephemeral.

Since the lxc-start patches were pushed, Miklos has given us a
way to detect whether we need the workdir= option.  So the
bdev.c code could be simplified to check for "overlay\n" in
/proc/filesystems just as lxc-start-ephemeral does.  This
patch doesn't do that.

Changelog (v2):
	1. use 'overlay' fstype for new overlay upstream module
	2. avoid using unneeded readlines().

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: d2cf4c378588cc1d497fe8b2ba3f835d6b03fe38
      https://github.com/lxc/lxc/commit/d2cf4c378588cc1d497fe8b2ba3f835d6b03fe38
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-15 (Thu, 15 Jan 2015)

  Changed paths:
    M src/lxc/execute.c
    M src/lxc/lxccontainer.c
    M src/lxc/monitor.c
    M src/lxc/start.c
    M src/lxc/start.h

  Log Message:
  -----------
  close-all-fds: fix behavior

We want to close all inherited fds in three cases - one, if a container
is daemonized.  Two, if the user specifies -C on the lxc-start command
line.  Three, in src/lxc/monitor.c.  The presence of -C is passed in the
lxc_conf may not always exist.

One call to lxc_check_inherited was being done from lxc_start(), which
doesn't know whether we are daemonized.  Move that call to its caller,
lxcapi_start(), which does know.

Pass an explicit closeall boolean as second argument to lxc_check_inherited.
If it is true, then all fds are closed.  If it is false, then we check
the lxc_conf->close_all_fds.

With this, all tests pass, and the logic appears correct.

Note that when -C is not true, then we only warn about inherited fds,
but we do not abort the container start.  This appears to have ben the case
since commit 92c7f6295518 in 2011.  Unfortunately the referenced URL with
the justification is no longer valid.  We may want to consider becoming
stricter about this again.  (Note that the commit did say "for now")

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/db2930e17441...d2cf4c378588

From obnox at samba.org  Thu Jan 15 23:21:40 2015
From: obnox at samba.org (Michael Adam)
Date: Fri, 16 Jan 2015 00:21:40 +0100
Subject: [lxc-devel] [PATCHES] improve lxc-download help and --list function
Message-ID: <20150115232140.GJ2519@obnox.de>

Hi,

While working on the documentation improvements for the other
templates in accordance to the download template, as discussed,
I came across a few small improvements to lxc-download itself:

- typofix
- make --list more useful
- document --help and --list separately as special options.

Thanks for consideration!

Michael



From 8b90ae51e19c6963730a02ecc1a0911df09375d3 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Fri, 16 Jan 2015 00:13:35 +0100
Subject: [PATCH 1/3] lxc-download: fix typo in help text.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-download.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-download.in b/templates/lxc-download.in
index 73704ba..6fc5d2e 100644
--- a/templates/lxc-download.in
+++ b/templates/lxc-download.in
@@ -202,7 +202,7 @@ Optional arguments:
 [ --keyserver <keyserver> ]: GPG keyserver to use
 [ --no-validate ]: Disable GPG validation (not recommended)
 [ --flush-cache ]: Flush the local copy (if present)
-[ --force-cache ]; Force the use of the local copy even if expired
+[ --force-cache ]: Force the use of the local copy even if expired
 
 LXC internal arguments (do not pass manually!):
 [ --name <name> ]: The container name
-- 
2.1.0


From 4c6142080bc05b0d862e84962398ba8d304855b8 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Fri, 16 Jan 2015 00:14:15 +0100
Subject: [PATCH 2/3] lxc-download: make --list more useful.

Make it possible to use --list without having to specify
--dist, --release, and --arch, which does not make a lot
of sense.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-download.in | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/templates/lxc-download.in b/templates/lxc-download.in
index 6fc5d2e..2d6b1cb 100644
--- a/templates/lxc-download.in
+++ b/templates/lxc-download.in
@@ -266,8 +266,10 @@ fi
 
 # Check that we have all variables we need
 if [ -z "$LXC_NAME" ] || [ -z "$LXC_PATH" ] || [ -z "$LXC_ROOTFS" ]; then
-    echo "ERROR: Not running through LXC." 1>&2
-    exit 1
+    if [ "$DOWNLOAD_LIST_IMAGES" != "true" ]; then
+        echo "ERROR: Not running through LXC." 1>&2
+        exit 1
+    fi
 fi
 
 USERNS=$(in_userns)
-- 
2.1.0


From 18acf0c5cbaf651869871e382e363902177787f6 Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Fri, 16 Jan 2015 00:15:50 +0100
Subject: [PATCH 3/3] lxc-download: improve help text.

--help and --list are special in the sense that they
are independent of the other options and exit early.
Document them separately.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-download.in | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/templates/lxc-download.in b/templates/lxc-download.in
index 2d6b1cb..722f95f 100644
--- a/templates/lxc-download.in
+++ b/templates/lxc-download.in
@@ -188,14 +188,16 @@ usage() {
     cat <<EOF
 LXC container image downloader
 
+Special arguments:
+[ -h | --help ]: Print this help message and exit.
+[ -l | --list ]: List all available images and exit.
+
 Required arguments:
 [ -d | --dist <distribution> ]: The name of the distribution
 [ -r | --release <release> ]: Release name/version
 [ -a | --arch <architecture> ]: Architecture of the container
 
 Optional arguments:
-[ -h | --help ]: This help message
-[ -l | --list ]: List all available images
 [ --variant <variant> ]: Variant of the image (default: "default")
 [ --server <server> ]: Image server (default: "images.linuxcontainers.org")
 [ --keyid <keyid> ]: GPG keyid (default: 0x...)
-- 
2.1.0

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150116/3aa4fe7b/attachment.sig>

From stgraber at ubuntu.com  Thu Jan 15 23:26:42 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 15 Jan 2015 18:26:42 -0500
Subject: [lxc-devel] [PATCHES] improve lxc-download help and --list
 function
In-Reply-To: <20150115232140.GJ2519@obnox.de>
References: <20150115232140.GJ2519@obnox.de>
Message-ID: <20150115232642.GO3574@dakara>

On Fri, Jan 16, 2015 at 12:21:40AM +0100, Michael Adam wrote:
> Hi,
> 
> While working on the documentation improvements for the other
> templates in accordance to the download template, as discussed,
> I came across a few small improvements to lxc-download itself:
> 
> - typofix
> - make --list more useful
> - document --help and --list separately as special options.
> 
> Thanks for consideration!
> 
> Michael

The whole set looks good, thanks!

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> 
> 
> 
> From 8b90ae51e19c6963730a02ecc1a0911df09375d3 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Fri, 16 Jan 2015 00:13:35 +0100
> Subject: [PATCH 1/3] lxc-download: fix typo in help text.
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-download.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-download.in b/templates/lxc-download.in
> index 73704ba..6fc5d2e 100644
> --- a/templates/lxc-download.in
> +++ b/templates/lxc-download.in
> @@ -202,7 +202,7 @@ Optional arguments:
>  [ --keyserver <keyserver> ]: GPG keyserver to use
>  [ --no-validate ]: Disable GPG validation (not recommended)
>  [ --flush-cache ]: Flush the local copy (if present)
> -[ --force-cache ]; Force the use of the local copy even if expired
> +[ --force-cache ]: Force the use of the local copy even if expired
>  
>  LXC internal arguments (do not pass manually!):
>  [ --name <name> ]: The container name
> -- 
> 2.1.0
> 
> 
> From 4c6142080bc05b0d862e84962398ba8d304855b8 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Fri, 16 Jan 2015 00:14:15 +0100
> Subject: [PATCH 2/3] lxc-download: make --list more useful.
> 
> Make it possible to use --list without having to specify
> --dist, --release, and --arch, which does not make a lot
> of sense.
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-download.in | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/templates/lxc-download.in b/templates/lxc-download.in
> index 6fc5d2e..2d6b1cb 100644
> --- a/templates/lxc-download.in
> +++ b/templates/lxc-download.in
> @@ -266,8 +266,10 @@ fi
>  
>  # Check that we have all variables we need
>  if [ -z "$LXC_NAME" ] || [ -z "$LXC_PATH" ] || [ -z "$LXC_ROOTFS" ]; then
> -    echo "ERROR: Not running through LXC." 1>&2
> -    exit 1
> +    if [ "$DOWNLOAD_LIST_IMAGES" != "true" ]; then
> +        echo "ERROR: Not running through LXC." 1>&2
> +        exit 1
> +    fi
>  fi
>  
>  USERNS=$(in_userns)
> -- 
> 2.1.0
> 
> 
> From 18acf0c5cbaf651869871e382e363902177787f6 Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Fri, 16 Jan 2015 00:15:50 +0100
> Subject: [PATCH 3/3] lxc-download: improve help text.
> 
> --help and --list are special in the sense that they
> are independent of the other options and exit early.
> Document them separately.
> 
> Signed-off-by: Michael Adam <obnox at samba.org>
> ---
>  templates/lxc-download.in | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/templates/lxc-download.in b/templates/lxc-download.in
> index 2d6b1cb..722f95f 100644
> --- a/templates/lxc-download.in
> +++ b/templates/lxc-download.in
> @@ -188,14 +188,16 @@ usage() {
>      cat <<EOF
>  LXC container image downloader
>  
> +Special arguments:
> +[ -h | --help ]: Print this help message and exit.
> +[ -l | --list ]: List all available images and exit.
> +
>  Required arguments:
>  [ -d | --dist <distribution> ]: The name of the distribution
>  [ -r | --release <release> ]: Release name/version
>  [ -a | --arch <architecture> ]: Architecture of the container
>  
>  Optional arguments:
> -[ -h | --help ]: This help message
> -[ -l | --list ]: List all available images
>  [ --variant <variant> ]: Variant of the image (default: "default")
>  [ --server <server> ]: Image server (default: "images.linuxcontainers.org")
>  [ --keyid <keyid> ]: GPG keyid (default: 0x...)
> -- 
> 2.1.0
> 



> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150115/8b00378a/attachment.sig>

From obnox at samba.org  Thu Jan 15 23:28:01 2015
From: obnox at samba.org (Michael Adam)
Date: Fri, 16 Jan 2015 00:28:01 +0100
Subject: [lxc-devel] how are lxc-download images created?
Message-ID: <20150115232801.GK2519@obnox.de>

Hi,

How are the images that lxc-download uses created?
It would be great to have these recipes in the tree.

I am asking because apparently the fedora and debian
jessie images don't have the improvements/fixes for
running systemd as init that are installed when
using the lxc-debian or lxc-fedora template to
create the container (lxc.kmsg = 0 and lxc.autodev = 1).

Cheers - Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150116/df1ccf07/attachment.sig>

From stgraber at ubuntu.com  Thu Jan 15 23:30:46 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 15 Jan 2015 18:30:46 -0500
Subject: [lxc-devel] how are lxc-download images created?
In-Reply-To: <20150115232801.GK2519@obnox.de>
References: <20150115232801.GK2519@obnox.de>
Message-ID: <20150115233046.GP3574@dakara>

On Fri, Jan 16, 2015 at 12:28:01AM +0100, Michael Adam wrote:
> Hi,
> 
> How are the images that lxc-download uses created?
> It would be great to have these recipes in the tree.
> 
> I am asking because apparently the fedora and debian
> jessie images don't have the improvements/fixes for
> running systemd as init that are installed when
> using the lxc-debian or lxc-fedora template to
> create the container (lxc.kmsg = 0 and lxc.autodev = 1).
> 
> Cheers - Michael

They are built using the standard templates on
jenkins.linuxcontainers.org using the scripts at github.com/lxc/lxc-ci.

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150115/998aa592/attachment-0001.sig>

From stgraber at ubuntu.com  Fri Jan 16 00:09:42 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 15 Jan 2015 19:09:42 -0500
Subject: [lxc-devel] [PATCH 1/2] autodev: switch strategies (v3)
In-Reply-To: <20150112235436.GA14742@ubuntumail>
References: <20150112235436.GA14742@ubuntumail>
Message-ID: <20150116000942.GS3574@dakara>

On Mon, Jan 12, 2015 at 11:54:36PM +0000, Serge Hallyn wrote:
> Do not keep container devs under /dev/.lxc.  Instead, always
> keep them in a small tmpfs mounted at $(mounted_root)/dev.
> 
> The tmpfs is mounted in the container monitor's namespace.  This
> means that at every reboot it will get re-created.  It seems to
> me this better replicates what happens on a real host.
> 
> If we want devices persisting across reboots, then perhaps we can
> implement a $lxcpath/$name/keepdev directory containing devices to
> bind into the container at each startup.
> 
> Changelog (v2): don't bother with the $lxcpath/$name/rootfs.dev
> 	directory, just mount the tmpfs straight into the container.
> 
> Changelog (v3): Don't create /dev if it doesn't exist
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/conf.c  | 312 +++++---------------------------------------------------
>  src/lxc/start.c |   1 -
>  2 files changed, 24 insertions(+), 289 deletions(-)
> 
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index 72181dd..dff5020 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -94,10 +94,7 @@
>  
>  lxc_log_define(lxc_conf, lxc);
>  
> -#define MAXHWLEN    18
> -#define MAXINDEXLEN 20
> -#define MAXMTULEN   16
> -#define MAXLINELEN  128
> +#define LINELEN 4096
>  
>  #if HAVE_SYS_CAPABILITY_H
>  #ifndef CAP_SETFCAP
> @@ -295,9 +292,6 @@ static struct caps_opt caps_opt[] = {
>  static struct caps_opt caps_opt[] = {};
>  #endif
>  
> -const char *dev_base_path = "/dev/.lxc";
> -const char *dev_user_path = "/dev/.lxc/user";
> -
>  static int run_buffer(char *buffer)
>  {
>  	struct lxc_popen_FILE *f;
> @@ -1092,247 +1086,47 @@ fail:
>  }
>  
>  /*
> - * Check to see if a directory has something mounted on it and,
> - * if it does, return the fstype.
> - *
> - * Code largely based on detect_shared_rootfs below
> - *
> - * Returns: # of matching entries in /proc/self/mounts
> - * 	if != 0 fstype is filled with the last filesystem value.
> - * 	if == 0 no matches found, fstype unchanged.
> - *
> - * ToDo: Maybe return the mount options in another parameter...
> - */
> -
> -#define LINELEN 4096
> -#define MAX_FSTYPE_LEN 128
> -static int mount_check_fs( const char *dir, char *fstype )
> -{
> -	char buf[LINELEN], *p;
> -	struct stat s;
> -	FILE *f;
> -	int found_fs = 0;
> -	char *p2;
> -
> -	DEBUG("entering mount_check_fs for %s", dir);
> -
> -	if ( 0 != access(dir, F_OK) || 0 != stat(dir, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		return 0;
> -	}
> -
> -	f = fopen("/proc/self/mounts", "r");
> -	if (!f)
> -		return 0;
> -	while (fgets(buf, LINELEN, f)) {
> -		p = index(buf, ' ');
> -		if( !p )
> -			continue;
> -		*p = '\0';
> -		p2 = p + 1;
> -
> -		p = index(p2, ' ');
> -		if( !p )
> -			continue;
> -		*p = '\0';
> -
> -		/* Compare the directory in the entry to desired */
> -		if( strcmp( p2, dir ) ) {
> -			continue;
> -		}
> -
> -		p2 = p + 1;
> -		p = index( p2, ' ');
> -		if( !p )
> -			continue;
> -		*p = '\0';
> -
> -		++found_fs;
> -
> -		if( fstype ) {
> -			strncpy( fstype, p2, MAX_FSTYPE_LEN - 1 );
> -			fstype [ MAX_FSTYPE_LEN - 1 ] = '\0';
> -		}
> -	}
> -
> -	fclose(f);
> -
> -	DEBUG("mount_check_fs returning %d last %s", found_fs, fstype);
> -
> -	return found_fs;
> -}
> -
> -/*
> - * Locate a devtmpfs mount (should be on /dev) and create a container
> - * subdirectory on it which we can then bind mount to the container
> - * /dev instead of mounting a tmpfs there.
> - * If we fail, return NULL.
> - * Else return the pointer to the name buffer with the string to
> - * the devtmpfs subdirectory.
> + * Just create a path for /dev under $lxcpath/$name and in rootfs
> + * If we hit an error, log it but don't fail yet.
>   */
> -
> -static char *mk_devtmpfs(const char *name, char *path, const char *lxcpath)
> +static int mount_autodev(const char *name, char *root, const char *lxcpath)
>  {
>  	int ret;
> -	struct stat s;
> -	char tmp_path[MAXPATHLEN];
> -	char fstype[MAX_FSTYPE_LEN];
> -	uint64_t hash;
> -
> -	if ( 0 != access(dev_base_path, F_OK) || 0 != stat(dev_base_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		/* This is just making /dev/.lxc it better work or we're done */
> -		ret = mkdir(dev_base_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
> -		if ( ret ) {
> -			SYSERROR( "Unable to create /dev/.lxc for autodev" );
> -			return NULL;
> -		}
> -	}
> +	size_t clen;
> +	char *path;
>  
> -	/*
> -	 * Programmers notes:
> -	 * 	We can not do mounts in this area of code that we want
> -	 * 	to be visible in the host.  Consequently, /dev/.lxc must
> -	 * 	be set up earlier if we need a tmpfs mounted there.
> -	 * 	That only affects the rare cases where autodev is enabled
> -	 * 	for a container and devtmpfs is not mounted on /dev in the
> -	 * 	host.  In that case, we'll fall back to the old method
> -	 * 	of mounting a tmpfs in the container and have no visibility
> -	 * 	into the container /dev.
> -	 */
> -	if( ! mount_check_fs( "/dev", fstype )
> -		|| strcmp( "devtmpfs", fstype ) ) {
> -		/* Either /dev was not mounted or was not devtmpfs */
> +	INFO("Mounting /dev under %s", root);
>  
> -		if ( ! mount_check_fs( "/dev/.lxc", NULL ) ) {
> -			/*
> -			 * /dev/.lxc is not already mounted
> -			 * Doing a mount here does no good, since
> -			 * it's not visible in the host.
> -			 */
> +	/* $(root) + "/dev/pts" + '\0' */
> +	clen = strlen(root) + 9;
> +	path = alloca(clen);
>  
> -			ERROR("/dev/.lxc is not setup - taking fallback" );
> -			return NULL;
> -		}
> -	}
> +	ret = snprintf(path, clen, "%s/dev", root);
> +	if (ret < 0 || ret >= clen)
> +		return -1;
>  
> -	if ( 0 != access(dev_user_path, F_OK) || 0 != stat(dev_user_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		/*
> -		 * This is making /dev/.lxc/user path for non-priv users.
> -		 * If this doesn't work, we'll have to fall back in the
> -		 * case of non-priv users.  It's mode 1777 like /tmp.
> -		 */
> -		ret = mkdir(dev_user_path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
> -		if ( ret ) {
> -			/* Issue an error but don't fail yet! */
> -			ERROR("Unable to create /dev/.lxc/user");
> -		}
> -		/* Umask tends to screw us up here */
> -		chmod(dev_user_path, S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX);
> +	if (!dir_exists(path)) {
> +		WARN("No /dev on container rootfs.");
> +		WARN("Proceeding without autodev setup");
> +		return 0;
>  	}
>  
> -	/*
> -	 * Since the container name must be unique within a given
> -	 * lxcpath, we're going to use a hash of the path
> -	 * /lxcpath/name as our hash name in /dev/.lxc/
> -	 */
> -
> -	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s", lxcpath, name);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> -		return NULL;
> -
> -	hash = fnv_64a_buf(tmp_path, ret, FNV1A_64_INIT);
> -
> -	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_base_path, name, hash);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> -		return NULL;
> -
> -	if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		ret = mkdir(tmp_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
> -		if ( ret ) {
> -			/* Something must have failed with the dev_base_path...
> -			 * Maybe unpriv user.  Try dev_user_path now... */
> -			INFO("Setup in /dev/.lxc failed.  Trying /dev/.lxc/user." );
> -
> -			ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_user_path, name, hash);
> -			if (ret < 0 || ret >= MAXPATHLEN)
> -				return NULL;
> -
> -			if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -				ret = mkdir(tmp_path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
> -				if ( ret ) {
> -					ERROR("Container /dev setup in host /dev failed - taking fallback" );
> -					return NULL;
> -				}
> -			}
> -		}
> +	if (mount("none", path, "tmpfs", 0, "size=100000,mode=755")) {
> +		SYSERROR("Failed mounting tmpfs onto %s\n", path);
> +		return false;
>  	}
>  
> -	strcpy( path, tmp_path );
> -	return path;
> -}
> -
> -/*
> - * Do we want to add options for max size of /dev and a file to
> - * specify which devices to create?
> - */
> -static int mount_autodev(const char *name, char *root, const char *lxcpath)
> -{
> -	int ret;
> -	struct stat s;
> -	char path[MAXPATHLEN];
> -	char host_path[MAXPATHLEN];
> -	char devtmpfs_path[MAXPATHLEN];
> -
> -	INFO("Mounting /dev under %s", root);
> -
> -	ret = snprintf(host_path, MAXPATHLEN, "%s/%s/rootfs.dev", lxcpath, name);
> -	if (ret < 0 || ret > MAXPATHLEN)
> -		return -1;
> +	INFO("Mounted tmpfs onto %s",  path);
>  
> -	ret = snprintf(path, MAXPATHLEN, "%s/dev", root);
> -	if (ret < 0 || ret > MAXPATHLEN)
> +	ret = snprintf(path, clen, "%s/dev/pts", root);
> +	if (ret < 0 || ret >= clen)
>  		return -1;
>  
> -	if (mk_devtmpfs( name, devtmpfs_path, lxcpath ) ) {
> -		/*
> -		 * Get rid of old links and directoriess
> -		 * This could be either a symlink and we remove it,
> -		 * or an empty directory and we remove it,
> -		 * or non-existent and we don't care,
> -		 * or a non-empty directory, and we will then emit an error
> -		 * but we will not fail out the process.
> -		 */
> -		unlink( host_path );
> -		rmdir( host_path );
> -		ret = symlink(devtmpfs_path, host_path);
> -
> -		if ( ret < 0 ) {
> -			SYSERROR("WARNING: Failed to create symlink '%s'->'%s'", host_path, devtmpfs_path);
> -		}
> -		DEBUG("Bind mounting %s to %s", devtmpfs_path , path );
> -		ret = mount(devtmpfs_path, path, NULL, MS_BIND, 0 );
> -	} else {
> -		/* Only mount a tmpfs on here if we don't already a mount */
> -		if ( ! mount_check_fs( host_path, NULL ) ) {
> -			DEBUG("Mounting tmpfs to %s", host_path );
> -			ret = mount("none", path, "tmpfs", 0, "size=100000,mode=755");
> -		} else {
> -			/* This allows someone to manually set up a mount */
> -			DEBUG("Bind mounting %s to %s", host_path, path );
> -			ret = mount(host_path , path, NULL, MS_BIND, 0 );
> -		}
> -	}
> -	if (ret) {
> -		SYSERROR("Failed to mount /dev at %s", root);
> -		return -1;
> -	}
> -	ret = snprintf(path, MAXPATHLEN, "%s/dev/pts", root);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> -		return -1;
>  	/*
>  	 * If we are running on a devtmpfs mapping, dev/pts may already exist.
>  	 * If not, then create it and exit if that fails...
>  	 */
> -	if ( 0 != access(path, F_OK) || 0 != stat(path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> +	if (!dir_exists(path)) {
>  		ret = mkdir(path, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
>  		if (ret) {
>  			SYSERROR("Failed to create /dev/pts in container");
> @@ -1395,64 +1189,6 @@ static int setup_autodev(const char *root)
>  	return 0;
>  }
>  
> -/*
> - * Locate allocated devtmpfs mount and purge it.
> - * path lookup mostly taken from mk_devtmpfs
> - */
> -int lxc_delete_autodev(struct lxc_handler *handler)
> -{
> -	int ret;
> -	struct stat s;
> -	struct lxc_conf *lxc_conf = handler->conf;
> -	const char *name = handler->name;
> -	const char *lxcpath = handler->lxcpath;
> -	char tmp_path[MAXPATHLEN];
> -	uint64_t hash;
> -
> -	if ( lxc_conf->autodev <= 0 )
> -		return 0;
> -
> -	/* don't clean on reboot */
> -	if ( lxc_conf->reboot == 1 )
> -		return 0;
> -
> -	/*
> -	 * Use the same logic as mk_devtmpfs to compute candidate
> -	 * path for cleanup.
> -	 */
> -
> -	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s", lxcpath, name);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> -		return -1;
> -
> -	hash = fnv_64a_buf(tmp_path, ret, FNV1A_64_INIT);
> -
> -	/* Probe /dev/.lxc/<container name>.<hash> */
> -	ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_base_path, name, hash);
> -	if (ret < 0 || ret >= MAXPATHLEN)
> -		return -1;
> -
> -	if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -		/* Probe /dev/.lxc/user/<container name>.<hash> */
> -		ret = snprintf(tmp_path, MAXPATHLEN, "%s/%s.%016" PRIx64, dev_user_path, name, hash);
> -		if (ret < 0 || ret >= MAXPATHLEN)
> -			return -1;
> -
> -		if ( 0 != access(tmp_path, F_OK) || 0 != stat(tmp_path, &s) || 0 == S_ISDIR(s.st_mode) ) {
> -			WARN("Failed to locate autodev /dev/.lxc and /dev/.lxc/user." );
> -			return -1;
> -		}
> -	}
> -
> -	/* Do the cleanup */
> -	INFO("Cleaning %s", tmp_path );
> -	if ( 0 != lxc_rmdir_onedev(tmp_path, NULL) ) {
> -		ERROR("Failed to cleanup autodev" );
> -	}
> -
> -	return 0;
> -}
> -
>  static int setup_rootfs(struct lxc_conf *conf)
>  {
>  	const struct lxc_rootfs *rootfs = &conf->rootfs;
> diff --git a/src/lxc/start.c b/src/lxc/start.c
> index cd78665..98905a3 100644
> --- a/src/lxc/start.c
> +++ b/src/lxc/start.c
> @@ -477,7 +477,6 @@ void lxc_fini(const char *name, struct lxc_handler *handler)
>  
>  	lxc_console_delete(&handler->conf->console);
>  	lxc_delete_tty(&handler->conf->tty_info);
> -	lxc_delete_autodev(handler);
>  	close(handler->conf->maincmd_fd);
>  	handler->conf->maincmd_fd = -1;
>  	free(handler->name);
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150115/0bc9e9da/attachment.sig>

From stgraber at ubuntu.com  Fri Jan 16 00:09:51 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 15 Jan 2015 19:09:51 -0500
Subject: [lxc-devel] [PATCH 2/2] fill_autodev: bind-mount if mknod fails
 (v3)
In-Reply-To: <20150112235628.GB14742@ubuntumail>
References: <20150112235436.GA14742@ubuntumail>
 <20150112235628.GB14742@ubuntumail>
Message-ID: <20150116000951.GT3574@dakara>

On Mon, Jan 12, 2015 at 11:56:28PM +0000, Serge Hallyn wrote:
> First, rename setup_autodev to fill_autodev, since all it
> does is populate it, not fully set it up.
> 
> Secondly, if mknod of a device fails, then try bind-mounting
> it from the host rather than failing immediately.
> 
> Note that this isn't an urgent patch because the common.userns
> configuration hook already specifies bind,create=file mount
> entries for all the devices we would want.
> 
> Changelog (v3): ignore if /dev doesn't exist
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/conf.c | 28 ++++++++++++++++++++++++----
>  1 file changed, 24 insertions(+), 4 deletions(-)
> 
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index dff5020..19efe72 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -1155,7 +1155,7 @@ static const struct lxc_devs lxc_devs[] = {
>  	{ "console",	S_IFCHR | S_IRUSR | S_IWUSR,	       5, 1	},
>  };
>  
> -static int setup_autodev(const char *root)
> +static int fill_autodev(const char *root)
>  {
>  	int ret;
>  	char path[MAXPATHLEN];
> @@ -1170,6 +1170,9 @@ static int setup_autodev(const char *root)
>  		return -1;
>  	}
>  
> +	if (!dir_exists(path))  // ignore, just don't try to fill in
> +		return 0;
> +
>  	INFO("Populating /dev under %s", root);
>  	cmask = umask(S_IXUSR | S_IXGRP | S_IXOTH);
>  	for (i = 0; i < sizeof(lxc_devs) / sizeof(lxc_devs[0]); i++) {
> @@ -1179,8 +1182,25 @@ static int setup_autodev(const char *root)
>  			return -1;
>  		ret = mknod(path, d->mode, makedev(d->maj, d->min));
>  		if (ret && errno != EEXIST) {
> -			SYSERROR("Error creating %s", d->name);
> -			return -1;
> +			char hostpath[MAXPATHLEN];
> +			FILE *pathfile;
> +
> +			// Unprivileged containers cannot create devices, so
> +			// bind mount the device from the host
> +			ret = snprintf(hostpath, MAXPATHLEN, "/dev/%s", d->name);
> +			if (ret < 0 || ret >= MAXPATHLEN)
> +				return -1;
> +			pathfile = fopen(path, "wb");
> +			if (!pathfile) {
> +				SYSERROR("Failed to create device mount target '%s'", path);
> +				return -1;
> +			}
> +			fclose(pathfile);
> +			if (mount(hostpath, path, 0, MS_BIND, NULL) != 0) {
> +				SYSERROR("Failed bind mounting device %s from host into container",
> +					d->name);
> +				return -1;
> +			}
>  		}
>  	}
>  	umask(cmask);
> @@ -3847,7 +3867,7 @@ int lxc_setup(struct lxc_handler *handler)
>  			ERROR("failed to run autodev hooks for container '%s'.", name);
>  			return -1;
>  		}
> -		if (setup_autodev(lxc_conf->rootfs.mount)) {
> +		if (fill_autodev(lxc_conf->rootfs.mount)) {
>  			ERROR("failed to populate /dev in the container");
>  			return -1;
>  		}
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150115/75599f41/attachment.sig>

From noreply at github.com  Fri Jan 16 00:10:18 2015
From: noreply at github.com (GitHub)
Date: Thu, 15 Jan 2015 16:10:18 -0800
Subject: [lxc-devel] [lxc/lxc] e145b7: lxc-download: fix typo in help text.
Message-ID: <54b856eab2a00_19973febccd652c08385c@hookshot-fe3-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: e145b7bb6d62fe3ba279ec0730117edea9c2d538
      https://github.com/lxc/lxc/commit/e145b7bb6d62fe3ba279ec0730117edea9c2d538
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-15 (Thu, 15 Jan 2015)

  Changed paths:
    M templates/lxc-download.in

  Log Message:
  -----------
  lxc-download: fix typo in help text.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 308f4f391a0a0f2bd29a44a7b2be1e43abc61912
      https://github.com/lxc/lxc/commit/308f4f391a0a0f2bd29a44a7b2be1e43abc61912
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-15 (Thu, 15 Jan 2015)

  Changed paths:
    M templates/lxc-download.in

  Log Message:
  -----------
  lxc-download: make --list more useful.

Make it possible to use --list without having to specify
--dist, --release, and --arch, which does not make a lot
of sense.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 7d540a266389ab981c87a64050b0ba050e147e15
      https://github.com/lxc/lxc/commit/7d540a266389ab981c87a64050b0ba050e147e15
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-15 (Thu, 15 Jan 2015)

  Changed paths:
    M templates/lxc-download.in

  Log Message:
  -----------
  lxc-download: improve help text.

--help and --list are special in the sense that they
are independent of the other options and exit early.
Document them separately.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 87da4ec3371b975df8387360524c76cb4d4b6a4a
      https://github.com/lxc/lxc/commit/87da4ec3371b975df8387360524c76cb4d4b6a4a
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-15 (Thu, 15 Jan 2015)

  Changed paths:
    M src/lxc/conf.c
    M src/lxc/start.c

  Log Message:
  -----------
  autodev: switch strategies (v3)

Do not keep container devs under /dev/.lxc.  Instead, always
keep them in a small tmpfs mounted at $(mounted_root)/dev.

The tmpfs is mounted in the container monitor's namespace.  This
means that at every reboot it will get re-created.  It seems to
me this better replicates what happens on a real host.

If we want devices persisting across reboots, then perhaps we can
implement a $lxcpath/$name/keepdev directory containing devices to
bind into the container at each startup.

Changelog (v2): don't bother with the $lxcpath/$name/rootfs.dev
	directory, just mount the tmpfs straight into the container.

Changelog (v3): Don't create /dev if it doesn't exist

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 9cb4d183559d7f0b1008ea077be8e7793a7ba72d
      https://github.com/lxc/lxc/commit/9cb4d183559d7f0b1008ea077be8e7793a7ba72d
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-15 (Thu, 15 Jan 2015)

  Changed paths:
    M src/lxc/conf.c

  Log Message:
  -----------
  fill_autodev: bind-mount if mknod fails (v3)

First, rename setup_autodev to fill_autodev, since all it
does is populate it, not fully set it up.

Secondly, if mknod of a device fails, then try bind-mounting
it from the host rather than failing immediately.

Note that this isn't an urgent patch because the common.userns
configuration hook already specifies bind,create=file mount
entries for all the devices we would want.

Changelog (v3): ignore if /dev doesn't exist

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/d2cf4c378588...9cb4d183559d

From serge.hallyn at ubuntu.com  Fri Jan 16 06:02:43 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 16 Jan 2015 06:02:43 +0000
Subject: [lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the
 overlayfs workdir option (v2)
In-Reply-To: <20150115220925.GM3574@dakara>
References: <20150113000837.GD14742@ubuntumail> <20150115220925.GM3574@dakara>
Message-ID: <20150116060243.GA19510@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> On Tue, Jan 13, 2015 at 12:08:37AM +0000, Serge Hallyn wrote:
> > We fixed this some time ago for basic lxc-start, but never did
> > lxc-start-ephemeral.
> > 
> > Since the lxc-start patches were pushed, Miklos has given us a
> > way to detect whether we need the workdir= option.  So the
> > bdev.c code could be simplified to check for "overlay\n" in
> > /proc/filesystems just as lxc-start-ephemeral does.  This
> > patch doesn't do that.
> > 
> > Changelog (v2):
> > 	1. use 'overlay' fstype for new overlay upstream module
> > 	2. avoid using unneeded readlines().
> > 
> > Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> 
> Acked-by: Stéphane Graber <stgraber at ubuntu.com>

Oh, right, if you haven't already done it I'll try to remember tomorrow
to send the patch to do the modprobe of overlay{,fs}.

> > ---
> >  src/lxc/lxc-start-ephemeral.in | 25 ++++++++++++++++++++++++-
> >  1 file changed, 24 insertions(+), 1 deletion(-)
> > 
> > diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
> > index c999e74..36e2579 100644
> > --- a/src/lxc/lxc-start-ephemeral.in
> > +++ b/src/lxc/lxc-start-ephemeral.in
> > @@ -219,6 +219,14 @@ for entry in args.cdir:
> >          dst_path = "%s/rootfs/%s" % (dest_path, src_path)
> >          overlay_dirs += [(src_path, dst_path)]
> >  
> > +# do we have the new overlay fs which requires workdir, or the older
> > +# overlayfs which does not?
> > +have_new_overlay = False
> > +with open("/proc/filesystems", "r") as fd:
> > +    for line in fd:
> > +        if line == "nodev\toverlay\n":
> > +            have_new_overlay = True
> > +
> >  # Generate pre-mount script
> >  with open(os.path.join(dest_path, "pre-mount"), "w+") as fd:
> >      os.fchmod(fd.fileno(), 0o755)
> > @@ -231,16 +239,31 @@ LXC_NAME="%s"
> >      count = 0
> >      for entry in overlay_dirs:
> >          target = "%s/delta%s" % (dest_path, count)
> > +        workdir = "%s/work%s" % (dest_path, count)
> >          fd.write("mkdir -p %s %s\n" % (target, entry[1]))
> > +        if have_new_overlay:
> > +            fd.write("mkdir -p %s\n" % workdir)
> >  
> >          if args.storage_type == "tmpfs":
> >              fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (target))
> > +            if have_new_overlay:
> > +                fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (workdir))
> >  
> >          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], target))
> >          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
> > +        if have_new_overlay:
> > +            fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], workdir))
> >  
> >          if args.union_type == "overlayfs":
> > -            fd.write("mount -n -t overlayfs"
> > +            if have_new_overlay:
> > +                fd.write("mount -n -t overlay"
> > +                     " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
> > +                         target,
> > +                         entry[0],
> > +                         workdir,
> > +                         entry[1]))
> > +            else:
> > +                fd.write("mount -n -t overlayfs"
> >                       " -oupperdir=%s,lowerdir=%s none %s\n" % (
> >                           target,
> >                           entry[0],
> > -- 
> > 2.1.0
> > 
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> 
> -- 
> Stéphane Graber
> Ubuntu developer
> http://www.ubuntu.com



> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From karma at jazz.email.ne.jp  Fri Jan 16 06:54:11 2015
From: karma at jazz.email.ne.jp (KATOH Yasufumi)
Date: Fri, 16 Jan 2015 15:54:11 +0900
Subject: [lxc-devel] [PATCH] doc: Update the description of the veth in the
	Japanese lxc.container.conf(5)
Message-ID: <1421391251-19210-1-git-send-email-karma@jazz.email.ne.jp>

Update for the commit 38005c5

Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>
---
 doc/ja/lxc.container.conf.sgml.in | 52 +++++++++++++++++++--------------------
 1 file changed, 26 insertions(+), 26 deletions(-)

diff --git a/doc/ja/lxc.container.conf.sgml.in b/doc/ja/lxc.container.conf.sgml.in
index f14ef31..4d38c8e 100644
--- a/doc/ja/lxc.container.conf.sgml.in
+++ b/doc/ja/lxc.container.conf.sgml.in
@@ -366,34 +366,34 @@ by KATOH Yasufumi <karma at jazz.email.ne.jp>
 	      <option>empty:</option> ループバックインターフェースだけを作成します。
 	    </para>
 
-	    <para>
+            <para>
               <!--
-	      <option>veth:</option> a peer network device is created
-	      with one side assigned to the container and the other
-	      side is attached to a bridge specified by
-	      the <option>lxc.network.link</option>. If the bridge is
-	      not specified, then the veth pair device will be created
-	      but not attached to any bridge. Otherwise, the bridge
-	      has to be setup before on the
-	      system, <command>lxc</command> won't handle any
-	      configuration outside of the container.  By
-	      default <command>lxc</command> choose a name for the
-	      network device belonging to the outside of the
-	      container, this name is handled
-	      by <command>lxc</command>, but if you wish to handle
-	      this name yourself, you can tell <command>lxc</command>
-	      to set a specific name with
-	      the <option>lxc.network.veth.pair</option> option (except for
-	      unprivileged containers where this option is ignored for security
-	      reasons).
-              -->
-              <option>veth:</option> 一方がコンテナに、もう一方が <option>lxc.network.link</option> で指定されるブリッジにアタッチされる、ピアネットワークデバイスを作成します。
-              もし、ブリッジが指定されていない場合、veth ペアデバイスは作成されますが、ブリッジにはアタッチされません。
-              ブリッジはシステムで事前に設定する必要があります。
-              さもなければ、<command>lxc</command> はコンテナ外のいかなる設定も扱うことはできないでしょう。
-              デフォルトでは、<command>lxc</command> はコンテナの外部に属するネットワークデバイスに対する名前を決定し、<command>lxc</command> はこの名前を使います。
+              <option>veth:</option> a virtual ethernet pair
+              device is created with one side assigned to the container
+              and the other side attached to a bridge specified by
+              the <option>lxc.network.link</option> option.
+              If the bridge is not specified, then the veth pair device
+              will be created but not attached to any bridge.
+              Otherwise, the bridge has to be created on the system
+              before starting the container.
+              <command>lxc</command> won't handle any
+              configuration outside of the container.
+              By default, <command>lxc</command> chooses a name for the
+              network device belonging to the outside of the
+              container, but if you wish to handle
+              this name yourselves, you can tell <command>lxc</command>
+              to set a specific name with
+              the <option>lxc.network.veth.pair</option> option (except for
+              unprivileged containers where this option is ignored for security
+              reasons).
+              -->
+              <option>veth:</option > 一方がコンテナに、もう一方が <option>lxc.network.link</option> オプションで指定されたブリッジに接続されるペアの仮想イーサネットデバイスを作成します。
+              もし、ブリッジが指定されていない場合、veth ペアデバイスは作成されますが、ブリッジには接続されません。
+              ブリッジはコンテナが開始する前にシステムで事前に設定しておく必要があります。
+              <command>lxc</command> はコンテナ外の設定を扱うことはありません。
+              デフォルトでは、<command>lxc</command> がコンテナの外部に属するネットワークデバイスに対する名前を決定します。
               しかし、もしこの名前を自分で指定したい場合、<option>lxc.network.veth.pair</option> オプションを使って名前を設定し、lxc に対して指定をすることができます (非特権コンテナの場合をのぞきます。セキュリティ上の理由からこのオプションは無視されます)。
-	    </para>
+            </para>
 
 	    <para>
               <!--
-- 
2.2.1


From karma at jazz.email.ne.jp  Fri Jan 16 07:12:35 2015
From: karma at jazz.email.ne.jp (KATOH Yasufumi)
Date: Fri, 16 Jan 2015 16:12:35 +0900
Subject: [lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the
 overlayfs workdir option (v2)
In-Reply-To: <CAJiGEG4RpvURW0y9+QvFrAFZ=fX6xsVwFYA2+mJYvveENVBeVw@mail.gmail.com>
References: <20150113000837.GD14742@ubuntumail>
 <87ppajm6m6.wl%karma@jazz.email.ne.jp>
 <20150113144224.GC15152@ubuntumail> <20150113145123.GK24962@dakara>
 <CAJiGEG4RpvURW0y9+QvFrAFZ=fX6xsVwFYA2+mJYvveENVBeVw@mail.gmail.com>
Message-ID: <CAJiGEG4rF0yeY0qbA90TxQQAB6-2xXS1hErvk1Dcdw8csqK6Qw@mail.gmail.com>

Hi,

2015-01-13 23:51 GMT+09:00 Stéphane Graber <stgraber at ubuntu.com>:
> On Tue, Jan 13, 2015 at 02:42:24PM +0000, Serge Hallyn wrote:
>> Quoting KATOH Yasufumi (karma at jazz.email.ne.jp):
>> > Hi,
>> >
>> > I tested on kernel 3.18.1 with your patch. It works fine, but there is
>> > one problem.
>> >
>> > >>> On Tue, 13 Jan 2015 00:08:37 +0000
>> >     in message   "[lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the overlayfs workdir option (v2)"
>> >                   Serge Hallyn-san wrote:
>> >
>> > > We fixed this some time ago for basic lxc-start, but never did
>> > > lxc-start-ephemeral.
>> >
>> > > Since the lxc-start patches were pushed, Miklos has given us a
>> > > way to detect whether we need the workdir= option.  So the
>> > > bdev.c code could be simplified to check for "overlay\n" in
>> > > /proc/filesystems just as lxc-start-ephemeral does.  This
>> > > patch doesn't do that.
>> >
>> >
>> >
>> > > Changelog (v2):
>> > >   1. use 'overlay' fstype for new overlay upstream module
>> > >   2. avoid using unneeded readlines().
>> >
>> > > Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
>> > > ---
>> > >  src/lxc/lxc-start-ephemeral.in | 25 ++++++++++++++++++++++++-
>> > >  1 file changed, 24 insertions(+), 1 deletion(-)
>> >
>> > > diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
>> > > index c999e74..36e2579 100644
>> > > --- a/src/lxc/lxc-start-ephemeral.in
>> > > +++ b/src/lxc/lxc-start-ephemeral.in
>> > > @@ -219,6 +219,14 @@ for entry in args.cdir:
>> > >          dst_path = "%s/rootfs/%s" % (dest_path, src_path)
>> > >          overlay_dirs += [(src_path, dst_path)]
>> >
>> > > +# do we have the new overlay fs which requires workdir, or the older
>> > > +# overlayfs which does not?
>> > > +have_new_overlay = False
>> > > +with open("/proc/filesystems", "r") as fd:
>> > > +    for line in fd:
>> > > +        if line == "nodev\toverlay\n":
>> > > +            have_new_overlay = True
>> >
>> > When the overlayfs is module, and the module is not loaded at this
>> > moment, "have_new_overlay" is False and the mount will fail.
>> >
>> > We need to load the overlayfs module before the check.
>>
>> Yeah I thought of that when I started, then I guess ended up
>> ignoring it.  What would be the cleanest way to do this in
>> python?  Stéphane?
>
> if os.geteuid() == 0:
>     with open(os.devnull, "w") as devnull:
>         subprocess.call(["modprobe", "overlay"], stdout=devnull, stderr=devnull)
>         subprocess.call(["modprobe", "overlayfs"], stdout=devnull, stderr=devnull)
>
> That's about as clean as I can think of. That's also entirely ignoring
> any failure since we may be euid 0 and have those built into the kernel
> or not present at all or not have cap_sys_module or be in a uid mapped
> namespace, all of which would cause a failure.

It looks good to me.
Or...
I thought a little bit about this.
Considering the case of overlayfs is not enabled on the kernel, simply
it might be good only to display the error.

Thanks,
KATOH Yasufumi

From obnox at samba.org  Fri Jan 16 09:29:41 2015
From: obnox at samba.org (Michael Adam)
Date: Fri, 16 Jan 2015 10:29:41 +0100
Subject: [lxc-devel] how are lxc-download images created?
In-Reply-To: <20150115233046.GP3574@dakara>
References: <20150115232801.GK2519@obnox.de>
 <20150115233046.GP3574@dakara>
Message-ID: <20150116092941.GM2519@obnox.de>

On 2015-01-15 at 18:30 -0500, Stéphane Graber wrote:
> On Fri, Jan 16, 2015 at 12:28:01AM +0100, Michael Adam wrote:
> > Hi,
> > 
> > How are the images that lxc-download uses created?
> > It would be great to have these recipes in the tree.
> > 
> > I am asking because apparently the fedora and debian
> > jessie images don't have the improvements/fixes for
> > running systemd as init that are installed when
> > using the lxc-debian or lxc-fedora template to
> > create the container (lxc.kmsg = 0 and lxc.autodev = 1).
> > 
> 
> They are built using the standard templates on
> jenkins.linuxcontainers.org using the scripts at github.com/lxc/lxc-ci.

Thanks! I am still in the process of really understanding what
happens there. It seems that these call the regular lxc-foobar
templates. But apparently, the download template creates the
config for the downloaded image, essentially including the
common config for the given distribution.

The problem here is that this does not take into account the
special configuration needed for e.g. Debian Jessie and
Fedora 15+ in order to make systemd happy. The debian and
fedora templates have customizations for the generated config
for this, but the common config is not conditional.
This means that the mentioned containers created by lxc-download
are not usable as is for me, but need some config changes first.

How can we circumvent that problem? Without replicating the logic
from the other templates inside the download template?
I generally see two thinkable approaches:

- have the creation mechanism package the config generated by
  the distri template and have the lxc-download template
  use that (possibly with slight modifications) instead the
  self-generated one.

- have version-specific default/common configs shipped instead
  of only distri-specific and have lxc-download use these.

Is there something else we can do?

Thanks - Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150116/d3e6cb05/attachment.sig>

From alexander.idkfa.vladimirov at gmail.com  Fri Jan 16 10:37:00 2015
From: alexander.idkfa.vladimirov at gmail.com (Alexander Vladimirov)
Date: Fri, 16 Jan 2015 17:37:00 +0700
Subject: [lxc-devel] [PATCH] lxc-centos: pass releasever parameter to yum
Message-ID: <1421404620-26757-1-git-send-email-alexander.idkfa.vladimirov@gmail.com>

Signed-off-by: Alexander Vladimirov <alexander.idkfa.vladimirov at gmail.com>
---
allow lxc-centos template install from arch and probably other non-centos hosts
 templates/lxc-centos.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
index c7d2b89..c2b4db6 100644
--- a/templates/lxc-centos.in
+++ b/templates/lxc-centos.in
@@ -409,7 +409,7 @@ download_centos()
 
     # download a mini centos into a cache
     echo "Downloading centos minimal ..."
-    YUM="yum --installroot $INSTALL_ROOT -y --nogpgcheck"
+    YUM="yum --installroot $INSTALL_ROOT -y --nogpgcheck --releasever=$release"
     PKG_LIST="yum initscripts passwd rsyslog vim-minimal openssh-server openssh-clients dhclient chkconfig rootfiles policycoreutils"
 
     # use temporary repository definition
-- 
2.2.2


From G.Jaekel at DNB.DE  Fri Jan 16 15:13:39 2015
From: G.Jaekel at DNB.DE (=?UTF-8?B?R3VpZG8gSsOka2Vs?=)
Date: Fri, 16 Jan 2015 16:13:39 +0100
Subject: [lxc-devel] [PATCH] clarify explanation of veth
In-Reply-To: <20150115220820.GL3574@dakara>
References: <20150113212708.GA2519@obnox.de> <20150115220820.GL3574@dakara>
Message-ID: <54B92AA3.9040007@DNB.DE>

On 15.01.2015 23:08, Stéphane Graber ACKd:
> +              By default, <command>lxc</command> chooses a name for the

Is this the truth? I expect the veth driver (or the system) itself create the default names.


BTW: I'm using the container name as the outerside name for the veth. For me, is very convenient to have this direct correlation, e.g. for automated naming at SNMP-Discovery and -Monitoring.

Guido


From stgraber at ubuntu.com  Fri Jan 16 15:16:52 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 16 Jan 2015 10:16:52 -0500
Subject: [lxc-devel] [PATCH 1/1] lxc-start-ephemeral: handle the
 overlayfs workdir option (v2)
In-Reply-To: <20150116060243.GA19510@ubuntumail>
References: <20150113000837.GD14742@ubuntumail> <20150115220925.GM3574@dakara>
 <20150116060243.GA19510@ubuntumail>
Message-ID: <20150116151652.GV3574@dakara>

On Fri, Jan 16, 2015 at 06:02:43AM +0000, Serge Hallyn wrote:
> Quoting Stéphane Graber (stgraber at ubuntu.com):
> > On Tue, Jan 13, 2015 at 12:08:37AM +0000, Serge Hallyn wrote:
> > > We fixed this some time ago for basic lxc-start, but never did
> > > lxc-start-ephemeral.
> > > 
> > > Since the lxc-start patches were pushed, Miklos has given us a
> > > way to detect whether we need the workdir= option.  So the
> > > bdev.c code could be simplified to check for "overlay\n" in
> > > /proc/filesystems just as lxc-start-ephemeral does.  This
> > > patch doesn't do that.
> > > 
> > > Changelog (v2):
> > > 	1. use 'overlay' fstype for new overlay upstream module
> > > 	2. avoid using unneeded readlines().
> > > 
> > > Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> > 
> > Acked-by: Stéphane Graber <stgraber at ubuntu.com>
> 
> Oh, right, if you haven't already done it I'll try to remember tomorrow
> to send the patch to do the modprobe of overlay{,fs}.

I haven't.

> 
> > > ---
> > >  src/lxc/lxc-start-ephemeral.in | 25 ++++++++++++++++++++++++-
> > >  1 file changed, 24 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
> > > index c999e74..36e2579 100644
> > > --- a/src/lxc/lxc-start-ephemeral.in
> > > +++ b/src/lxc/lxc-start-ephemeral.in
> > > @@ -219,6 +219,14 @@ for entry in args.cdir:
> > >          dst_path = "%s/rootfs/%s" % (dest_path, src_path)
> > >          overlay_dirs += [(src_path, dst_path)]
> > >  
> > > +# do we have the new overlay fs which requires workdir, or the older
> > > +# overlayfs which does not?
> > > +have_new_overlay = False
> > > +with open("/proc/filesystems", "r") as fd:
> > > +    for line in fd:
> > > +        if line == "nodev\toverlay\n":
> > > +            have_new_overlay = True
> > > +
> > >  # Generate pre-mount script
> > >  with open(os.path.join(dest_path, "pre-mount"), "w+") as fd:
> > >      os.fchmod(fd.fileno(), 0o755)
> > > @@ -231,16 +239,31 @@ LXC_NAME="%s"
> > >      count = 0
> > >      for entry in overlay_dirs:
> > >          target = "%s/delta%s" % (dest_path, count)
> > > +        workdir = "%s/work%s" % (dest_path, count)
> > >          fd.write("mkdir -p %s %s\n" % (target, entry[1]))
> > > +        if have_new_overlay:
> > > +            fd.write("mkdir -p %s\n" % workdir)
> > >  
> > >          if args.storage_type == "tmpfs":
> > >              fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (target))
> > > +            if have_new_overlay:
> > > +                fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (workdir))
> > >  
> > >          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], target))
> > >          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
> > > +        if have_new_overlay:
> > > +            fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], workdir))
> > >  
> > >          if args.union_type == "overlayfs":
> > > -            fd.write("mount -n -t overlayfs"
> > > +            if have_new_overlay:
> > > +                fd.write("mount -n -t overlay"
> > > +                     " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
> > > +                         target,
> > > +                         entry[0],
> > > +                         workdir,
> > > +                         entry[1]))
> > > +            else:
> > > +                fd.write("mount -n -t overlayfs"
> > >                       " -oupperdir=%s,lowerdir=%s none %s\n" % (
> > >                           target,
> > >                           entry[0],
> > > -- 
> > > 2.1.0
> > > 
> > > _______________________________________________
> > > lxc-devel mailing list
> > > lxc-devel at lists.linuxcontainers.org
> > > http://lists.linuxcontainers.org/listinfo/lxc-devel
> > 
> > -- 
> > Stéphane Graber
> > Ubuntu developer
> > http://www.ubuntu.com
> 
> 
> 
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150116/657aa1bd/attachment.sig>

From stgraber at ubuntu.com  Fri Jan 16 15:29:34 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 16 Jan 2015 10:29:34 -0500
Subject: [lxc-devel] how are lxc-download images created?
In-Reply-To: <20150116092941.GM2519@obnox.de>
References: <20150115232801.GK2519@obnox.de> <20150115233046.GP3574@dakara>
 <20150116092941.GM2519@obnox.de>
Message-ID: <20150116152934.GW3574@dakara>

On Fri, Jan 16, 2015 at 10:29:41AM +0100, Michael Adam wrote:
> On 2015-01-15 at 18:30 -0500, Stéphane Graber wrote:
> > On Fri, Jan 16, 2015 at 12:28:01AM +0100, Michael Adam wrote:
> > > Hi,
> > > 
> > > How are the images that lxc-download uses created?
> > > It would be great to have these recipes in the tree.
> > > 
> > > I am asking because apparently the fedora and debian
> > > jessie images don't have the improvements/fixes for
> > > running systemd as init that are installed when
> > > using the lxc-debian or lxc-fedora template to
> > > create the container (lxc.kmsg = 0 and lxc.autodev = 1).
> > > 
> > 
> > They are built using the standard templates on
> > jenkins.linuxcontainers.org using the scripts at github.com/lxc/lxc-ci.
> 
> Thanks! I am still in the process of really understanding what
> happens there. It seems that these call the regular lxc-foobar
> templates. But apparently, the download template creates the
> config for the downloaded image, essentially including the
> common config for the given distribution.
> 
> The problem here is that this does not take into account the
> special configuration needed for e.g. Debian Jessie and
> Fedora 15+ in order to make systemd happy. The debian and
> fedora templates have customizations for the generated config
> for this, but the common config is not conditional.
> This means that the mentioned containers created by lxc-download
> are not usable as is for me, but need some config changes first.
> 
> How can we circumvent that problem? Without replicating the logic
> from the other templates inside the download template?
> I generally see two thinkable approaches:
> 
> - have the creation mechanism package the config generated by
>   the distri template and have the lxc-download template
>   use that (possibly with slight modifications) instead the
>   self-generated one.
> 
> - have version-specific default/common configs shipped instead
>   of only distri-specific and have lxc-download use these.
> 
> Is there something else we can do?
> 
> Thanks - Michael

We're currently busy working on getting LXC to work properly with
systemd by default for both privileged and unprivileged containers.

The reason why I never liked the conditional config options as are
implemented today in some of the templates and why I didn't replicate
that for lxc-download is that I want people to be able to upgrade their
containers.

That's why we're working on reworking lxc.autodev and init system
detection within LXC so that you never need to set any of those options
to begin with and then can dist-upgrade from a sysvinit version of your
container to a systemd version of your container or from usptart to
systemd and things will just work.


That work is currently all that's separating us from current git master
and LXC 1.1.

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150116/fcb2f3e1/attachment.sig>

From stgraber at ubuntu.com  Fri Jan 16 15:31:59 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 16 Jan 2015 10:31:59 -0500
Subject: [lxc-devel] [PATCH] clarify explanation of veth
In-Reply-To: <54B92AA3.9040007@DNB.DE>
References: <20150113212708.GA2519@obnox.de> <20150115220820.GL3574@dakara>
 <54B92AA3.9040007@DNB.DE>
Message-ID: <20150116153159.GX3574@dakara>

On Fri, Jan 16, 2015 at 04:13:39PM +0100, Guido Jäkel wrote:
> On 15.01.2015 23:08, Stéphane Graber ACKd:
> > +              By default, <command>lxc</command> chooses a name for the
> 
> Is this the truth? I expect the veth driver (or the system) itself create the default names.
> 
> 
> BTW: I'm using the container name as the outerside name for the veth. For me, is very convenient to have this direct correlation, e.g. for automated naming at SNMP-Discovery and -Monitoring.
> 
> Guido

It's the truth. LXC uses a vethXXXX template rather than what you'd get
from the kernel which is just vethX where X is an incrementing digit.

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150116/81f480b1/attachment.sig>

From G.Jaekel at DNB.DE  Fri Jan 16 15:50:50 2015
From: G.Jaekel at DNB.DE (=?UTF-8?B?R3VpZG8gSsOka2Vs?=)
Date: Fri, 16 Jan 2015 16:50:50 +0100
Subject: [lxc-devel] [PATCH] clarify explanation of veth
In-Reply-To: <20150116153159.GX3574@dakara>
References: <20150113212708.GA2519@obnox.de> <20150115220820.GL3574@dakara>
 <54B92AA3.9040007@DNB.DE> <20150116153159.GX3574@dakara>
Message-ID: <54B9335A.7010000@DNB.DE>

On 16.01.2015 16:31, Stéphane Graber wrote:
> On Fri, Jan 16, 2015 at 04:13:39PM +0100, Guido Jäkel wrote:
>> On 15.01.2015 23:08, Stéphane Graber ACKd:
>>> +              By default, <command>lxc</command> chooses a name for the
>>
>> Is this the truth? I expect the veth driver (or the system) itself create the default names.
>>
>>
>> BTW: I'm using the container name as the outerside name for the veth. For me, is very convenient to have this direct correlation, e.g. for automated naming at SNMP-Discovery and -Monitoring.
>>
>> Guido
> 
> It's the truth. LXC uses a vethXXXX template rather than what you'd get
> from the kernel which is just vethX where X is an incrementing digit.

Well, I should have taken a look in the code repository before. Please, may I then (nevertheless) ask for the motivation of the choice for pattern vethXXXX ?


From stgraber at ubuntu.com  Fri Jan 16 15:54:44 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 16 Jan 2015 10:54:44 -0500
Subject: [lxc-devel] [PATCH] clarify explanation of veth
In-Reply-To: <54B9335A.7010000@DNB.DE>
References: <20150113212708.GA2519@obnox.de> <20150115220820.GL3574@dakara>
 <54B92AA3.9040007@DNB.DE> <20150116153159.GX3574@dakara>
 <54B9335A.7010000@DNB.DE>
Message-ID: <20150116155444.GZ3574@dakara>

On Fri, Jan 16, 2015 at 04:50:50PM +0100, Guido Jäkel wrote:
> On 16.01.2015 16:31, Stéphane Graber wrote:
> > On Fri, Jan 16, 2015 at 04:13:39PM +0100, Guido Jäkel wrote:
> >> On 15.01.2015 23:08, Stéphane Graber ACKd:
> >>> +              By default, <command>lxc</command> chooses a name for the
> >>
> >> Is this the truth? I expect the veth driver (or the system) itself create the default names.
> >>
> >>
> >> BTW: I'm using the container name as the outerside name for the veth. For me, is very convenient to have this direct correlation, e.g. for automated naming at SNMP-Discovery and -Monitoring.
> >>
> >> Guido
> > 
> > It's the truth. LXC uses a vethXXXX template rather than what you'd get
> > from the kernel which is just vethX where X is an incrementing digit.
> 
> Well, I should have taken a look in the code repository before. Please, may I then (nevertheless) ask for the motivation of the choice for pattern vethXXXX ?

I'm not sure what the initial reason for it is. However to me it makes
it trivial to differentiate lxc-created veth devices vs manually created
ones.

Another potential reason why this was done to begin with is that if they
are sequentially numbered and a container side veth is moved back to the
host namespace, a name clash is likely which would then make the kernel
rename it to renameX and would confuse anything which assumes that veth*
are veth devices and that everything else can be used for host
connectivity (like NetworkManager).


-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150116/d9f66907/attachment.sig>

From obnox at samba.org  Fri Jan 16 17:15:57 2015
From: obnox at samba.org (Michael Adam)
Date: Fri, 16 Jan 2015 18:15:57 +0100
Subject: [lxc-devel] how are lxc-download images created?
In-Reply-To: <20150116152934.GW3574@dakara>
References: <20150115232801.GK2519@obnox.de> <20150115233046.GP3574@dakara>
 <20150116092941.GM2519@obnox.de> <20150116152934.GW3574@dakara>
Message-ID: <20150116171557.GQ2519@obnox.de>

On 2015-01-16 at 10:29 -0500, Stéphane Graber wrote:
> 
> We're currently busy working on getting LXC to work properly with
> systemd by default for both privileged and unprivileged containers.
> 
> The reason why I never liked the conditional config options as are
> implemented today in some of the templates and why I didn't replicate
> that for lxc-download is that I want people to be able to upgrade their
> containers.
> 
> That's why we're working on reworking lxc.autodev and init system
> detection within LXC so that you never need to set any of those options
> to begin with and then can dist-upgrade from a sysvinit version of your
> container to a systemd version of your container or from usptart to
> systemd and things will just work.
> 
> 
> That work is currently all that's separating us from current git master
> and LXC 1.1.

Sounds very good and thanks for the details!

I'm happy to help in getting that done if it is interesting.

Cheers - Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150116/fc0805f6/attachment.sig>

From obnox at samba.org  Fri Jan 16 17:30:17 2015
From: obnox at samba.org (Michael Adam)
Date: Fri, 16 Jan 2015 18:30:17 +0100
Subject: [lxc-devel] how are lxc-download images created?
In-Reply-To: <20150116171557.GQ2519@obnox.de>
References: <20150115232801.GK2519@obnox.de> <20150115233046.GP3574@dakara>
 <20150116092941.GM2519@obnox.de> <20150116152934.GW3574@dakara>
 <20150116171557.GQ2519@obnox.de>
Message-ID: <20150116173017.GR2519@obnox.de>

On 2015-01-16 at 18:15 +0100, Michael Adam wrote:
> On 2015-01-16 at 10:29 -0500, Stéphane Graber wrote:
> > 
> > We're currently busy working on getting LXC to work properly with
> > systemd by default for both privileged and unprivileged containers.
> > 
> > The reason why I never liked the conditional config options as are
> > implemented today in some of the templates and why I didn't replicate
> > that for lxc-download is that I want people to be able to upgrade their
> > containers.
> > 
> > That's why we're working on reworking lxc.autodev and init system
> > detection within LXC so that you never need to set any of those options
> > to begin with and then can dist-upgrade from a sysvinit version of your
> > container to a systemd version of your container or from usptart to
> > systemd and things will just work.
> > 
> > 
> > That work is currently all that's separating us from current git master
> > and LXC 1.1.
> 
> Sounds very good and thanks for the details!
> 
> I'm happy to help in getting that done if it is interesting.

Ok that was misleading! I meant to say:
I am happy to help if it is interesting for you to get some help. ;-)

Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150116/f518b917/attachment.sig>

From serge.hallyn at ubuntu.com  Fri Jan 16 19:22:17 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 16 Jan 2015 19:22:17 +0000
Subject: [lxc-devel] [PATCH] implement lxc.include for directories
Message-ID: <20150116192217.GA485@ubuntumail>

If you have 'lxc.include = /some/dir' and /some/dir is a directory, then any
'*.conf" files under /some/dir will be read.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/bdev.c    |  9 ---------
 src/lxc/confile.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 src/lxc/utils.c   |  9 +++++++++
 src/lxc/utils.h   |  1 +
 4 files changed, 65 insertions(+), 9 deletions(-)

diff --git a/src/lxc/bdev.c b/src/lxc/bdev.c
index 5c6b00a..c0cc050 100644
--- a/src/lxc/bdev.c
+++ b/src/lxc/bdev.c
@@ -357,15 +357,6 @@ struct bdev_type {
 	const struct bdev_ops *ops;
 };
 
-static int is_dir(const char *path)
-{
-	struct stat statbuf;
-	int ret = stat(path, &statbuf);
-	if (ret == 0 && S_ISDIR(statbuf.st_mode))
-		return 1;
-	return 0;
-}
-
 static int dir_detect(const char *path)
 {
 	if (strncmp(path, "dir:", 4) == 0)
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index 0366959..e73f97c 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -37,6 +37,7 @@
 #include <netinet/in.h>
 #include <net/if.h>
 #include <time.h>
+#include <dirent.h>
 
 #include "parse.h"
 #include "config.h"
@@ -1663,9 +1664,63 @@ int append_unexp_config_line(const char *line, struct lxc_conf *conf)
 	return 0;
 }
 
+static int do_includedir(const char *dirp, struct lxc_conf *lxc_conf)
+{
+	struct dirent dirent, *direntp;
+	DIR *dir;
+	char path[MAXPATHLEN];
+	int ret = -1, len;
+
+	dir = opendir(dirp);
+	if (!dir) {
+		SYSERROR("failed to open '%s'", dirp);
+		return -1;
+	}
+
+	while (!readdir_r(dir, &dirent, &direntp)) {
+		const char *fnam;
+		if (!direntp)
+			break;
+
+		fnam = direntp->d_name;
+INFO("looking at %s", fnam);
+		if (!strcmp(fnam, "."))
+			continue;
+
+		if (!strcmp(fnam, ".."))
+			continue;
+
+		len = strlen(fnam);
+		if (len < 6 || strncmp(fnam+len-5, ".conf", 5) != 0)
+			continue;
+		len = snprintf(path, MAXPATHLEN, "%s/%s", dirp, fnam);
+		if (len < 0 || len >= MAXPATHLEN) {
+			ERROR("lxc.include filename too long under '%s'", dirp);
+			ret = -1;
+			goto out;
+		}
+INFO("reading %s", path);
+
+		ret = lxc_config_read(path, lxc_conf, true);
+		if (ret < 0)
+			goto out;
+	}
+	ret = 0;
+
+out:
+INFO("returning %d", ret);
+	if (closedir(dir))
+		WARN("lxc.include dir: failed to close directory");
+
+	return ret;
+}
+
 static int config_includefile(const char *key, const char *value,
 			  struct lxc_conf *lxc_conf)
 {
+	if (is_dir(value))
+		return do_includedir(value, lxc_conf);
+
 	return lxc_config_read(value, lxc_conf, true);
 }
 
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index 2037ef0..23b1b11 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -1497,3 +1497,12 @@ int print_to_file(const char *file, const char *content)
 	fclose(f);
 	return ret;
 }
+
+int is_dir(const char *path)
+{
+	struct stat statbuf;
+	int ret = stat(path, &statbuf);
+	if (ret == 0 && S_ISDIR(statbuf.st_mode))
+		return 1;
+	return 0;
+}
diff --git a/src/lxc/utils.h b/src/lxc/utils.h
index 5ffafca..ae2c851 100644
--- a/src/lxc/utils.h
+++ b/src/lxc/utils.h
@@ -284,3 +284,4 @@ bool file_exists(const char *f);
 char *choose_init(const char *rootfs);
 int print_to_file(const char *file, const char *content);
 bool switch_to_ns(pid_t pid, const char *ns);
+int is_dir(const char *path);
-- 
2.1.0


From stgraber at ubuntu.com  Fri Jan 16 19:27:15 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 16 Jan 2015 14:27:15 -0500
Subject: [lxc-devel] [PATCH] implement lxc.include for directories
In-Reply-To: <20150116192217.GA485@ubuntumail>
References: <20150116192217.GA485@ubuntumail>
Message-ID: <20150116192715.GB3574@dakara>

On Fri, Jan 16, 2015 at 07:22:17PM +0000, Serge Hallyn wrote:
> If you have 'lxc.include = /some/dir' and /some/dir is a directory, then any
> '*.conf" files under /some/dir will be read.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Some comments below.

Also, I'm wondering, what happens when you save_config(), does the save
config retain the lxc.include = /path/to/dir or is that expanded to
individual includes for each dir?

> ---
>  src/lxc/bdev.c    |  9 ---------
>  src/lxc/confile.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
>  src/lxc/utils.c   |  9 +++++++++
>  src/lxc/utils.h   |  1 +
>  4 files changed, 65 insertions(+), 9 deletions(-)
> 
> diff --git a/src/lxc/bdev.c b/src/lxc/bdev.c
> index 5c6b00a..c0cc050 100644
> --- a/src/lxc/bdev.c
> +++ b/src/lxc/bdev.c
> @@ -357,15 +357,6 @@ struct bdev_type {
>  	const struct bdev_ops *ops;
>  };
>  
> -static int is_dir(const char *path)
> -{
> -	struct stat statbuf;
> -	int ret = stat(path, &statbuf);
> -	if (ret == 0 && S_ISDIR(statbuf.st_mode))
> -		return 1;
> -	return 0;
> -}
> -
>  static int dir_detect(const char *path)
>  {
>  	if (strncmp(path, "dir:", 4) == 0)
> diff --git a/src/lxc/confile.c b/src/lxc/confile.c
> index 0366959..e73f97c 100644
> --- a/src/lxc/confile.c
> +++ b/src/lxc/confile.c
> @@ -37,6 +37,7 @@
>  #include <netinet/in.h>
>  #include <net/if.h>
>  #include <time.h>
> +#include <dirent.h>
>  
>  #include "parse.h"
>  #include "config.h"
> @@ -1663,9 +1664,63 @@ int append_unexp_config_line(const char *line, struct lxc_conf *conf)
>  	return 0;
>  }
>  
> +static int do_includedir(const char *dirp, struct lxc_conf *lxc_conf)
> +{
> +	struct dirent dirent, *direntp;
> +	DIR *dir;
> +	char path[MAXPATHLEN];
> +	int ret = -1, len;
> +
> +	dir = opendir(dirp);
> +	if (!dir) {
> +		SYSERROR("failed to open '%s'", dirp);
> +		return -1;
> +	}
> +
> +	while (!readdir_r(dir, &dirent, &direntp)) {
> +		const char *fnam;
> +		if (!direntp)
> +			break;
> +
> +		fnam = direntp->d_name;
> +INFO("looking at %s", fnam);

^ Probably should go away?

> +		if (!strcmp(fnam, "."))
> +			continue;
> +
> +		if (!strcmp(fnam, ".."))
> +			continue;
> +
> +		len = strlen(fnam);
> +		if (len < 6 || strncmp(fnam+len-5, ".conf", 5) != 0)
> +			continue;
> +		len = snprintf(path, MAXPATHLEN, "%s/%s", dirp, fnam);
> +		if (len < 0 || len >= MAXPATHLEN) {
> +			ERROR("lxc.include filename too long under '%s'", dirp);
> +			ret = -1;
> +			goto out;
> +		}
> +INFO("reading %s", path);

Too

> +
> +		ret = lxc_config_read(path, lxc_conf, true);
> +		if (ret < 0)
> +			goto out;
> +	}
> +	ret = 0;
> +
> +out:
> +INFO("returning %d", ret);

Too

> +	if (closedir(dir))
> +		WARN("lxc.include dir: failed to close directory");
> +
> +	return ret;
> +}
> +
>  static int config_includefile(const char *key, const char *value,
>  			  struct lxc_conf *lxc_conf)
>  {
> +	if (is_dir(value))
> +		return do_includedir(value, lxc_conf);
> +
>  	return lxc_config_read(value, lxc_conf, true);
>  }
>  
> diff --git a/src/lxc/utils.c b/src/lxc/utils.c
> index 2037ef0..23b1b11 100644
> --- a/src/lxc/utils.c
> +++ b/src/lxc/utils.c
> @@ -1497,3 +1497,12 @@ int print_to_file(const char *file, const char *content)
>  	fclose(f);
>  	return ret;
>  }
> +
> +int is_dir(const char *path)
> +{
> +	struct stat statbuf;
> +	int ret = stat(path, &statbuf);
> +	if (ret == 0 && S_ISDIR(statbuf.st_mode))
> +		return 1;
> +	return 0;
> +}
> diff --git a/src/lxc/utils.h b/src/lxc/utils.h
> index 5ffafca..ae2c851 100644
> --- a/src/lxc/utils.h
> +++ b/src/lxc/utils.h
> @@ -284,3 +284,4 @@ bool file_exists(const char *f);
>  char *choose_init(const char *rootfs);
>  int print_to_file(const char *file, const char *content);
>  bool switch_to_ns(pid_t pid, const char *ns);
> +int is_dir(const char *path);
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150116/25da8953/attachment-0001.sig>

From serge.hallyn at ubuntu.com  Fri Jan 16 20:22:46 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 16 Jan 2015 20:22:46 +0000
Subject: [lxc-devel] [PATCH] implement lxc.include for directories
In-Reply-To: <20150116192715.GB3574@dakara>
References: <20150116192217.GA485@ubuntumail>
 <20150116192715.GB3574@dakara>
Message-ID: <20150116202246.GD485@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> On Fri, Jan 16, 2015 at 07:22:17PM +0000, Serge Hallyn wrote:
> > If you have 'lxc.include = /some/dir' and /some/dir is a directory, then any
> > '*.conf" files under /some/dir will be read.
> > 
> > Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> 
> Some comments below.
> 
> Also, I'm wondering, what happens when you save_config(), does the save
> config retain the lxc.include = /path/to/dir or is that expanded to
> individual includes for each dir?

It retains the /path/to/dir:

# Template used to create this container: /usr/share/lxc/templates/lxc-download
# Parameters passed to the template: -d ubuntu -r trusty -a amd64
# For additional config options, please look at lxc.container.conf(5)
# Distribution configuration
lxc.include = /usr/share/lxc/config/ubuntu.common.conf
lxc.arch = x86_64
# Container specific configuration
lxc.rootfs = /var/lib/lxc/t1/rootfs
lxc.utsname = t1
# Network configuration
lxc.network.type = veth
lxc.network.link = lxcbr0
lxc.network.flags = up
lxc.network.hwaddr = 00:16:3e:xx:xx:xx
lxc.include = /var/lib/lxc/t1/x

(/var/lib/lxc/t1/x is a directory)

Comments removed in below patch;

Subject: [PATCH 1/1] implement lxc.include for directories

If you have 'lxc.include = /some/dir' and /some/dir is a directory, then any
'*.conf" files under /some/dir will be read.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/bdev.c    |  9 ---------
 src/lxc/confile.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 src/lxc/utils.c   |  9 +++++++++
 src/lxc/utils.h   |  1 +
 4 files changed, 62 insertions(+), 9 deletions(-)

diff --git a/src/lxc/bdev.c b/src/lxc/bdev.c
index 5c6b00a..c0cc050 100644
--- a/src/lxc/bdev.c
+++ b/src/lxc/bdev.c
@@ -357,15 +357,6 @@ struct bdev_type {
 	const struct bdev_ops *ops;
 };
 
-static int is_dir(const char *path)
-{
-	struct stat statbuf;
-	int ret = stat(path, &statbuf);
-	if (ret == 0 && S_ISDIR(statbuf.st_mode))
-		return 1;
-	return 0;
-}
-
 static int dir_detect(const char *path)
 {
 	if (strncmp(path, "dir:", 4) == 0)
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index 0366959..1d42941 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -37,6 +37,7 @@
 #include <netinet/in.h>
 #include <net/if.h>
 #include <time.h>
+#include <dirent.h>
 
 #include "parse.h"
 #include "config.h"
@@ -1663,9 +1664,60 @@ int append_unexp_config_line(const char *line, struct lxc_conf *conf)
 	return 0;
 }
 
+static int do_includedir(const char *dirp, struct lxc_conf *lxc_conf)
+{
+	struct dirent dirent, *direntp;
+	DIR *dir;
+	char path[MAXPATHLEN];
+	int ret = -1, len;
+
+	dir = opendir(dirp);
+	if (!dir) {
+		SYSERROR("failed to open '%s'", dirp);
+		return -1;
+	}
+
+	while (!readdir_r(dir, &dirent, &direntp)) {
+		const char *fnam;
+		if (!direntp)
+			break;
+
+		fnam = direntp->d_name;
+		if (!strcmp(fnam, "."))
+			continue;
+
+		if (!strcmp(fnam, ".."))
+			continue;
+
+		len = strlen(fnam);
+		if (len < 6 || strncmp(fnam+len-5, ".conf", 5) != 0)
+			continue;
+		len = snprintf(path, MAXPATHLEN, "%s/%s", dirp, fnam);
+		if (len < 0 || len >= MAXPATHLEN) {
+			ERROR("lxc.include filename too long under '%s'", dirp);
+			ret = -1;
+			goto out;
+		}
+
+		ret = lxc_config_read(path, lxc_conf, true);
+		if (ret < 0)
+			goto out;
+	}
+	ret = 0;
+
+out:
+	if (closedir(dir))
+		WARN("lxc.include dir: failed to close directory");
+
+	return ret;
+}
+
 static int config_includefile(const char *key, const char *value,
 			  struct lxc_conf *lxc_conf)
 {
+	if (is_dir(value))
+		return do_includedir(value, lxc_conf);
+
 	return lxc_config_read(value, lxc_conf, true);
 }
 
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index 2037ef0..23b1b11 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -1497,3 +1497,12 @@ int print_to_file(const char *file, const char *content)
 	fclose(f);
 	return ret;
 }
+
+int is_dir(const char *path)
+{
+	struct stat statbuf;
+	int ret = stat(path, &statbuf);
+	if (ret == 0 && S_ISDIR(statbuf.st_mode))
+		return 1;
+	return 0;
+}
diff --git a/src/lxc/utils.h b/src/lxc/utils.h
index 5ffafca..ae2c851 100644
--- a/src/lxc/utils.h
+++ b/src/lxc/utils.h
@@ -284,3 +284,4 @@ bool file_exists(const char *f);
 char *choose_init(const char *rootfs);
 int print_to_file(const char *file, const char *content);
 bool switch_to_ns(pid_t pid, const char *ns);
+int is_dir(const char *path);
-- 
2.1.0


From stgraber at ubuntu.com  Fri Jan 16 20:25:20 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 16 Jan 2015 15:25:20 -0500
Subject: [lxc-devel] [PATCH] implement lxc.include for directories
In-Reply-To: <20150116202246.GD485@ubuntumail>
References: <20150116192217.GA485@ubuntumail> <20150116192715.GB3574@dakara>
 <20150116202246.GD485@ubuntumail>
Message-ID: <20150116202520.GD3574@dakara>

On Fri, Jan 16, 2015 at 08:22:46PM +0000, Serge Hallyn wrote:
> Quoting Stéphane Graber (stgraber at ubuntu.com):
> > On Fri, Jan 16, 2015 at 07:22:17PM +0000, Serge Hallyn wrote:
> > > If you have 'lxc.include = /some/dir' and /some/dir is a directory, then any
> > > '*.conf" files under /some/dir will be read.
> > > 
> > > Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> > 
> > Some comments below.
> > 
> > Also, I'm wondering, what happens when you save_config(), does the save
> > config retain the lxc.include = /path/to/dir or is that expanded to
> > individual includes for each dir?
> 
> It retains the /path/to/dir:
> 
> # Template used to create this container: /usr/share/lxc/templates/lxc-download
> # Parameters passed to the template: -d ubuntu -r trusty -a amd64
> # For additional config options, please look at lxc.container.conf(5)
> # Distribution configuration
> lxc.include = /usr/share/lxc/config/ubuntu.common.conf
> lxc.arch = x86_64
> # Container specific configuration
> lxc.rootfs = /var/lib/lxc/t1/rootfs
> lxc.utsname = t1
> # Network configuration
> lxc.network.type = veth
> lxc.network.link = lxcbr0
> lxc.network.flags = up
> lxc.network.hwaddr = 00:16:3e:xx:xx:xx
> lxc.include = /var/lib/lxc/t1/x
> 
> (/var/lib/lxc/t1/x is a directory)
> 
> Comments removed in below patch;
> 
> Subject: [PATCH 1/1] implement lxc.include for directories
> 
> If you have 'lxc.include = /some/dir' and /some/dir is a directory, then any
> '*.conf" files under /some/dir will be read.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/bdev.c    |  9 ---------
>  src/lxc/confile.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
>  src/lxc/utils.c   |  9 +++++++++
>  src/lxc/utils.h   |  1 +
>  4 files changed, 62 insertions(+), 9 deletions(-)
> 
> diff --git a/src/lxc/bdev.c b/src/lxc/bdev.c
> index 5c6b00a..c0cc050 100644
> --- a/src/lxc/bdev.c
> +++ b/src/lxc/bdev.c
> @@ -357,15 +357,6 @@ struct bdev_type {
>  	const struct bdev_ops *ops;
>  };
>  
> -static int is_dir(const char *path)
> -{
> -	struct stat statbuf;
> -	int ret = stat(path, &statbuf);
> -	if (ret == 0 && S_ISDIR(statbuf.st_mode))
> -		return 1;
> -	return 0;
> -}
> -
>  static int dir_detect(const char *path)
>  {
>  	if (strncmp(path, "dir:", 4) == 0)
> diff --git a/src/lxc/confile.c b/src/lxc/confile.c
> index 0366959..1d42941 100644
> --- a/src/lxc/confile.c
> +++ b/src/lxc/confile.c
> @@ -37,6 +37,7 @@
>  #include <netinet/in.h>
>  #include <net/if.h>
>  #include <time.h>
> +#include <dirent.h>
>  
>  #include "parse.h"
>  #include "config.h"
> @@ -1663,9 +1664,60 @@ int append_unexp_config_line(const char *line, struct lxc_conf *conf)
>  	return 0;
>  }
>  
> +static int do_includedir(const char *dirp, struct lxc_conf *lxc_conf)
> +{
> +	struct dirent dirent, *direntp;
> +	DIR *dir;
> +	char path[MAXPATHLEN];
> +	int ret = -1, len;
> +
> +	dir = opendir(dirp);
> +	if (!dir) {
> +		SYSERROR("failed to open '%s'", dirp);
> +		return -1;
> +	}
> +
> +	while (!readdir_r(dir, &dirent, &direntp)) {
> +		const char *fnam;
> +		if (!direntp)
> +			break;
> +
> +		fnam = direntp->d_name;
> +		if (!strcmp(fnam, "."))
> +			continue;
> +
> +		if (!strcmp(fnam, ".."))
> +			continue;
> +
> +		len = strlen(fnam);
> +		if (len < 6 || strncmp(fnam+len-5, ".conf", 5) != 0)
> +			continue;
> +		len = snprintf(path, MAXPATHLEN, "%s/%s", dirp, fnam);
> +		if (len < 0 || len >= MAXPATHLEN) {
> +			ERROR("lxc.include filename too long under '%s'", dirp);
> +			ret = -1;
> +			goto out;
> +		}
> +
> +		ret = lxc_config_read(path, lxc_conf, true);
> +		if (ret < 0)
> +			goto out;
> +	}
> +	ret = 0;
> +
> +out:
> +	if (closedir(dir))
> +		WARN("lxc.include dir: failed to close directory");
> +
> +	return ret;
> +}
> +
>  static int config_includefile(const char *key, const char *value,
>  			  struct lxc_conf *lxc_conf)
>  {
> +	if (is_dir(value))
> +		return do_includedir(value, lxc_conf);
> +
>  	return lxc_config_read(value, lxc_conf, true);
>  }
>  
> diff --git a/src/lxc/utils.c b/src/lxc/utils.c
> index 2037ef0..23b1b11 100644
> --- a/src/lxc/utils.c
> +++ b/src/lxc/utils.c
> @@ -1497,3 +1497,12 @@ int print_to_file(const char *file, const char *content)
>  	fclose(f);
>  	return ret;
>  }
> +
> +int is_dir(const char *path)
> +{
> +	struct stat statbuf;
> +	int ret = stat(path, &statbuf);
> +	if (ret == 0 && S_ISDIR(statbuf.st_mode))
> +		return 1;
> +	return 0;
> +}
> diff --git a/src/lxc/utils.h b/src/lxc/utils.h
> index 5ffafca..ae2c851 100644
> --- a/src/lxc/utils.h
> +++ b/src/lxc/utils.h
> @@ -284,3 +284,4 @@ bool file_exists(const char *f);
>  char *choose_init(const char *rootfs);
>  int print_to_file(const char *file, const char *content);
>  bool switch_to_ns(pid_t pid, const char *ns);
> +int is_dir(const char *path);
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150116/5b7ae709/attachment.sig>

From stgraber at ubuntu.com  Fri Jan 16 23:03:01 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 16 Jan 2015 18:03:01 -0500
Subject: [lxc-devel] [PATCH] doc: Update the description of the veth in
 the Japanese lxc.container.conf(5)
In-Reply-To: <1421391251-19210-1-git-send-email-karma@jazz.email.ne.jp>
References: <1421391251-19210-1-git-send-email-karma@jazz.email.ne.jp>
Message-ID: <20150116230301.GE3574@dakara>

On Fri, Jan 16, 2015 at 03:54:11PM +0900, KATOH Yasufumi wrote:
> Update for the commit 38005c5
> 
> Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  doc/ja/lxc.container.conf.sgml.in | 52 +++++++++++++++++++--------------------
>  1 file changed, 26 insertions(+), 26 deletions(-)
> 
> diff --git a/doc/ja/lxc.container.conf.sgml.in b/doc/ja/lxc.container.conf.sgml.in
> index f14ef31..4d38c8e 100644
> --- a/doc/ja/lxc.container.conf.sgml.in
> +++ b/doc/ja/lxc.container.conf.sgml.in
> @@ -366,34 +366,34 @@ by KATOH Yasufumi <karma at jazz.email.ne.jp>
>  	      <option>empty:</option> ループバックインターフェースだけを作成します。
>  	    </para>
>  
> -	    <para>
> +            <para>
>                <!--
> -	      <option>veth:</option> a peer network device is created
> -	      with one side assigned to the container and the other
> -	      side is attached to a bridge specified by
> -	      the <option>lxc.network.link</option>. If the bridge is
> -	      not specified, then the veth pair device will be created
> -	      but not attached to any bridge. Otherwise, the bridge
> -	      has to be setup before on the
> -	      system, <command>lxc</command> won't handle any
> -	      configuration outside of the container.  By
> -	      default <command>lxc</command> choose a name for the
> -	      network device belonging to the outside of the
> -	      container, this name is handled
> -	      by <command>lxc</command>, but if you wish to handle
> -	      this name yourself, you can tell <command>lxc</command>
> -	      to set a specific name with
> -	      the <option>lxc.network.veth.pair</option> option (except for
> -	      unprivileged containers where this option is ignored for security
> -	      reasons).
> -              -->
> -              <option>veth:</option> 一方がコンテナに、もう一方が <option>lxc.network.link</option> で指定されるブリッジにアタッチされる、ピアネットワークデバイスを作成します。
> -              もし、ブリッジが指定されていない場合、veth ペアデバイスは作成されますが、ブリッジにはアタッチされません。
> -              ブリッジはシステムで事前に設定する必要があります。
> -              さもなければ、<command>lxc</command> はコンテナ外のいかなる設定も扱うことはできないでしょう。
> -              デフォルトでは、<command>lxc</command> はコンテナの外部に属するネットワークデバイスに対する名前を決定し、<command>lxc</command> はこの名前を使います。
> +              <option>veth:</option> a virtual ethernet pair
> +              device is created with one side assigned to the container
> +              and the other side attached to a bridge specified by
> +              the <option>lxc.network.link</option> option.
> +              If the bridge is not specified, then the veth pair device
> +              will be created but not attached to any bridge.
> +              Otherwise, the bridge has to be created on the system
> +              before starting the container.
> +              <command>lxc</command> won't handle any
> +              configuration outside of the container.
> +              By default, <command>lxc</command> chooses a name for the
> +              network device belonging to the outside of the
> +              container, but if you wish to handle
> +              this name yourselves, you can tell <command>lxc</command>
> +              to set a specific name with
> +              the <option>lxc.network.veth.pair</option> option (except for
> +              unprivileged containers where this option is ignored for security
> +              reasons).
> +              -->
> +              <option>veth:</option > 一方がコンテナに、もう一方が <option>lxc.network.link</option> オプションで指定されたブリッジに接続されるペアの仮想イーサネットデバイスを作成します。
> +              もし、ブリッジが指定されていない場合、veth ペアデバイスは作成されますが、ブリッジには接続されません。
> +              ブリッジはコンテナが開始する前にシステムで事前に設定しておく必要があります。
> +              <command>lxc</command> はコンテナ外の設定を扱うことはありません。
> +              デフォルトでは、<command>lxc</command> がコンテナの外部に属するネットワークデバイスに対する名前を決定します。
>                しかし、もしこの名前を自分で指定したい場合、<option>lxc.network.veth.pair</option> オプションを使って名前を設定し、lxc に対して指定をすることができます (非特権コンテナの場合をのぞきます。セキュリティ上の理由からこのオプションは無視されます)。
> -	    </para>
> +            </para>
>  
>  	    <para>
>                <!--
> -- 
> 2.2.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150116/219191ec/attachment.sig>

From stgraber at ubuntu.com  Fri Jan 16 23:04:45 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 16 Jan 2015 18:04:45 -0500
Subject: [lxc-devel] [PATCH] lxc-centos: pass releasever parameter to yum
In-Reply-To: <1421404620-26757-1-git-send-email-alexander.idkfa.vladimirov@gmail.com>
References: <1421404620-26757-1-git-send-email-alexander.idkfa.vladimirov@gmail.com>
Message-ID: <20150116230445.GF3574@dakara>

On Fri, Jan 16, 2015 at 05:37:00PM +0700, Alexander Vladimirov wrote:
> Signed-off-by: Alexander Vladimirov <alexander.idkfa.vladimirov at gmail.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
> allow lxc-centos template install from arch and probably other non-centos hosts
>  templates/lxc-centos.in | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
> index c7d2b89..c2b4db6 100644
> --- a/templates/lxc-centos.in
> +++ b/templates/lxc-centos.in
> @@ -409,7 +409,7 @@ download_centos()
>  
>      # download a mini centos into a cache
>      echo "Downloading centos minimal ..."
> -    YUM="yum --installroot $INSTALL_ROOT -y --nogpgcheck"
> +    YUM="yum --installroot $INSTALL_ROOT -y --nogpgcheck --releasever=$release"
>      PKG_LIST="yum initscripts passwd rsyslog vim-minimal openssh-server openssh-clients dhclient chkconfig rootfiles policycoreutils"
>  
>      # use temporary repository definition
> -- 
> 2.2.2
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150116/5b0e83e1/attachment.sig>

From noreply at github.com  Fri Jan 16 23:09:58 2015
From: noreply at github.com (GitHub)
Date: Fri, 16 Jan 2015 15:09:58 -0800
Subject: [lxc-devel] [lxc/lxc] e1daeb: implement lxc.include for directories
Message-ID: <54b99a469f88e_483f3ff2d268b2bc9394d@hookshot-fe3-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: e1daebd9051199fab633b42de95a3515faa26a80
      https://github.com/lxc/lxc/commit/e1daebd9051199fab633b42de95a3515faa26a80
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-16 (Fri, 16 Jan 2015)

  Changed paths:
    M src/lxc/bdev.c
    M src/lxc/confile.c
    M src/lxc/utils.c
    M src/lxc/utils.h

  Log Message:
  -----------
  implement lxc.include for directories

If you have 'lxc.include = /some/dir' and /some/dir is a directory, then any
'*.conf" files under /some/dir will be read.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: ac11ab3351796be7903f340099beb16d0e52a870
      https://github.com/lxc/lxc/commit/ac11ab3351796be7903f340099beb16d0e52a870
  Author: KATOH Yasufumi <karma at jazz.email.ne.jp>
  Date:   2015-01-16 (Fri, 16 Jan 2015)

  Changed paths:
    M doc/ja/lxc.container.conf.sgml.in

  Log Message:
  -----------
  doc: Update the description of the veth in the Japanese lxc.container.conf(5)

Update for the commit 38005c5

Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 97e1e9bbb2ba975a42692d959686ebfe1d3fd738
      https://github.com/lxc/lxc/commit/97e1e9bbb2ba975a42692d959686ebfe1d3fd738
  Author: Alexander Vladimirov <alexander.idkfa.vladimirov at gmail.com>
  Date:   2015-01-16 (Fri, 16 Jan 2015)

  Changed paths:
    M templates/lxc-centos.in

  Log Message:
  -----------
  lxc-centos: pass releasever parameter to yum

Signed-off-by: Alexander Vladimirov <alexander.idkfa.vladimirov at gmail.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/9cb4d183559d...97e1e9bbb2ba

From mail at ojkastl.de  Sat Jan 17 19:34:07 2015
From: mail at ojkastl.de (Johannes Kastl)
Date: Sat, 17 Jan 2015 20:34:07 +0100
Subject: [lxc-devel] how are lxc-download images created?
In-Reply-To: <20150116173017.GR2519@obnox.de>
References: <20150115232801.GK2519@obnox.de> <20150115233046.GP3574@dakara>
 <20150116092941.GM2519@obnox.de> <20150116152934.GW3574@dakara>
 <20150116171557.GQ2519@obnox.de> <20150116173017.GR2519@obnox.de>
Message-ID: <m9edfe$rfs$1@ger.gmane.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 16.01.2015 Michael Adam wrote:

> Ok that was misleading! I meant to say: I am happy to help if it is
> interesting for you to get some help. ;-)

I second that. If you need testers on openSUSE hosts, I'll be happy to
help...

Regards,
Johannes
- -- 
Ducttape is like the Force: It has a light side and a dark side, and
it holds the universe together.
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/

iEYEARECAAYFAlS6uSkACgkQzi3gQ/xETbKHcwCeJFQqmFAr4S/ujH7PPf19p/iC
IFcAniG7avkf06sFfVB4eVb14tibKKN+
=aG+k
-----END PGP SIGNATURE-----


From caglar at 10ur.org  Sun Jan 18 00:06:46 2015
From: caglar at 10ur.org (=?UTF-8?q?S=2E=C3=87a=C4=9Flar=20Onur?=)
Date: Sat, 17 Jan 2015 19:06:46 -0500
Subject: [lxc-devel] [PATCH] restore the dropped bits of 1c1bb85ad2b6 and
	also implement the logic suggested at
	https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-December/010985.html
Message-ID: <1421539606-3477-1-git-send-email-caglar@10ur.org>

---
 config/init/common/lxc-net.in | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/config/init/common/lxc-net.in b/config/init/common/lxc-net.in
index 5567fee..dcbe155 100644
--- a/config/init/common/lxc-net.in
+++ b/config/init/common/lxc-net.in
@@ -115,7 +115,15 @@ start() {
     if [ -n "$LXC_DOMAIN" ]; then
         LXC_DOMAIN_ARG="-s $LXC_DOMAIN -S /$LXC_DOMAIN/"
     fi
-    dnsmasq $LXC_DOMAIN_ARG -u lxc-dnsmasq --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid --conf-file=${LXC_DHCP_CONFILE} --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override --except-interface=lo --interface=${LXC_BRIDGE} --dhcp-leasefile=/var/lib/misc/dnsmasq.${LXC_BRIDGE}.leases --dhcp-authoritative || cleanup
+
+    # https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-October/010561.html
+    for DNSMASQ_USER in lxc-dnsmasq dnsmasq nobody
+    do
+        if getent passwd ${DNSMASQ_USER} >/dev/null; then
+            break
+        fi
+    done
+    dnsmasq $LXC_DOMAIN_ARG -u ${DNSMASQ_USER} --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid --conf-file=${LXC_DHCP_CONFILE} --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override --except-interface=lo --interface=${LXC_BRIDGE} --dhcp-leasefile=/var/lib/misc/dnsmasq.${LXC_BRIDGE}.leases --dhcp-authoritative || cleanup
     touch "${varrun}"/network_up
     touch "${lockdir}"/lxc-net
 }
-- 
1.9.1


From caglar at 10ur.org  Sun Jan 18 00:08:01 2015
From: caglar at 10ur.org (=?UTF-8?q?S=2E=C3=87a=C4=9Flar=20Onur?=)
Date: Sat, 17 Jan 2015 19:08:01 -0500
Subject: [lxc-devel] [PATCH] restore the dropped bits of 1c1bb85ad2b6 and
	also implement the logic suggested at
	https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-December/010985.html
Message-ID: <1421539681-3556-1-git-send-email-caglar@10ur.org>

Signed-off-by: S.Çağlar Onur <caglar at 10ur.org>
---
 config/init/common/lxc-net.in | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/config/init/common/lxc-net.in b/config/init/common/lxc-net.in
index 5567fee..dcbe155 100644
--- a/config/init/common/lxc-net.in
+++ b/config/init/common/lxc-net.in
@@ -115,7 +115,15 @@ start() {
     if [ -n "$LXC_DOMAIN" ]; then
         LXC_DOMAIN_ARG="-s $LXC_DOMAIN -S /$LXC_DOMAIN/"
     fi
-    dnsmasq $LXC_DOMAIN_ARG -u lxc-dnsmasq --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid --conf-file=${LXC_DHCP_CONFILE} --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override --except-interface=lo --interface=${LXC_BRIDGE} --dhcp-leasefile=/var/lib/misc/dnsmasq.${LXC_BRIDGE}.leases --dhcp-authoritative || cleanup
+
+    # https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-October/010561.html
+    for DNSMASQ_USER in lxc-dnsmasq dnsmasq nobody
+    do
+        if getent passwd ${DNSMASQ_USER} >/dev/null; then
+            break
+        fi
+    done
+    dnsmasq $LXC_DOMAIN_ARG -u ${DNSMASQ_USER} --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid --conf-file=${LXC_DHCP_CONFILE} --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override --except-interface=lo --interface=${LXC_BRIDGE} --dhcp-leasefile=/var/lib/misc/dnsmasq.${LXC_BRIDGE}.leases --dhcp-authoritative || cleanup
     touch "${varrun}"/network_up
     touch "${lockdir}"/lxc-net
 }
-- 
1.9.1


From serge.hallyn at ubuntu.com  Mon Jan 19 05:06:55 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 19 Jan 2015 05:06:55 +0000
Subject: [lxc-devel] [PATCH RFC] yet another problem with new overlay fs
Message-ID: <20150119050655.GA2795@ubuntumail>

It turns out that the new upstream overlay fs requires that the delta
and work dirs be under the same mount.  So create a $lxcpath/tmpfs
and create delta0 and work0 under that.  If the user asks for a
tmpfs that'll be mounted under $lxcpath/tmpfs and workdir and delta0
both created under that.

This isn't heavily tested.  But if fixes mounting of 'overlay' fs
for me.

It's "not backward compatible", since it moves delta0, but that
shouldn't matter since ephemeral containers are either destroyed
on exit, or re-started with lxc-start.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/lxc-start-ephemeral.in | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
index 36e2579..66abe56 100644
--- a/src/lxc/lxc-start-ephemeral.in
+++ b/src/lxc/lxc-start-ephemeral.in
@@ -166,6 +166,7 @@ dest = lxc.Container(os.path.basename(dest_path), args.lxcpath)
 dest.load_config(orig.config_file_name)
 dest.set_config_item("lxc.utsname", dest.name)
 dest.set_config_item("lxc.rootfs", os.path.join(dest_path, "rootfs"))
+print("setting rootfs to .%s.", os.path.join(dest_path, "rootfs"))
 for nic in dest.network:
     if hasattr(nic, 'hwaddr'):
         nic.hwaddr = randomMAC()
@@ -238,34 +239,32 @@ LXC_NAME="%s"
 
     count = 0
     for entry in overlay_dirs:
-        target = "%s/delta%s" % (dest_path, count)
-        workdir = "%s/work%s" % (dest_path, count)
-        fd.write("mkdir -p %s %s\n" % (target, entry[1]))
+        deltdir = "%s/delta%s" % (tmpdir, count)
+        workdir = "%s/work%s" % (tmpdir, count)
+        fd.write("mkdir -p %s %s\n" % (deltdir, entry[1]))
         if have_new_overlay:
             fd.write("mkdir -p %s\n" % workdir)
 
         if args.storage_type == "tmpfs":
-            fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (target))
-            if have_new_overlay:
-                fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (workdir))
+            fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (tmpdir))
+            fd.write("mkdir %s\n" % deltdir)
+            fd.write("mkdir %s\n" % workdir)
 
-        fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], target))
+        fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], deltdir))
         fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
-        if have_new_overlay:
-            fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], workdir))
 
         if args.union_type == "overlayfs":
             if have_new_overlay:
                 fd.write("mount -n -t overlay"
                      " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
-                         target,
+                         deltdir,
                          entry[0],
                          workdir,
                          entry[1]))
             else:
                 fd.write("mount -n -t overlayfs"
                      " -oupperdir=%s,lowerdir=%s none %s\n" % (
-                         target,
+                         deltdir,
                          entry[0],
                          entry[1]))
         elif args.union_type == "aufs":
@@ -275,7 +274,7 @@ LXC_NAME="%s"
 
             fd.write("mount -n -t aufs "
                      "-o br=%s=rw:%s=ro,noplink,xino=%s none %s\n" % (
-                         target,
+                         deltdir,
                          entry[0],
                          xino_path,
                          entry[1]))
-- 
2.1.0


From stgraber at ubuntu.com  Mon Jan 19 20:16:14 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Mon, 19 Jan 2015 15:16:14 -0500
Subject: [lxc-devel] [PATCH] Add common.conf.d
Message-ID: <1421698574-17620-1-git-send-email-stgraber@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 config/templates/Makefile.am               | 2 ++
 config/templates/common.conf.d/Makefile.am | 6 ++++++
 config/templates/common.conf.d/README      | 6 ++++++
 config/templates/common.conf.in            | 3 +++
 configure.ac                               | 1 +
 5 files changed, 18 insertions(+)
 create mode 100644 config/templates/common.conf.d/Makefile.am
 create mode 100644 config/templates/common.conf.d/README

diff --git a/config/templates/Makefile.am b/config/templates/Makefile.am
index fdbf9d2..329f919 100644
--- a/config/templates/Makefile.am
+++ b/config/templates/Makefile.am
@@ -2,6 +2,8 @@ templatesconfigdir=@LXCTEMPLATECONFIG@
 
 EXTRA_DIST = common.seccomp
 
+SUBDIRS = common.conf.d
+
 templatesconfig_DATA = \
 	archlinux.common.conf \
 	archlinux.userns.conf \
diff --git a/config/templates/common.conf.d/Makefile.am b/config/templates/common.conf.d/Makefile.am
new file mode 100644
index 0000000..b974249
--- /dev/null
+++ b/config/templates/common.conf.d/Makefile.am
@@ -0,0 +1,6 @@
+templatesconfigdir=@LXCTEMPLATECONFIG@/common.conf.d/
+
+EXTRA_DIST = README
+
+templatesconfig_DATA = \
+	README
diff --git a/config/templates/common.conf.d/README b/config/templates/common.conf.d/README
new file mode 100644
index 0000000..e17a3b3
--- /dev/null
+++ b/config/templates/common.conf.d/README
@@ -0,0 +1,6 @@
+This directory can be used by packages and users to dump LXC
+configuration snippets which will then be used by all containers using
+the common.conf configuration file (directlry or indirectly).
+
+Configuration files must end with the .conf suffix and LXC will include
+those in alphabetical order.
diff --git a/config/templates/common.conf.in b/config/templates/common.conf.in
index f01db08..f22ef0c 100644
--- a/config/templates/common.conf.in
+++ b/config/templates/common.conf.in
@@ -46,3 +46,6 @@ lxc.cgroup.devices.allow = c 136:* rwm
 # Blacklist some syscalls which are not safe in privileged
 # containers
 lxc.seccomp = @LXCTEMPLATECONFIG@/common.seccomp
+
+# Lastly, include all the configs from @LXCTEMPLATECONFIG@/common.conf.d/
+lxc.include = @LXCTEMPLATECONFIG@/common.conf.d/
diff --git a/configure.ac b/configure.ac
index 09cf9e2..f0605a8 100644
--- a/configure.ac
+++ b/configure.ac
@@ -627,6 +627,7 @@ AC_CONFIG_FILES([
 	config/templates/centos.common.conf
 	config/templates/centos.userns.conf
 	config/templates/common.conf
+	config/templates/common.conf.d/Makefile
 	config/templates/debian.common.conf
 	config/templates/debian.userns.conf
 	config/templates/fedora.common.conf
-- 
1.9.1


From obnox at samba.org  Mon Jan 19 20:25:48 2015
From: obnox at samba.org (Michael Adam)
Date: Mon, 19 Jan 2015 21:25:48 +0100
Subject: [lxc-devel] [PATCH] Add common.conf.d
In-Reply-To: <1421698574-17620-1-git-send-email-stgraber@ubuntu.com>
References: <1421698574-17620-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150119202548.GA3436@obnox.de>

Hi,

just two minor comments inline below,
looks good to me, otherwise.

Cheers - Michael

On 2015-01-19 at 15:16 -0500, Stéphane Graber wrote:
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
> ---
>  config/templates/Makefile.am               | 2 ++
>  config/templates/common.conf.d/Makefile.am | 6 ++++++
>  config/templates/common.conf.d/README      | 6 ++++++
>  config/templates/common.conf.in            | 3 +++
>  configure.ac                               | 1 +
>  5 files changed, 18 insertions(+)
>  create mode 100644 config/templates/common.conf.d/Makefile.am
>  create mode 100644 config/templates/common.conf.d/README
> 
> diff --git a/config/templates/Makefile.am b/config/templates/Makefile.am
> index fdbf9d2..329f919 100644
> --- a/config/templates/Makefile.am
> +++ b/config/templates/Makefile.am
> @@ -2,6 +2,8 @@ templatesconfigdir=@LXCTEMPLATECONFIG@
>  
>  EXTRA_DIST = common.seccomp
>  
> +SUBDIRS = common.conf.d
> +
>  templatesconfig_DATA = \
>  	archlinux.common.conf \
>  	archlinux.userns.conf \
> diff --git a/config/templates/common.conf.d/Makefile.am b/config/templates/common.conf.d/Makefile.am
> new file mode 100644
> index 0000000..b974249
> --- /dev/null
> +++ b/config/templates/common.conf.d/Makefile.am
> @@ -0,0 +1,6 @@
> +templatesconfigdir=@LXCTEMPLATECONFIG@/common.conf.d/
> +
> +EXTRA_DIST = README
> +
> +templatesconfig_DATA = \
> +	README
> diff --git a/config/templates/common.conf.d/README b/config/templates/common.conf.d/README
> new file mode 100644
> index 0000000..e17a3b3
> --- /dev/null
> +++ b/config/templates/common.conf.d/README
> @@ -0,0 +1,6 @@
> +This directory can be used by packages and users to dump LXC

Do you mean packages or packagers?

> +configuration snippets which will then be used by all containers using
> +the common.conf configuration file (directlry or indirectly).

directly

> +Configuration files must end with the .conf suffix and LXC will include
> +those in alphabetical order.
> diff --git a/config/templates/common.conf.in b/config/templates/common.conf.in
> index f01db08..f22ef0c 100644
> --- a/config/templates/common.conf.in
> +++ b/config/templates/common.conf.in
> @@ -46,3 +46,6 @@ lxc.cgroup.devices.allow = c 136:* rwm
>  # Blacklist some syscalls which are not safe in privileged
>  # containers
>  lxc.seccomp = @LXCTEMPLATECONFIG@/common.seccomp
> +
> +# Lastly, include all the configs from @LXCTEMPLATECONFIG@/common.conf.d/
> +lxc.include = @LXCTEMPLATECONFIG@/common.conf.d/
> diff --git a/configure.ac b/configure.ac
> index 09cf9e2..f0605a8 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -627,6 +627,7 @@ AC_CONFIG_FILES([
>  	config/templates/centos.common.conf
>  	config/templates/centos.userns.conf
>  	config/templates/common.conf
> +	config/templates/common.conf.d/Makefile
>  	config/templates/debian.common.conf
>  	config/templates/debian.userns.conf
>  	config/templates/fedora.common.conf
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150119/6579d398/attachment.sig>

From stgraber at ubuntu.com  Mon Jan 19 20:33:04 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Mon, 19 Jan 2015 15:33:04 -0500
Subject: [lxc-devel] [PATCH] Add common.conf.d
In-Reply-To: <20150119202548.GA3436@obnox.de>
References: <1421698574-17620-1-git-send-email-stgraber@ubuntu.com>
 <20150119202548.GA3436@obnox.de>
Message-ID: <20150119203304.GA19853@dakara>

On Mon, Jan 19, 2015 at 09:25:48PM +0100, Michael Adam wrote:
> Hi,
> 
> just two minor comments inline below,
> looks good to me, otherwise.
> 
> Cheers - Michael
> 
> On 2015-01-19 at 15:16 -0500, Stéphane Graber wrote:
> > Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
> > ---
> >  config/templates/Makefile.am               | 2 ++
> >  config/templates/common.conf.d/Makefile.am | 6 ++++++
> >  config/templates/common.conf.d/README      | 6 ++++++
> >  config/templates/common.conf.in            | 3 +++
> >  configure.ac                               | 1 +
> >  5 files changed, 18 insertions(+)
> >  create mode 100644 config/templates/common.conf.d/Makefile.am
> >  create mode 100644 config/templates/common.conf.d/README
> > 
> > diff --git a/config/templates/Makefile.am b/config/templates/Makefile.am
> > index fdbf9d2..329f919 100644
> > --- a/config/templates/Makefile.am
> > +++ b/config/templates/Makefile.am
> > @@ -2,6 +2,8 @@ templatesconfigdir=@LXCTEMPLATECONFIG@
> >  
> >  EXTRA_DIST = common.seccomp
> >  
> > +SUBDIRS = common.conf.d
> > +
> >  templatesconfig_DATA = \
> >  	archlinux.common.conf \
> >  	archlinux.userns.conf \
> > diff --git a/config/templates/common.conf.d/Makefile.am b/config/templates/common.conf.d/Makefile.am
> > new file mode 100644
> > index 0000000..b974249
> > --- /dev/null
> > +++ b/config/templates/common.conf.d/Makefile.am
> > @@ -0,0 +1,6 @@
> > +templatesconfigdir=@LXCTEMPLATECONFIG@/common.conf.d/
> > +
> > +EXTRA_DIST = README
> > +
> > +templatesconfig_DATA = \
> > +	README
> > diff --git a/config/templates/common.conf.d/README b/config/templates/common.conf.d/README
> > new file mode 100644
> > index 0000000..e17a3b3
> > --- /dev/null
> > +++ b/config/templates/common.conf.d/README
> > @@ -0,0 +1,6 @@
> > +This directory can be used by packages and users to dump LXC
> 
> Do you mean packages or packagers?

Packages as in the result of the packager's work.

> > +configuration snippets which will then be used by all containers using
> > +the common.conf configuration file (directlry or indirectly).
> 
> directly

Oops, indeed.

I'll fix that one on apply.

> > +Configuration files must end with the .conf suffix and LXC will include
> > +those in alphabetical order.
> > diff --git a/config/templates/common.conf.in b/config/templates/common.conf.in
> > index f01db08..f22ef0c 100644
> > --- a/config/templates/common.conf.in
> > +++ b/config/templates/common.conf.in
> > @@ -46,3 +46,6 @@ lxc.cgroup.devices.allow = c 136:* rwm
> >  # Blacklist some syscalls which are not safe in privileged
> >  # containers
> >  lxc.seccomp = @LXCTEMPLATECONFIG@/common.seccomp
> > +
> > +# Lastly, include all the configs from @LXCTEMPLATECONFIG@/common.conf.d/
> > +lxc.include = @LXCTEMPLATECONFIG@/common.conf.d/
> > diff --git a/configure.ac b/configure.ac
> > index 09cf9e2..f0605a8 100644
> > --- a/configure.ac
> > +++ b/configure.ac
> > @@ -627,6 +627,7 @@ AC_CONFIG_FILES([
> >  	config/templates/centos.common.conf
> >  	config/templates/centos.userns.conf
> >  	config/templates/common.conf
> > +	config/templates/common.conf.d/Makefile
> >  	config/templates/debian.common.conf
> >  	config/templates/debian.userns.conf
> >  	config/templates/fedora.common.conf
> > -- 
> > 1.9.1
> > 
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel



> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150119/27c4aa9a/attachment.sig>

From obnox at samba.org  Mon Jan 19 20:44:09 2015
From: obnox at samba.org (Michael Adam)
Date: Mon, 19 Jan 2015 21:44:09 +0100
Subject: [lxc-devel] [PATCH] Add common.conf.d
In-Reply-To: <20150119203304.GA19853@dakara>
References: <1421698574-17620-1-git-send-email-stgraber@ubuntu.com>
 <20150119202548.GA3436@obnox.de> <20150119203304.GA19853@dakara>
Message-ID: <20150119204409.GB3436@obnox.de>

On 2015-01-19 at 15:33 -0500, Stéphane Graber wrote:
> On Mon, Jan 19, 2015 at 09:25:48PM +0100, Michael Adam wrote:
> > Hi,
> > 
> > just two minor comments inline below,
> > looks good to me, otherwise.
> > 
> > Cheers - Michael
> > 
> > On 2015-01-19 at 15:16 -0500, Stéphane Graber wrote:
> >
> > > @@ -0,0 +1,6 @@
> > > +This directory can be used by packages and users to dump LXC
> > 
> > Do you mean packages or packagers?
> 
> Packages as in the result of the packager's work.

Ok makes sense. :-)

> > > +configuration snippets which will then be used by all containers using
> > > +the common.conf configuration file (directlry or indirectly).
> > 
> > directly
> 
> Oops, indeed.
> 
> I'll fix that one on apply.

Ok.

While we are at it:
How does the review process work for lxc?
(I did not find it written down in the tree
 but maybe that was just me..)
From what I've seen so far each patch needs Ack
by one maintainer (other than the author), or
are there other policies? Is the MAINTAINERS file
up-to-date?

Thanks - Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150119/3f1970be/attachment.sig>

From stgraber at ubuntu.com  Mon Jan 19 21:21:33 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Mon, 19 Jan 2015 16:21:33 -0500
Subject: [lxc-devel] [PATCH] Add common.conf.d
In-Reply-To: <20150119204409.GB3436@obnox.de>
References: <1421698574-17620-1-git-send-email-stgraber@ubuntu.com>
 <20150119202548.GA3436@obnox.de> <20150119203304.GA19853@dakara>
 <20150119204409.GB3436@obnox.de>
Message-ID: <20150119212133.GB19853@dakara>

On Mon, Jan 19, 2015 at 09:44:09PM +0100, Michael Adam wrote:
> On 2015-01-19 at 15:33 -0500, Stéphane Graber wrote:
> > On Mon, Jan 19, 2015 at 09:25:48PM +0100, Michael Adam wrote:
> > > Hi,
> > > 
> > > just two minor comments inline below,
> > > looks good to me, otherwise.
> > > 
> > > Cheers - Michael
> > > 
> > > On 2015-01-19 at 15:16 -0500, Stéphane Graber wrote:
> > >
> > > > @@ -0,0 +1,6 @@
> > > > +This directory can be used by packages and users to dump LXC
> > > 
> > > Do you mean packages or packagers?
> > 
> > Packages as in the result of the packager's work.
> 
> Ok makes sense. :-)
> 
> > > > +configuration snippets which will then be used by all containers using
> > > > +the common.conf configuration file (directlry or indirectly).
> > > 
> > > directly
> > 
> > Oops, indeed.
> > 
> > I'll fix that one on apply.
> 
> Ok.
> 
> While we are at it:
> How does the review process work for lxc?
> (I did not find it written down in the tree
>  but maybe that was just me..)
> From what I've seen so far each patch needs Ack
> by one maintainer (other than the author), or
> are there other policies? Is the MAINTAINERS file
> up-to-date?

So we are currently 4 people with commit rights:
 - Daniel Lezcano (original author of LXC)
 - Serge Hallyn
 - Dwight Engen
 - me

We don't strictly require an ack by one of the other committers though
we've been trying to stick to this in the past.

MAINTAINERS should probably be updated to include Dwight, I'll do that now.

> 
> Thanks - Michael


-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150119/7902a777/attachment.sig>

From stgraber at ubuntu.com  Mon Jan 19 21:31:20 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Mon, 19 Jan 2015 16:31:20 -0500
Subject: [lxc-devel] [PATCH] restore the dropped bits of 1c1bb85ad2b6
 and also implement the logic suggested at
 https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-December/010985.html
In-Reply-To: <1421539681-3556-1-git-send-email-caglar@10ur.org>
References: <1421539681-3556-1-git-send-email-caglar@10ur.org>
Message-ID: <20150119213120.GC19853@dakara>

On Sat, Jan 17, 2015 at 07:08:01PM -0500, S.Çağlar Onur wrote:
> Signed-off-by: S.Çağlar Onur <caglar at 10ur.org>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  config/init/common/lxc-net.in | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/config/init/common/lxc-net.in b/config/init/common/lxc-net.in
> index 5567fee..dcbe155 100644
> --- a/config/init/common/lxc-net.in
> +++ b/config/init/common/lxc-net.in
> @@ -115,7 +115,15 @@ start() {
>      if [ -n "$LXC_DOMAIN" ]; then
>          LXC_DOMAIN_ARG="-s $LXC_DOMAIN -S /$LXC_DOMAIN/"
>      fi
> -    dnsmasq $LXC_DOMAIN_ARG -u lxc-dnsmasq --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid --conf-file=${LXC_DHCP_CONFILE} --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override --except-interface=lo --interface=${LXC_BRIDGE} --dhcp-leasefile=/var/lib/misc/dnsmasq.${LXC_BRIDGE}.leases --dhcp-authoritative || cleanup
> +
> +    # https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-October/010561.html
> +    for DNSMASQ_USER in lxc-dnsmasq dnsmasq nobody
> +    do
> +        if getent passwd ${DNSMASQ_USER} >/dev/null; then
> +            break
> +        fi
> +    done
> +    dnsmasq $LXC_DOMAIN_ARG -u ${DNSMASQ_USER} --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid --conf-file=${LXC_DHCP_CONFILE} --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override --except-interface=lo --interface=${LXC_BRIDGE} --dhcp-leasefile=/var/lib/misc/dnsmasq.${LXC_BRIDGE}.leases --dhcp-authoritative || cleanup
>      touch "${varrun}"/network_up
>      touch "${lockdir}"/lxc-net
>  }
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150119/8a453026/attachment.sig>

From noreply at github.com  Mon Jan 19 21:23:31 2015
From: noreply at github.com (GitHub)
Date: Mon, 19 Jan 2015 13:23:31 -0800
Subject: [lxc-devel] [lxc/lxc] af242a: Update MAINTAINERS
Message-ID: <54bd75d3dbcb2_7a743f8196bc12c072912@hookshot-fe2-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: af242ace3ea7f14c9d0cc6a65e01eeb5796c8a79
      https://github.com/lxc/lxc/commit/af242ace3ea7f14c9d0cc6a65e01eeb5796c8a79
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-19 (Mon, 19 Jan 2015)

  Changed paths:
    M MAINTAINERS

  Log Message:
  -----------
  Update MAINTAINERS

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>



From obnox at samba.org  Mon Jan 19 21:50:58 2015
From: obnox at samba.org (Michael Adam)
Date: Mon, 19 Jan 2015 22:50:58 +0100
Subject: [lxc-devel] [obnox@samba.org: Re: [PATCHES] add "--mask-tmp" to
 lxc-fedora, plus some template script fixes]
Message-ID: <20150119215058.GC3436@obnox.de>

Hi Michael,

do you have any concerns with the attached patch to
the fedora template that adds an option --mask-tmp
that prevents fedora/systemd from over-mounting
/tmp with tmpfs, which is useful in some cases?

Thanks - Michael

----- Forwarded message from Michael Adam <obnox at samba.org> -----

Date: Sat, 10 Jan 2015 13:12:06 +0100
From: Michael Adam <obnox at samba.org>
To: LXC development mailing-list <lxc-devel at lists.linuxcontainers.org>
Subject: Re: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora, plus some
	template script fixes
User-Agent: Mutt/1.5.23 (2014-03-12)

On 2015-01-10 at 13:08 +0100, Michael Adam wrote:
> On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
> 
> > The less controversial one is adding mask-tmp to the fedora template.
> > It looks fine to me, but that should go separately to mwarfield, our
> > fedora template maintainer :)
> 
> I had notified mhw of my patches on irc, but apparently he is
> currently very busy.
> 
> For a start, following is an update of the uncontroversial fix
> patches, i.e. the fix patche without the path ones, and without
> the mask-tmp patch.

And here comes the mask-tmp patch.
It needs to be applied onto the previous fix-patchset.


From 9589dca113535ed2f4faad89db2fab33bb8a9d7e Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:25:24 +0100
Subject: [PATCH] lxc-fedora: add a new option --mask-tmp

This will configure the container to prevent the standard
behaviour of over-mounting /tmp with tmpfs, which can be
undesirable in some cases.

My personal use case is vagrant-lxc in combination with
vagrant-cachier.

Signed-off-by: Michael Adam <obnox at samba.org>
---
 templates/lxc-fedora.in | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index 210f2e7..49e14eb 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -372,6 +372,12 @@ configure_fedora_systemd()
     chroot ${rootfs_path} ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
     # Make systemd honor SIGPWR
     chroot ${rootfs_path} ln -s /usr/lib/systemd/system/halt.target /etc/systemd/system/sigpwr.target
+
+    # if desired, prevent systemd from over-mounting /tmp with tmpfs
+    if [ $masktmp -eq 1 ]; then
+        chroot ${rootfs_path} ln -s /dev/null /etc/systemd/system/tmp.mount
+    fi
+
     #dependency on a device unit fails it specially that we disabled udev
     # sed -i 's/After=dev-%i.device/After=/' ${rootfs_path}/lib/systemd/system/getty\@.service
     #
@@ -1186,6 +1192,7 @@ usage:
     $1 -n|--name=<container_name>
         [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>]
         [--fqdn=<network name of container>] [-a|--arch=<arch of the container>]
+        [--mask-tmp]
         [-h|--help]
 Mandatory args:
   -n,--name         container name, used to as an identifier for that container
@@ -1198,18 +1205,21 @@ Optional args:
                     Defaults to host's release if the host is Fedora.
      --fqdn         fully qualified domain name (FQDN) for DNS and system naming
   -a,--arch         Define what arch the container will be [i686,x86_64]
+  --mask-tmp        Prevent systemd from over-mounting /tmp with tmpfs.
   -h,--help         print this help
 EOF
     return 0
 }
 
-options=$(getopt -o a:hp:n:cR: -l help,path:,rootfs:,name:,clean,release:,arch:,fqdn: -- "$@")
+options=$(getopt -o a:hp:n:cR: -l help,path:,rootfs:,name:,clean,release:,arch:,fqdn:,mask-tmp -- "$@")
 if [ $? -ne 0 ]; then
     usage $(basename $0)
     exit 1
 fi
 
 arch=$(uname -m)
+masktmp=0
+
 eval set -- "$options"
 while true
 do
@@ -1222,6 +1232,7 @@ do
         -R|--release)   release=$2; shift 2;;
         -a|--arch)      newarch=$2; shift 2;;
         --fqdn)         utsname=$2; shift 2;;
+        --mask-tmp)     masktmp=1; shift 1;;
         --)             shift 1; break ;;
         *)              break ;;
     esac
-- 
2.1.0





_______________________________________________
lxc-devel mailing list
lxc-devel at lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel


----- End forwarded message -----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150119/66ea4122/attachment.sig>

From ruffian_hy at 126.com  Tue Jan 20 07:09:52 2015
From: ruffian_hy at 126.com (=?GBK?B?u8beyA==?=)
Date: Tue, 20 Jan 2015 15:09:52 +0800 (CST)
Subject: [lxc-devel] =?gbk?q?How_to_create_a_container_without_Internet_co?=
	=?gbk?b?bm5lY3Rpb26jv6O/?=
Message-ID: <a1674f9.304de.14b062d12fa.Coremail.ruffian_hy@126.com>

Hello everybody,
I am using LXC in RedHat 7 and have to  create a redhat container without Internet connection.
I tried to modify the template file of centos(changing the mirrorlist path to "file:///mnt" where i mount my .iso), but I failed and I got errors below:


Host CPE ID from /etc/os-release: cpe:/o:redhat:enterprise_linux:7.0:GA:server
This is not a CentOS or Redhat host and release is missing, defaulting to 6 use -R|--release to specify release
Checking cache download in /usr/local/var/cache/lxc/centos/x86_64/6/rootfs ...
Downloading centos minimal ..
Loaded plugins: langpacks, product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
 One of the configured repositories failed (Unknown),
 and yum doesn't have enough cached data to continue. At this point the only
 safe thing yum can do is fail. There are a few ways to work "fix" this:

      1. Contact the upstream for the repository and get them to fix the problem.

     2. Reconfigure the baseurl/etc. for the repository, to point to a working

        upstream. This is most often useful if you are using a newer

        distribution release than is supported by the repository (and the

        packages for the previous distribution release still work).

      3. Disable the repository, so yum won't use it by default. Yum will then

        just ignore the repository until you permanently enable it again or use

        --enablerepo for temporary usage:

            yum-config-manager --disable <repoid>

     4. Configure the failing repository to be skipped, if it is unavailable.

        Note that yum will try to contact the repo. when it runs most commands,

        so will have to try and fail each time (and thus. yum will be be much

        slower). If it is a very temporary problem though, this is often a nice

        compromise:

 

            yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=true

 Cannot find a valid baseurl for repo: base

Failed to download the rootfs, aborting.

Failed to download 'centos base'

failed to install centos

lxc_container: lxccontainer.c: create_run_template: 1125 container creation template for mylxc4 failed

lxc_container: lxc_create.c: main: 271 Error creating container mylxc4






If you could take a look, i really would geatly appreciate you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150120/e33a03aa/attachment-0001.html>

From mohan_gg at yahoo.com  Tue Jan 20 08:04:02 2015
From: mohan_gg at yahoo.com (Mohan G)
Date: Tue, 20 Jan 2015 08:04:02 +0000 (UTC)
Subject: [lxc-devel] external N/W support.
Message-ID: <1478781162.3723313.1421741042552.JavaMail.yahoo@jws10669.mail.bf1.yahoo.com>

Hi.How do i configure Ip on a container which can be reached by clients outside of the host. I see that by default when i install or start a container i get a already configured IP. 
RegardsMohan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150120/23003706/attachment.html>

From serge.hallyn at ubuntu.com  Tue Jan 20 16:59:27 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Tue, 20 Jan 2015 16:59:27 +0000
Subject: [lxc-devel] [PATCH 1/1] update hwaddr to fill in xx at create time
Message-ID: <20150120165927.GB2795@ubuntumail>

Commit 67702c21 regressed the case where lxc-create use a config
file with 'xx:xx' in lxc.network.hwaddr, so that the 'xx' were
preserved in the container's configuration file.  Expand those
in the unexpanded_config file whenever we are reading a
config file which is not coming from a 'lxc.include'.

The config file will have \n-terminated lines, so update
rand_complete_hwaddr to also stop on \n.

Add a test case to make sure xx gets expanded at lxc-create.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/confile.c               | 33 +++++++++++++++++++++++++++++++-
 src/tests/Makefile.am           |  3 ++-
 src/tests/lxc-test-createconfig | 42 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 76 insertions(+), 2 deletions(-)
 create mode 100644 src/tests/lxc-test-createconfig

diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index 1d42941..a21ee1a 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -551,7 +551,7 @@ static int rand_complete_hwaddr(char *hwaddr)
 #else
 	unsigned int seed=randseed(false);
 #endif
-	while (*curs != '\0')
+	while (*curs != '\0' && *curs != '\n')
 	{
 		if ( *curs == 'x' || *curs == 'X' ) {
 			if (curs - hwaddr == 1) {
@@ -1642,10 +1642,41 @@ static int config_console_logfile(const char *key, const char *value,
 	return config_path_item(&lxc_conf->console.log_path, value);
 }
 
+/*
+ * If we find a lxc.network.hwaddr in the original config file,
+ * we expand it in the unexpanded_config, so that after a save_config
+ * we store the hwaddr for re-use.
+ * This is only called when reading the config file, not when executing
+ * a lxc.include.
+ * 'x' and 'X' are substituted in-place.
+ */
+static void update_hwaddr(const char *line)
+{
+	char *p;
+
+	line += lxc_char_left_gc(line, strlen(line));
+	if (line[0] == '#')
+		return;
+	if (strncmp(line, "lxc.network.hwaddr", 18) != 0)
+		return;
+	p = strchr(line, '=');
+	if (!p)
+		return;  // let config_network_hwaddr raise the error
+	p++;
+	while (isblank(*p))
+		p++;
+	if (!*p)
+		return;
+
+	rand_complete_hwaddr(p);
+}
+
 int append_unexp_config_line(const char *line, struct lxc_conf *conf)
 {
 	size_t len = conf->unexpanded_len, linelen = strlen(line);
 
+	update_hwaddr(line);
+
 	while (conf->unexpanded_alloced <= len + linelen + 2) {
 		char *tmp = realloc(conf->unexpanded_config, conf->unexpanded_alloced + 1024);
 		if (!tmp)
diff --git a/src/tests/Makefile.am b/src/tests/Makefile.am
index 495f1cf..461d869 100644
--- a/src/tests/Makefile.am
+++ b/src/tests/Makefile.am
@@ -48,7 +48,7 @@ bin_PROGRAMS = lxc-test-containertests lxc-test-locktests lxc-test-startone \
 	lxc-test-reboot lxc-test-list lxc-test-attach lxc-test-device-add-remove \
 	lxc-test-apparmor
 
-bin_SCRIPTS = lxc-test-autostart lxc-test-cloneconfig
+bin_SCRIPTS = lxc-test-autostart lxc-test-cloneconfig lxc-test-createconfig
 
 if DISTRO_UBUNTU
 bin_SCRIPTS += \
@@ -79,6 +79,7 @@ EXTRA_DIST = \
 	lxc-test-apparmor-mount \
 	lxc-test-checkpoint-restore \
 	lxc-test-cloneconfig \
+	lxc-test-createconfig \
 	lxc-test-ubuntu \
 	lxc-test-unpriv \
 	may_control.c \
diff --git a/src/tests/lxc-test-createconfig b/src/tests/lxc-test-createconfig
new file mode 100644
index 0000000..6b74d1e
--- /dev/null
+++ b/src/tests/lxc-test-createconfig
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# lxc: linux Container library
+
+# Authors:
+# Serge Hallyn <serge.hallyn at ubuntu.com>
+#
+# This is a test script for the lxc-user-nic program
+
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+set -e
+
+s=`mktemp -d /tmp/lxctest-XXXXXX`
+f="$s/in.conf"
+
+cleanup() {
+	lxc-destroy -n lxctestc || true
+	rm -rf $s
+}
+
+trap cleanup EXIT
+
+cat > $f << EOF
+lxc.network.type = veth
+lxc.network.hwaddr = 00:16:3e:xx:xx:xx
+EOF
+lxc-create -t busybox -f $f -n lxctestc
+grep -q "xx:xx" /var/lib/lxc/lxctestc/config && { echo "hwaddr not expanded"; exit 1; }
+echo "Success"
-- 
2.1.0


From stgraber at ubuntu.com  Tue Jan 20 20:59:30 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Tue, 20 Jan 2015 15:59:30 -0500
Subject: [lxc-devel] [PATCH 1/1] update hwaddr to fill in xx at create
 time
In-Reply-To: <20150120165927.GB2795@ubuntumail>
References: <20150120165927.GB2795@ubuntumail>
Message-ID: <20150120205930.GC18736@dakara>

On Tue, Jan 20, 2015 at 04:59:27PM +0000, Serge Hallyn wrote:
> Commit 67702c21 regressed the case where lxc-create use a config
> file with 'xx:xx' in lxc.network.hwaddr, so that the 'xx' were
> preserved in the container's configuration file.  Expand those
> in the unexpanded_config file whenever we are reading a
> config file which is not coming from a 'lxc.include'.
> 
> The config file will have \n-terminated lines, so update
> rand_complete_hwaddr to also stop on \n.
> 
> Add a test case to make sure xx gets expanded at lxc-create.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/confile.c               | 33 +++++++++++++++++++++++++++++++-
>  src/tests/Makefile.am           |  3 ++-
>  src/tests/lxc-test-createconfig | 42 +++++++++++++++++++++++++++++++++++++++++
>  3 files changed, 76 insertions(+), 2 deletions(-)
>  create mode 100644 src/tests/lxc-test-createconfig
> 
> diff --git a/src/lxc/confile.c b/src/lxc/confile.c
> index 1d42941..a21ee1a 100644
> --- a/src/lxc/confile.c
> +++ b/src/lxc/confile.c
> @@ -551,7 +551,7 @@ static int rand_complete_hwaddr(char *hwaddr)
>  #else
>  	unsigned int seed=randseed(false);
>  #endif
> -	while (*curs != '\0')
> +	while (*curs != '\0' && *curs != '\n')
>  	{
>  		if ( *curs == 'x' || *curs == 'X' ) {
>  			if (curs - hwaddr == 1) {
> @@ -1642,10 +1642,41 @@ static int config_console_logfile(const char *key, const char *value,
>  	return config_path_item(&lxc_conf->console.log_path, value);
>  }
>  
> +/*
> + * If we find a lxc.network.hwaddr in the original config file,
> + * we expand it in the unexpanded_config, so that after a save_config
> + * we store the hwaddr for re-use.
> + * This is only called when reading the config file, not when executing
> + * a lxc.include.
> + * 'x' and 'X' are substituted in-place.
> + */
> +static void update_hwaddr(const char *line)
> +{
> +	char *p;
> +
> +	line += lxc_char_left_gc(line, strlen(line));
> +	if (line[0] == '#')
> +		return;
> +	if (strncmp(line, "lxc.network.hwaddr", 18) != 0)
> +		return;
> +	p = strchr(line, '=');
> +	if (!p)
> +		return;  // let config_network_hwaddr raise the error
> +	p++;
> +	while (isblank(*p))
> +		p++;
> +	if (!*p)
> +		return;
> +
> +	rand_complete_hwaddr(p);
> +}
> +
>  int append_unexp_config_line(const char *line, struct lxc_conf *conf)
>  {
>  	size_t len = conf->unexpanded_len, linelen = strlen(line);
>  
> +	update_hwaddr(line);
> +
>  	while (conf->unexpanded_alloced <= len + linelen + 2) {
>  		char *tmp = realloc(conf->unexpanded_config, conf->unexpanded_alloced + 1024);
>  		if (!tmp)
> diff --git a/src/tests/Makefile.am b/src/tests/Makefile.am
> index 495f1cf..461d869 100644
> --- a/src/tests/Makefile.am
> +++ b/src/tests/Makefile.am
> @@ -48,7 +48,7 @@ bin_PROGRAMS = lxc-test-containertests lxc-test-locktests lxc-test-startone \
>  	lxc-test-reboot lxc-test-list lxc-test-attach lxc-test-device-add-remove \
>  	lxc-test-apparmor
>  
> -bin_SCRIPTS = lxc-test-autostart lxc-test-cloneconfig
> +bin_SCRIPTS = lxc-test-autostart lxc-test-cloneconfig lxc-test-createconfig
>  
>  if DISTRO_UBUNTU
>  bin_SCRIPTS += \
> @@ -79,6 +79,7 @@ EXTRA_DIST = \
>  	lxc-test-apparmor-mount \
>  	lxc-test-checkpoint-restore \
>  	lxc-test-cloneconfig \
> +	lxc-test-createconfig \
>  	lxc-test-ubuntu \
>  	lxc-test-unpriv \
>  	may_control.c \
> diff --git a/src/tests/lxc-test-createconfig b/src/tests/lxc-test-createconfig
> new file mode 100644
> index 0000000..6b74d1e
> --- /dev/null
> +++ b/src/tests/lxc-test-createconfig
> @@ -0,0 +1,42 @@
> +#!/bin/bash
> +
> +# lxc: linux Container library
> +
> +# Authors:
> +# Serge Hallyn <serge.hallyn at ubuntu.com>
> +#
> +# This is a test script for the lxc-user-nic program
> +
> +# This library is free software; you can redistribute it and/or
> +# modify it under the terms of the GNU Lesser General Public
> +# License as published by the Free Software Foundation; either
> +# version 2.1 of the License, or (at your option) any later version.
> +
> +# This library is distributed in the hope that it will be useful,
> +# but WITHOUT ANY WARRANTY; without even the implied warranty of
> +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> +# Lesser General Public License for more details.
> +
> +# You should have received a copy of the GNU Lesser General Public
> +# License along with this library; if not, write to the Free Software
> +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
> +
> +set -e
> +
> +s=`mktemp -d /tmp/lxctest-XXXXXX`
> +f="$s/in.conf"
> +
> +cleanup() {
> +	lxc-destroy -n lxctestc || true
> +	rm -rf $s
> +}
> +
> +trap cleanup EXIT
> +
> +cat > $f << EOF
> +lxc.network.type = veth
> +lxc.network.hwaddr = 00:16:3e:xx:xx:xx
> +EOF
> +lxc-create -t busybox -f $f -n lxctestc
> +grep -q "xx:xx" /var/lib/lxc/lxctestc/config && { echo "hwaddr not expanded"; exit 1; }
> +echo "Success"
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150120/6048ed66/attachment.sig>

From noreply at github.com  Tue Jan 20 21:40:44 2015
From: noreply at github.com (GitHub)
Date: Tue, 20 Jan 2015 13:40:44 -0800
Subject: [lxc-devel] [lxc/lxc] e6744e: update hwaddr to fill in xx at create
	time
Message-ID: <54becb5c85d1d_25353f9c89fa52c0106657@hookshot-fe1-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: e6744e9b39c20166e900479339076631902e6d8f
      https://github.com/lxc/lxc/commit/e6744e9b39c20166e900479339076631902e6d8f
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-20 (Tue, 20 Jan 2015)

  Changed paths:
    M src/lxc/confile.c
    M src/tests/Makefile.am
    A src/tests/lxc-test-createconfig

  Log Message:
  -----------
  update hwaddr to fill in xx at create time

Commit 67702c21 regressed the case where lxc-create use a config
file with 'xx:xx' in lxc.network.hwaddr, so that the 'xx' were
preserved in the container's configuration file.  Expand those
in the unexpanded_config file whenever we are reading a
config file which is not coming from a 'lxc.include'.

The config file will have \n-terminated lines, so update
rand_complete_hwaddr to also stop on \n.

Add a test case to make sure xx gets expanded at lxc-create.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 5fdd4b0c119f5bd14fed3d4a6424e5a4d00c360e
      https://github.com/lxc/lxc/commit/5fdd4b0c119f5bd14fed3d4a6424e5a4d00c360e
  Author: S.Çağlar Onur <caglar at 10ur.org>
  Date:   2015-01-20 (Tue, 20 Jan 2015)

  Changed paths:
    M config/init/common/lxc-net.in

  Log Message:
  -----------
  restore the dropped bits of 1c1bb85ad2b6 and also implement the logic
suggested at
https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-December/010985.html

Signed-off-by: S.Çağlar Onur <caglar at 10ur.org>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/af242ace3ea7...5fdd4b0c119f

From stgraber at ubuntu.com  Tue Jan 20 23:40:17 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Tue, 20 Jan 2015 18:40:17 -0500
Subject: [lxc-devel] [PATCH 2/2] Set kmsg to 0 by default
In-Reply-To: <1421797217-26456-1-git-send-email-stgraber@ubuntu.com>
References: <1421797217-26456-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <1421797217-26456-2-git-send-email-stgraber@ubuntu.com>

It's now been proven over and over again that the symlink from /dev/kmsg
to /dev/console is harmful for everything but upstart systems. As Ubuntu
is now switching over to systemd too, lets switch the default.

Upstart users wishing to see boot messages can always set lxc.kmsg = 1
manually in their config (so long as they don't expect to then
dist-upgrade the container to systemd succesfuly).

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 config/templates/archlinux.common.conf.in |  3 ---
 doc/lxc.container.conf.sgml.in            |  4 ++--
 src/lxc/conf.c                            |  2 +-
 templates/lxc-debian.in                   |  6 ------
 templates/lxc-fedora.in                   | 14 --------------
 templates/lxc-oracle.in                   |  5 -----
 templates/lxc-sshd.in                     |  1 -
 7 files changed, 3 insertions(+), 32 deletions(-)

diff --git a/config/templates/archlinux.common.conf.in b/config/templates/archlinux.common.conf.in
index 8dea976..693f2f4 100644
--- a/config/templates/archlinux.common.conf.in
+++ b/config/templates/archlinux.common.conf.in
@@ -4,9 +4,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
 # Allow for 6 tty devices by default
 lxc.tty = 6
 
-# Disable kmsg
-lxc.kmsg = 0
-
 # Set the halt/stop signals
 lxc.haltsignal=SIGRTMIN+4
 lxc.stopsignal=SIGRTMIN+14
diff --git a/doc/lxc.container.conf.sgml.in b/doc/lxc.container.conf.sgml.in
index 96d574f..a86b1e5 100644
--- a/doc/lxc.container.conf.sgml.in
+++ b/doc/lxc.container.conf.sgml.in
@@ -674,7 +674,7 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
     <refsect2>
       <title>Enable kmsg symlink</title>
       <para>
-        Enable creating /dev/kmsg as symlink to /dev/console.  This defaults to 1.
+        Enable creating /dev/kmsg as symlink to /dev/console.  This defaults to 0.
       </para>
       <variablelist>
     <varlistentry>
@@ -683,7 +683,7 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
       </term>
       <listitem>
         <para>
-          Set this to 0 to disable /dev/kmsg symlinking.
+          Set this to 1 to enable /dev/kmsg symlinking.
         </para>
       </listitem>
     </varlistentry>
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index f0b2242..10582ae 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -2523,7 +2523,7 @@ struct lxc_conf *lxc_conf_init(void)
 		free(new);
 		return NULL;
 	}
-	new->kmsg = 1;
+	new->kmsg = 0;
 	lxc_list_init(&new->cgroup);
 	lxc_list_init(&new->network);
 	lxc_list_init(&new->mount_list);
diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index 0a3c402..8955363 100644
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
@@ -188,12 +188,6 @@ configure_debian_systemd()
     path=$1
     rootfs=$2
 
-    init="$(chroot ${rootfs} dpkg-query --search /sbin/init | cut -d : -f 1)"
-    if [ "$init" = "systemd-sysv" ]; then
-       # only appropriate when systemd is PID 1
-       echo 'lxc.kmsg = 0' >> "$path/config"
-    fi
-
     # this only works if we have getty at .service to manipulate
     if [ -f ${rootfs}/lib/systemd/system/getty\@.service ]; then
        sed -e 's/^ConditionPathExists=/# ConditionPathExists=/' \
diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index 36d22c5..5e7de80 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -1117,12 +1117,6 @@ lxc.include = @LXCTEMPLATECONFIG@/fedora.common.conf
 " >> $config_path/config
     fi
 
-    if [ "x$have_systemd" = "x1" ]; then
-        cat <<EOF >> $config_path/config
-lxc.kmsg = 0
-EOF
-    fi
-
     # Append things which require expansion here...
     cat <<EOF >> $config_path/config
 lxc.arch = $arch
@@ -1344,14 +1338,6 @@ if [ -z "$release" ]; then
     fi
 fi
 
-# Fedora 15 and above run systemd.We need autodev enabled to keep
-# systemd from causing problems.
-# Also, kmsg must not be mapped to prevent a 100% cpu loop
-# in systemd-journald.
-if [ $release -gt 14 ]; then
-    have_systemd="1"
-fi
-
 if [ "$(id -u)" != "0" ]; then
     echo "This script should be run as 'root'"
     exit 1
diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in
index 8ec02da..c35ac40 100644
--- a/templates/lxc-oracle.in
+++ b/templates/lxc-oracle.in
@@ -480,11 +480,6 @@ EOF
         echo "lxc.cap.drop = setfcap setpcap" >>$cfg_dir/config
     fi
 
-    # don't create kmsg symlink as it causes journald to use 100% cpu
-    if [ $container_release_major = "7" ]; then
-        echo "lxc.kmsg = 0" >>$cfg_dir/config
-    fi
-
     echo "# Networking" >>$cfg_dir/config
     # see if the network settings were already specified
     lxc_network_type=`grep '^lxc.network.type' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'`
diff --git a/templates/lxc-sshd.in b/templates/lxc-sshd.in
index 949c2ad..aa45c1d 100644
--- a/templates/lxc-sshd.in
+++ b/templates/lxc-sshd.in
@@ -129,7 +129,6 @@ copy_configuration()
 cat <<EOF >> $path/config
 lxc.utsname = $name
 lxc.pts = 1024
-lxc.kmsg = 0
 lxc.cap.drop = sys_module mac_admin mac_override sys_time
 
 # When using LXC with apparmor, uncomment the next line to run unconfined:
-- 
1.9.1


From stgraber at ubuntu.com  Tue Jan 20 23:40:16 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Tue, 20 Jan 2015 18:40:16 -0500
Subject: [lxc-devel] [PATCH 1/2] Turn autodev on by default
Message-ID: <1421797217-26456-1-git-send-email-stgraber@ubuntu.com>

Now that autodev works fine with unprivileged containers and shouldn't
come with any side effect, lets turn it on by default.

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 config/templates/archlinux.common.conf.in |  3 --
 config/templates/opensuse.common.conf.in  |  3 --
 doc/lxc.container.conf.sgml.in            |  4 +-
 src/lxc/conf.c                            | 89 +------------------------------
 templates/lxc-centos.in                   | 16 ------
 templates/lxc-debian.in                   |  1 -
 templates/lxc-fedora.in                   |  5 --
 templates/lxc-openmandriva.in             |  1 -
 templates/lxc-oracle.in                   |  1 -
 9 files changed, 3 insertions(+), 120 deletions(-)

diff --git a/config/templates/archlinux.common.conf.in b/config/templates/archlinux.common.conf.in
index 0be1958..8dea976 100644
--- a/config/templates/archlinux.common.conf.in
+++ b/config/templates/archlinux.common.conf.in
@@ -4,9 +4,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
 # Allow for 6 tty devices by default
 lxc.tty = 6
 
-# Turn on autodev for systemd
-lxc.autodev = 1
-
 # Disable kmsg
 lxc.kmsg = 0
 
diff --git a/config/templates/opensuse.common.conf.in b/config/templates/opensuse.common.conf.in
index 4026975..b040e95 100644
--- a/config/templates/opensuse.common.conf.in
+++ b/config/templates/opensuse.common.conf.in
@@ -1,9 +1,6 @@
 # This derives from the global common config
 lxc.include = @LXCTEMPLATECONFIG@/common.conf
 
-# Enable autodev
-lxc.autodev = 1
-
 # Capabilities
 # Uncomment these if you don't run anything that needs the capability, and
 # would like the container to run with less privilege.
diff --git a/doc/lxc.container.conf.sgml.in b/doc/lxc.container.conf.sgml.in
index 8652373..96d574f 100644
--- a/doc/lxc.container.conf.sgml.in
+++ b/doc/lxc.container.conf.sgml.in
@@ -663,7 +663,7 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
           </term>
           <listitem>
             <para>
-              Set this to 1 to have LXC mount and populate a minimal
+              Set this to 0 to stop LXC from mounting and populating a minimal
               <filename>/dev</filename> when starting the container.
             </para>
           </listitem>
@@ -674,7 +674,7 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
     <refsect2>
       <title>Enable kmsg symlink</title>
       <para>
-      Enable creating /dev/kmsg as symlink to /dev/console.  This defaults to 1.
+        Enable creating /dev/kmsg as symlink to /dev/console.  This defaults to 1.
       </para>
       <variablelist>
     <varlistentry>
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 0e663e9..f0b2242 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -2504,7 +2504,7 @@ struct lxc_conf *lxc_conf_init(void)
 
 	new->loglevel = LXC_LOG_PRIORITY_NOTSET;
 	new->personality = -1;
-	new->autodev = -1;
+	new->autodev = 1;
 	new->console.log_path = NULL;
 	new->console.log_fd = -1;
 	new->console.path = NULL;
@@ -3497,88 +3497,6 @@ int ttys_shift_ids(struct lxc_conf *c)
 }
 
 /*
- * This routine is called when the configuration does not already specify a value
- * for autodev (mounting a file system on /dev and populating it in a container).
- * If a hard override value has not be specified, then we try to apply some
- * heuristics to determine if we should switch to autodev mode.
- *
- * For instance, if the container has an /etc/systemd/system directory then it
- * is probably running systemd as the init process and it needs the autodev
- * mount to prevent it from mounting devtmpfs on /dev on it's own causing conflicts
- * in the host.
- *
- * We may also want to enable autodev if the host has devtmpfs mounted on its
- * /dev as this then enable us to use subdirectories under /dev for the container
- * /dev directories and we can fake udev devices.
- */
-struct start_args {
-	char *const *argv;
-};
-
-#define MAX_SYMLINK_DEPTH 32
-
-static int check_autodev( const char *rootfs, void *data )
-{
-	struct start_args *arg = data;
-	int ret;
-	int loop_count = 0;
-	struct stat s;
-	char absrootfs[MAXPATHLEN];
-	char path[MAXPATHLEN];
-	char abs_path[MAXPATHLEN];
-	char *command = "/sbin/init";
-
-	if (rootfs == NULL || strlen(rootfs) == 0)
-		return -2;
-
-	if (!realpath(rootfs, absrootfs))
-		return -2;
-
-	if( arg && arg->argv[0] ) {
-		command = arg->argv[0];
-		DEBUG("Set exec command to %s", command );
-	}
-
-	strncpy( path, command, MAXPATHLEN-1 );
-
-	if ( 0 != access(path, F_OK) || 0 != stat(path, &s) )
-		return -2;
-
-	/* Dereference down the symlink merry path testing as we go. */
-	/* If anything references systemd in the path - set autodev! */
-	/* Renormalize to the rootfs before each dereference */
-	/* Relative symlinks should fall out in the wash even with .. */
-	while( 1 ) {
-		if ( strstr( path, "systemd" ) ) {
-			INFO("Container with systemd init detected - enabling autodev!");
-			return 1;
-		}
-
-		ret = snprintf(abs_path, MAXPATHLEN-1, "%s/%s", absrootfs, path);
-		if (ret < 0 || ret > MAXPATHLEN)
-			return -2;
-
-		ret = readlink( abs_path, path, MAXPATHLEN-1 );
-
-		if ( ( ret <= 0 ) || ( ++loop_count > MAX_SYMLINK_DEPTH ) ) {
-			break; /* Break out for other tests */
-		}
-		path[ret] = '\0';
-	}
-
-	/*
-	 * Add future checks here.
-	 *	Return positive if we should go autodev
-	 *	Return 0 if we should NOT go autodev
-	 *	Return negative if we encounter an error or can not determine...
-	 */
-
-	/* All else fails, we don't need autodev */
-	INFO("Autodev not required.");
-	return 0;
-}
-
-/*
  * _do_tmp_proc_mount: Mount /proc inside container if not already
  * mounted
  *
@@ -3793,7 +3711,6 @@ int lxc_setup(struct lxc_handler *handler)
 	const char *name = handler->name;
 	struct lxc_conf *lxc_conf = handler->conf;
 	const char *lxcpath = handler->lxcpath;
-	void *data = handler->data;
 
 	if (do_rootfs_setup(lxc_conf, name, lxcpath) < 0) {
 		ERROR("Error setting up rootfs mount after spawn");
@@ -3812,10 +3729,6 @@ int lxc_setup(struct lxc_handler *handler)
 		return -1;
 	}
 
-	if (lxc_conf->autodev < 0) {
-		lxc_conf->autodev = check_autodev(lxc_conf->rootfs.mount, data);
-	}
-
 	if (lxc_conf->autodev > 0) {
 		if (mount_autodev(name, lxc_conf->rootfs.mount, lxcpath)) {
 			ERROR("failed to mount /dev in the container");
diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
index c2b4db6..fdc307a 100644
--- a/templates/lxc-centos.in
+++ b/templates/lxc-centos.in
@@ -612,8 +612,6 @@ lxc.include = @LXCTEMPLATECONFIG@/centos.common.conf
 lxc.arch = $arch
 lxc.utsname = $utsname
 
-lxc.autodev = $auto_dev
-
 # When using LXC with apparmor, uncomment the next line to run unconfined:
 #lxc.aa_profile = unconfined
 
@@ -824,20 +822,6 @@ if [ -z "$release" ]; then
     fi
 fi
 
-# CentOS 7 and above should run systemd.  We need autodev enabled to keep
-# systemd from causing problems.
-#
-# There is some ambiguity here due to the differnce between versioning
-# of point specific releases such as 6.5 and the rolling release 6.  We
-# only want the major number here if it's a point release...
-
-mrelease=$(expr $release : '\([0-9]*\)')
-if [ $mrelease -gt 6 ]; then
-    auto_dev="1"
-else
-    auto_dev="0"
-fi
-
 if [ "$(id -u)" != "0" ]; then
     echo "This script should be run as 'root'"
     exit 1
diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index 65093f3..0a3c402 100644
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
@@ -191,7 +191,6 @@ configure_debian_systemd()
     init="$(chroot ${rootfs} dpkg-query --search /sbin/init | cut -d : -f 1)"
     if [ "$init" = "systemd-sysv" ]; then
        # only appropriate when systemd is PID 1
-       echo 'lxc.autodev = 1' >> "$path/config"
        echo 'lxc.kmsg = 0' >> "$path/config"
     fi
 
diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index 210f2e7..36d22c5 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -1119,13 +1119,8 @@ lxc.include = @LXCTEMPLATECONFIG@/fedora.common.conf
 
     if [ "x$have_systemd" = "x1" ]; then
         cat <<EOF >> $config_path/config
-lxc.autodev = 1
 lxc.kmsg = 0
 EOF
-    else
-        cat <<EOF >> $config_path/config
-lxc.autodev = 0
-EOF
     fi
 
     # Append things which require expansion here...
diff --git a/templates/lxc-openmandriva.in b/templates/lxc-openmandriva.in
index be8023e..46c829d 100644
--- a/templates/lxc-openmandriva.in
+++ b/templates/lxc-openmandriva.in
@@ -229,7 +229,6 @@ copy_configuration()
     grep -q "^lxc.rootfs" $config_path/config 2>/dev/null || echo "lxc.rootfs = $rootfs_path" >> $config_path/config
     cat <<EOF >> $config_path/config
 lxc.utsname = $name
-lxc.autodev = 1
 lxc.tty = 4
 lxc.pts = 1024
 lxc.mount = $config_path/fstab
diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in
index 1f65d4c..8ec02da 100644
--- a/templates/lxc-oracle.in
+++ b/templates/lxc-oracle.in
@@ -482,7 +482,6 @@ EOF
 
     # don't create kmsg symlink as it causes journald to use 100% cpu
     if [ $container_release_major = "7" ]; then
-        echo "lxc.autodev = 1" >>$cfg_dir/config
         echo "lxc.kmsg = 0" >>$cfg_dir/config
     fi
 
-- 
1.9.1


From stgraber at ubuntu.com  Tue Jan 20 23:44:30 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Tue, 20 Jan 2015 18:44:30 -0500
Subject: [lxc-devel] [PATCH RFC] yet another problem with new overlay fs
In-Reply-To: <20150119050655.GA2795@ubuntumail>
References: <20150119050655.GA2795@ubuntumail>
Message-ID: <20150120234430.GD18736@dakara>

On Mon, Jan 19, 2015 at 05:06:55AM +0000, Serge Hallyn wrote:
> It turns out that the new upstream overlay fs requires that the delta
> and work dirs be under the same mount.  So create a $lxcpath/tmpfs
> and create delta0 and work0 under that.  If the user asks for a
> tmpfs that'll be mounted under $lxcpath/tmpfs and workdir and delta0
> both created under that.
> 
> This isn't heavily tested.  But if fixes mounting of 'overlay' fs
> for me.
> 
> It's "not backward compatible", since it moves delta0, but that
> shouldn't matter since ephemeral containers are either destroyed
> on exit, or re-started with lxc-start.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Looks fine to me

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/lxc-start-ephemeral.in | 23 +++++++++++------------
>  1 file changed, 11 insertions(+), 12 deletions(-)
> 
> diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
> index 36e2579..66abe56 100644
> --- a/src/lxc/lxc-start-ephemeral.in
> +++ b/src/lxc/lxc-start-ephemeral.in
> @@ -166,6 +166,7 @@ dest = lxc.Container(os.path.basename(dest_path), args.lxcpath)
>  dest.load_config(orig.config_file_name)
>  dest.set_config_item("lxc.utsname", dest.name)
>  dest.set_config_item("lxc.rootfs", os.path.join(dest_path, "rootfs"))
> +print("setting rootfs to .%s.", os.path.join(dest_path, "rootfs"))
>  for nic in dest.network:
>      if hasattr(nic, 'hwaddr'):
>          nic.hwaddr = randomMAC()
> @@ -238,34 +239,32 @@ LXC_NAME="%s"
>  
>      count = 0
>      for entry in overlay_dirs:
> -        target = "%s/delta%s" % (dest_path, count)
> -        workdir = "%s/work%s" % (dest_path, count)
> -        fd.write("mkdir -p %s %s\n" % (target, entry[1]))
> +        deltdir = "%s/delta%s" % (tmpdir, count)
> +        workdir = "%s/work%s" % (tmpdir, count)
> +        fd.write("mkdir -p %s %s\n" % (deltdir, entry[1]))
>          if have_new_overlay:
>              fd.write("mkdir -p %s\n" % workdir)
>  
>          if args.storage_type == "tmpfs":
> -            fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (target))
> -            if have_new_overlay:
> -                fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (workdir))
> +            fd.write("mount -n -t tmpfs -o mode=0755 none %s\n" % (tmpdir))
> +            fd.write("mkdir %s\n" % deltdir)
> +            fd.write("mkdir %s\n" % workdir)
>  
> -        fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], target))
> +        fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], deltdir))
>          fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
> -        if have_new_overlay:
> -            fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], workdir))
>  
>          if args.union_type == "overlayfs":
>              if have_new_overlay:
>                  fd.write("mount -n -t overlay"
>                       " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
> -                         target,
> +                         deltdir,
>                           entry[0],
>                           workdir,
>                           entry[1]))
>              else:
>                  fd.write("mount -n -t overlayfs"
>                       " -oupperdir=%s,lowerdir=%s none %s\n" % (
> -                         target,
> +                         deltdir,
>                           entry[0],
>                           entry[1]))
>          elif args.union_type == "aufs":
> @@ -275,7 +274,7 @@ LXC_NAME="%s"
>  
>              fd.write("mount -n -t aufs "
>                       "-o br=%s=rw:%s=ro,noplink,xino=%s none %s\n" % (
> -                         target,
> +                         deltdir,
>                           entry[0],
>                           xino_path,
>                           entry[1]))
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150120/50af7af9/attachment.sig>

From stgraber at ubuntu.com  Tue Jan 20 23:52:06 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Tue, 20 Jan 2015 18:52:06 -0500
Subject: [lxc-devel] rc1 and 1.1 right around the corner
Message-ID: <20150120235206.GE18736@dakara>

Hello,

So first of all, a very quick update on systemd containers. As you
noticed, Serge and I have been busy trying to solve that for a little
while now.

 - Serge wrote lxcfs which is now in a working state and had its second
   release earlier today. lxcfs provides an unprivileged /sys/fs/cgroup
   tree which can be used by systemd.
 - In order to support lxcfs, support for lxc.include of directories was
   added and a new common.conf.d directory introduced so that lxcfs can
   ship a 00-lxcfs.conf file in there.
 - lxc.autodev was reworked to work in the same manner for both
   privileged and unprivileged containers.
 - lxc.autodev is now on by default for all containers. The
   auto-detection code has been removed and the documentation updated
   accordingly.
 - lxc.kmsg now defaults to 0.

With all of that combined, I've got a perfectly well working Ubuntu
15.04 container using our stock systemd without any change to any of the
units (so no change to our template whatsoever).


That's basically the point I wanted to reach for LXC 1.1 and once all of
those patches are merged, this will unblock the 1.1 release itself.

As a result, I'm currently planning on tagging LXC 1.1 rc1 tomorrow with
a tentative final LXC 1.1 release for Monday next week.


That means that anyone intending on shipping LXC 1.1 rather than
sticking to the long term supported 1.0 should really start testing git
master now and make sure to send us patches for any bug they notice
ASAP.

Thanks!

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150120/e1c7cdd1/attachment-0001.sig>

From serge.hallyn at ubuntu.com  Wed Jan 21 00:19:01 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Wed, 21 Jan 2015 00:19:01 +0000
Subject: [lxc-devel] [PATCH 1/2] Turn autodev on by default
In-Reply-To: <1421797217-26456-1-git-send-email-stgraber@ubuntu.com>
References: <1421797217-26456-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150121001901.GA468@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Now that autodev works fine with unprivileged containers and shouldn't
> come with any side effect, lets turn it on by default.
> 
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

In b/doc/lxc.container.conf.sgml.in you changed the
kmsg text.  But not worth fixing the patch order imo.

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  config/templates/archlinux.common.conf.in |  3 --
>  config/templates/opensuse.common.conf.in  |  3 --
>  doc/lxc.container.conf.sgml.in            |  4 +-
>  src/lxc/conf.c                            | 89 +------------------------------
>  templates/lxc-centos.in                   | 16 ------
>  templates/lxc-debian.in                   |  1 -
>  templates/lxc-fedora.in                   |  5 --
>  templates/lxc-openmandriva.in             |  1 -
>  templates/lxc-oracle.in                   |  1 -
>  9 files changed, 3 insertions(+), 120 deletions(-)
> 
> diff --git a/config/templates/archlinux.common.conf.in b/config/templates/archlinux.common.conf.in
> index 0be1958..8dea976 100644
> --- a/config/templates/archlinux.common.conf.in
> +++ b/config/templates/archlinux.common.conf.in
> @@ -4,9 +4,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  # Allow for 6 tty devices by default
>  lxc.tty = 6
>  
> -# Turn on autodev for systemd
> -lxc.autodev = 1
> -
>  # Disable kmsg
>  lxc.kmsg = 0
>  
> diff --git a/config/templates/opensuse.common.conf.in b/config/templates/opensuse.common.conf.in
> index 4026975..b040e95 100644
> --- a/config/templates/opensuse.common.conf.in
> +++ b/config/templates/opensuse.common.conf.in
> @@ -1,9 +1,6 @@
>  # This derives from the global common config
>  lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  
> -# Enable autodev
> -lxc.autodev = 1
> -
>  # Capabilities
>  # Uncomment these if you don't run anything that needs the capability, and
>  # would like the container to run with less privilege.
> diff --git a/doc/lxc.container.conf.sgml.in b/doc/lxc.container.conf.sgml.in
> index 8652373..96d574f 100644
> --- a/doc/lxc.container.conf.sgml.in
> +++ b/doc/lxc.container.conf.sgml.in
> @@ -663,7 +663,7 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
>            </term>
>            <listitem>
>              <para>
> -              Set this to 1 to have LXC mount and populate a minimal
> +              Set this to 0 to stop LXC from mounting and populating a minimal
>                <filename>/dev</filename> when starting the container.
>              </para>
>            </listitem>
> @@ -674,7 +674,7 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
>      <refsect2>
>        <title>Enable kmsg symlink</title>
>        <para>
> -      Enable creating /dev/kmsg as symlink to /dev/console.  This defaults to 1.
> +        Enable creating /dev/kmsg as symlink to /dev/console.  This defaults to 1.
>        </para>
>        <variablelist>
>      <varlistentry>
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index 0e663e9..f0b2242 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -2504,7 +2504,7 @@ struct lxc_conf *lxc_conf_init(void)
>  
>  	new->loglevel = LXC_LOG_PRIORITY_NOTSET;
>  	new->personality = -1;
> -	new->autodev = -1;
> +	new->autodev = 1;
>  	new->console.log_path = NULL;
>  	new->console.log_fd = -1;
>  	new->console.path = NULL;
> @@ -3497,88 +3497,6 @@ int ttys_shift_ids(struct lxc_conf *c)
>  }
>  
>  /*
> - * This routine is called when the configuration does not already specify a value
> - * for autodev (mounting a file system on /dev and populating it in a container).
> - * If a hard override value has not be specified, then we try to apply some
> - * heuristics to determine if we should switch to autodev mode.
> - *
> - * For instance, if the container has an /etc/systemd/system directory then it
> - * is probably running systemd as the init process and it needs the autodev
> - * mount to prevent it from mounting devtmpfs on /dev on it's own causing conflicts
> - * in the host.
> - *
> - * We may also want to enable autodev if the host has devtmpfs mounted on its
> - * /dev as this then enable us to use subdirectories under /dev for the container
> - * /dev directories and we can fake udev devices.
> - */
> -struct start_args {
> -	char *const *argv;
> -};
> -
> -#define MAX_SYMLINK_DEPTH 32
> -
> -static int check_autodev( const char *rootfs, void *data )
> -{
> -	struct start_args *arg = data;
> -	int ret;
> -	int loop_count = 0;
> -	struct stat s;
> -	char absrootfs[MAXPATHLEN];
> -	char path[MAXPATHLEN];
> -	char abs_path[MAXPATHLEN];
> -	char *command = "/sbin/init";
> -
> -	if (rootfs == NULL || strlen(rootfs) == 0)
> -		return -2;
> -
> -	if (!realpath(rootfs, absrootfs))
> -		return -2;
> -
> -	if( arg && arg->argv[0] ) {
> -		command = arg->argv[0];
> -		DEBUG("Set exec command to %s", command );
> -	}
> -
> -	strncpy( path, command, MAXPATHLEN-1 );
> -
> -	if ( 0 != access(path, F_OK) || 0 != stat(path, &s) )
> -		return -2;
> -
> -	/* Dereference down the symlink merry path testing as we go. */
> -	/* If anything references systemd in the path - set autodev! */
> -	/* Renormalize to the rootfs before each dereference */
> -	/* Relative symlinks should fall out in the wash even with .. */
> -	while( 1 ) {
> -		if ( strstr( path, "systemd" ) ) {
> -			INFO("Container with systemd init detected - enabling autodev!");
> -			return 1;
> -		}
> -
> -		ret = snprintf(abs_path, MAXPATHLEN-1, "%s/%s", absrootfs, path);
> -		if (ret < 0 || ret > MAXPATHLEN)
> -			return -2;
> -
> -		ret = readlink( abs_path, path, MAXPATHLEN-1 );
> -
> -		if ( ( ret <= 0 ) || ( ++loop_count > MAX_SYMLINK_DEPTH ) ) {
> -			break; /* Break out for other tests */
> -		}
> -		path[ret] = '\0';
> -	}
> -
> -	/*
> -	 * Add future checks here.
> -	 *	Return positive if we should go autodev
> -	 *	Return 0 if we should NOT go autodev
> -	 *	Return negative if we encounter an error or can not determine...
> -	 */
> -
> -	/* All else fails, we don't need autodev */
> -	INFO("Autodev not required.");
> -	return 0;
> -}
> -
> -/*
>   * _do_tmp_proc_mount: Mount /proc inside container if not already
>   * mounted
>   *
> @@ -3793,7 +3711,6 @@ int lxc_setup(struct lxc_handler *handler)
>  	const char *name = handler->name;
>  	struct lxc_conf *lxc_conf = handler->conf;
>  	const char *lxcpath = handler->lxcpath;
> -	void *data = handler->data;
>  
>  	if (do_rootfs_setup(lxc_conf, name, lxcpath) < 0) {
>  		ERROR("Error setting up rootfs mount after spawn");
> @@ -3812,10 +3729,6 @@ int lxc_setup(struct lxc_handler *handler)
>  		return -1;
>  	}
>  
> -	if (lxc_conf->autodev < 0) {
> -		lxc_conf->autodev = check_autodev(lxc_conf->rootfs.mount, data);
> -	}
> -
>  	if (lxc_conf->autodev > 0) {
>  		if (mount_autodev(name, lxc_conf->rootfs.mount, lxcpath)) {
>  			ERROR("failed to mount /dev in the container");
> diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
> index c2b4db6..fdc307a 100644
> --- a/templates/lxc-centos.in
> +++ b/templates/lxc-centos.in
> @@ -612,8 +612,6 @@ lxc.include = @LXCTEMPLATECONFIG@/centos.common.conf
>  lxc.arch = $arch
>  lxc.utsname = $utsname
>  
> -lxc.autodev = $auto_dev
> -
>  # When using LXC with apparmor, uncomment the next line to run unconfined:
>  #lxc.aa_profile = unconfined
>  
> @@ -824,20 +822,6 @@ if [ -z "$release" ]; then
>      fi
>  fi
>  
> -# CentOS 7 and above should run systemd.  We need autodev enabled to keep
> -# systemd from causing problems.
> -#
> -# There is some ambiguity here due to the differnce between versioning
> -# of point specific releases such as 6.5 and the rolling release 6.  We
> -# only want the major number here if it's a point release...
> -
> -mrelease=$(expr $release : '\([0-9]*\)')
> -if [ $mrelease -gt 6 ]; then
> -    auto_dev="1"
> -else
> -    auto_dev="0"
> -fi
> -
>  if [ "$(id -u)" != "0" ]; then
>      echo "This script should be run as 'root'"
>      exit 1
> diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
> index 65093f3..0a3c402 100644
> --- a/templates/lxc-debian.in
> +++ b/templates/lxc-debian.in
> @@ -191,7 +191,6 @@ configure_debian_systemd()
>      init="$(chroot ${rootfs} dpkg-query --search /sbin/init | cut -d : -f 1)"
>      if [ "$init" = "systemd-sysv" ]; then
>         # only appropriate when systemd is PID 1
> -       echo 'lxc.autodev = 1' >> "$path/config"
>         echo 'lxc.kmsg = 0' >> "$path/config"
>      fi
>  
> diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
> index 210f2e7..36d22c5 100644
> --- a/templates/lxc-fedora.in
> +++ b/templates/lxc-fedora.in
> @@ -1119,13 +1119,8 @@ lxc.include = @LXCTEMPLATECONFIG@/fedora.common.conf
>  
>      if [ "x$have_systemd" = "x1" ]; then
>          cat <<EOF >> $config_path/config
> -lxc.autodev = 1
>  lxc.kmsg = 0
>  EOF
> -    else
> -        cat <<EOF >> $config_path/config
> -lxc.autodev = 0
> -EOF
>      fi
>  
>      # Append things which require expansion here...
> diff --git a/templates/lxc-openmandriva.in b/templates/lxc-openmandriva.in
> index be8023e..46c829d 100644
> --- a/templates/lxc-openmandriva.in
> +++ b/templates/lxc-openmandriva.in
> @@ -229,7 +229,6 @@ copy_configuration()
>      grep -q "^lxc.rootfs" $config_path/config 2>/dev/null || echo "lxc.rootfs = $rootfs_path" >> $config_path/config
>      cat <<EOF >> $config_path/config
>  lxc.utsname = $name
> -lxc.autodev = 1
>  lxc.tty = 4
>  lxc.pts = 1024
>  lxc.mount = $config_path/fstab
> diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in
> index 1f65d4c..8ec02da 100644
> --- a/templates/lxc-oracle.in
> +++ b/templates/lxc-oracle.in
> @@ -482,7 +482,6 @@ EOF
>  
>      # don't create kmsg symlink as it causes journald to use 100% cpu
>      if [ $container_release_major = "7" ]; then
> -        echo "lxc.autodev = 1" >>$cfg_dir/config
>          echo "lxc.kmsg = 0" >>$cfg_dir/config
>      fi
>  
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Wed Jan 21 00:21:30 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Wed, 21 Jan 2015 00:21:30 +0000
Subject: [lxc-devel] [PATCH 2/2] Set kmsg to 0 by default
In-Reply-To: <1421797217-26456-2-git-send-email-stgraber@ubuntu.com>
References: <1421797217-26456-1-git-send-email-stgraber@ubuntu.com>
 <1421797217-26456-2-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150121002129.GB468@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> It's now been proven over and over again that the symlink from /dev/kmsg
> to /dev/console is harmful for everything but upstart systems. As Ubuntu
> is now switching over to systemd too, lets switch the default.
> 
> Upstart users wishing to see boot messages can always set lxc.kmsg = 1
> manually in their config (so long as they don't expect to then
> dist-upgrade the container to systemd succesfuly).
> 
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  config/templates/archlinux.common.conf.in |  3 ---
>  doc/lxc.container.conf.sgml.in            |  4 ++--
>  src/lxc/conf.c                            |  2 +-
>  templates/lxc-debian.in                   |  6 ------
>  templates/lxc-fedora.in                   | 14 --------------
>  templates/lxc-oracle.in                   |  5 -----
>  templates/lxc-sshd.in                     |  1 -
>  7 files changed, 3 insertions(+), 32 deletions(-)
> 
> diff --git a/config/templates/archlinux.common.conf.in b/config/templates/archlinux.common.conf.in
> index 8dea976..693f2f4 100644
> --- a/config/templates/archlinux.common.conf.in
> +++ b/config/templates/archlinux.common.conf.in
> @@ -4,9 +4,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  # Allow for 6 tty devices by default
>  lxc.tty = 6
>  
> -# Disable kmsg
> -lxc.kmsg = 0
> -
>  # Set the halt/stop signals
>  lxc.haltsignal=SIGRTMIN+4
>  lxc.stopsignal=SIGRTMIN+14
> diff --git a/doc/lxc.container.conf.sgml.in b/doc/lxc.container.conf.sgml.in
> index 96d574f..a86b1e5 100644
> --- a/doc/lxc.container.conf.sgml.in
> +++ b/doc/lxc.container.conf.sgml.in
> @@ -674,7 +674,7 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
>      <refsect2>
>        <title>Enable kmsg symlink</title>
>        <para>
> -        Enable creating /dev/kmsg as symlink to /dev/console.  This defaults to 1.
> +        Enable creating /dev/kmsg as symlink to /dev/console.  This defaults to 0.
>        </para>
>        <variablelist>
>      <varlistentry>
> @@ -683,7 +683,7 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
>        </term>
>        <listitem>
>          <para>
> -          Set this to 0 to disable /dev/kmsg symlinking.
> +          Set this to 1 to enable /dev/kmsg symlinking.
>          </para>
>        </listitem>
>      </varlistentry>
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index f0b2242..10582ae 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -2523,7 +2523,7 @@ struct lxc_conf *lxc_conf_init(void)
>  		free(new);
>  		return NULL;
>  	}
> -	new->kmsg = 1;
> +	new->kmsg = 0;
>  	lxc_list_init(&new->cgroup);
>  	lxc_list_init(&new->network);
>  	lxc_list_init(&new->mount_list);
> diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
> index 0a3c402..8955363 100644
> --- a/templates/lxc-debian.in
> +++ b/templates/lxc-debian.in
> @@ -188,12 +188,6 @@ configure_debian_systemd()
>      path=$1
>      rootfs=$2
>  
> -    init="$(chroot ${rootfs} dpkg-query --search /sbin/init | cut -d : -f 1)"
> -    if [ "$init" = "systemd-sysv" ]; then
> -       # only appropriate when systemd is PID 1
> -       echo 'lxc.kmsg = 0' >> "$path/config"
> -    fi
> -
>      # this only works if we have getty at .service to manipulate
>      if [ -f ${rootfs}/lib/systemd/system/getty\@.service ]; then
>         sed -e 's/^ConditionPathExists=/# ConditionPathExists=/' \
> diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
> index 36d22c5..5e7de80 100644
> --- a/templates/lxc-fedora.in
> +++ b/templates/lxc-fedora.in
> @@ -1117,12 +1117,6 @@ lxc.include = @LXCTEMPLATECONFIG@/fedora.common.conf
>  " >> $config_path/config
>      fi
>  
> -    if [ "x$have_systemd" = "x1" ]; then
> -        cat <<EOF >> $config_path/config
> -lxc.kmsg = 0
> -EOF
> -    fi
> -
>      # Append things which require expansion here...
>      cat <<EOF >> $config_path/config
>  lxc.arch = $arch
> @@ -1344,14 +1338,6 @@ if [ -z "$release" ]; then
>      fi
>  fi
>  
> -# Fedora 15 and above run systemd.We need autodev enabled to keep
> -# systemd from causing problems.
> -# Also, kmsg must not be mapped to prevent a 100% cpu loop
> -# in systemd-journald.
> -if [ $release -gt 14 ]; then
> -    have_systemd="1"
> -fi
> -
>  if [ "$(id -u)" != "0" ]; then
>      echo "This script should be run as 'root'"
>      exit 1
> diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in
> index 8ec02da..c35ac40 100644
> --- a/templates/lxc-oracle.in
> +++ b/templates/lxc-oracle.in
> @@ -480,11 +480,6 @@ EOF
>          echo "lxc.cap.drop = setfcap setpcap" >>$cfg_dir/config
>      fi
>  
> -    # don't create kmsg symlink as it causes journald to use 100% cpu
> -    if [ $container_release_major = "7" ]; then
> -        echo "lxc.kmsg = 0" >>$cfg_dir/config
> -    fi
> -
>      echo "# Networking" >>$cfg_dir/config
>      # see if the network settings were already specified
>      lxc_network_type=`grep '^lxc.network.type' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'`
> diff --git a/templates/lxc-sshd.in b/templates/lxc-sshd.in
> index 949c2ad..aa45c1d 100644
> --- a/templates/lxc-sshd.in
> +++ b/templates/lxc-sshd.in
> @@ -129,7 +129,6 @@ copy_configuration()
>  cat <<EOF >> $path/config
>  lxc.utsname = $name
>  lxc.pts = 1024
> -lxc.kmsg = 0
>  lxc.cap.drop = sys_module mac_admin mac_override sys_time
>  
>  # When using LXC with apparmor, uncomment the next line to run unconfined:
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Wed Jan 21 04:25:42 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Wed, 21 Jan 2015 04:25:42 +0000
Subject: [lxc-devel] [PATCH] Add common.conf.d
In-Reply-To: <1421698574-17620-1-git-send-email-stgraber@ubuntu.com>
References: <1421698574-17620-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150121042542.GA836@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge Hallyn <serge.hallyn at ubuntu.com>

> ---
>  config/templates/Makefile.am               | 2 ++
>  config/templates/common.conf.d/Makefile.am | 6 ++++++
>  config/templates/common.conf.d/README      | 6 ++++++
>  config/templates/common.conf.in            | 3 +++
>  configure.ac                               | 1 +
>  5 files changed, 18 insertions(+)
>  create mode 100644 config/templates/common.conf.d/Makefile.am
>  create mode 100644 config/templates/common.conf.d/README
> 
> diff --git a/config/templates/Makefile.am b/config/templates/Makefile.am
> index fdbf9d2..329f919 100644
> --- a/config/templates/Makefile.am
> +++ b/config/templates/Makefile.am
> @@ -2,6 +2,8 @@ templatesconfigdir=@LXCTEMPLATECONFIG@
>  
>  EXTRA_DIST = common.seccomp
>  
> +SUBDIRS = common.conf.d
> +
>  templatesconfig_DATA = \
>  	archlinux.common.conf \
>  	archlinux.userns.conf \
> diff --git a/config/templates/common.conf.d/Makefile.am b/config/templates/common.conf.d/Makefile.am
> new file mode 100644
> index 0000000..b974249
> --- /dev/null
> +++ b/config/templates/common.conf.d/Makefile.am
> @@ -0,0 +1,6 @@
> +templatesconfigdir=@LXCTEMPLATECONFIG@/common.conf.d/
> +
> +EXTRA_DIST = README
> +
> +templatesconfig_DATA = \
> +	README
> diff --git a/config/templates/common.conf.d/README b/config/templates/common.conf.d/README
> new file mode 100644
> index 0000000..e17a3b3
> --- /dev/null
> +++ b/config/templates/common.conf.d/README
> @@ -0,0 +1,6 @@
> +This directory can be used by packages and users to dump LXC
> +configuration snippets which will then be used by all containers using
> +the common.conf configuration file (directlry or indirectly).
> +
> +Configuration files must end with the .conf suffix and LXC will include
> +those in alphabetical order.
> diff --git a/config/templates/common.conf.in b/config/templates/common.conf.in
> index f01db08..f22ef0c 100644
> --- a/config/templates/common.conf.in
> +++ b/config/templates/common.conf.in
> @@ -46,3 +46,6 @@ lxc.cgroup.devices.allow = c 136:* rwm
>  # Blacklist some syscalls which are not safe in privileged
>  # containers
>  lxc.seccomp = @LXCTEMPLATECONFIG@/common.seccomp
> +
> +# Lastly, include all the configs from @LXCTEMPLATECONFIG@/common.conf.d/
> +lxc.include = @LXCTEMPLATECONFIG@/common.conf.d/
> diff --git a/configure.ac b/configure.ac
> index 09cf9e2..f0605a8 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -627,6 +627,7 @@ AC_CONFIG_FILES([
>  	config/templates/centos.common.conf
>  	config/templates/centos.userns.conf
>  	config/templates/common.conf
> +	config/templates/common.conf.d/Makefile
>  	config/templates/debian.common.conf
>  	config/templates/debian.userns.conf
>  	config/templates/fedora.common.conf
> -- 
> 1.9.1
> 

From noreply at github.com  Wed Jan 21 04:32:27 2015
From: noreply at github.com (GitHub)
Date: Tue, 20 Jan 2015 20:32:27 -0800
Subject: [lxc-devel] [lxc/lxc] dd2271: yet another problem with new overlay
	fs
Message-ID: <54bf2bdbc5d2d_8a43f81815f32b8129179@hookshot-fe6-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: dd2271e6bbee568064b35aa488716d478e6ea195
      https://github.com/lxc/lxc/commit/dd2271e6bbee568064b35aa488716d478e6ea195
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-20 (Tue, 20 Jan 2015)

  Changed paths:
    M src/lxc/lxc-start-ephemeral.in

  Log Message:
  -----------
  yet another problem with new overlay fs

It turns out that the new upstream overlay fs requires that the delta
and work dirs be under the same mount.  So create a $lxcpath/tmpfs
and create delta0 and work0 under that.  If the user asks for a
tmpfs that'll be mounted under $lxcpath/tmpfs and workdir and delta0
both created under that.

This isn't heavily tested.  But if fixes mounting of 'overlay' fs
for me.

It's "not backward compatible", since it moves delta0, but that
shouldn't matter since ephemeral containers are either destroyed
on exit, or re-started with lxc-start.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 124fa0a869c4cf5b4dc3ea2281446df32f0a7980
      https://github.com/lxc/lxc/commit/124fa0a869c4cf5b4dc3ea2281446df32f0a7980
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-20 (Tue, 20 Jan 2015)

  Changed paths:
    M config/templates/archlinux.common.conf.in
    M config/templates/opensuse.common.conf.in
    M doc/lxc.container.conf.sgml.in
    M src/lxc/conf.c
    M templates/lxc-centos.in
    M templates/lxc-debian.in
    M templates/lxc-fedora.in
    M templates/lxc-openmandriva.in
    M templates/lxc-oracle.in

  Log Message:
  -----------
  Turn autodev on by default

Now that autodev works fine with unprivileged containers and shouldn't
come with any side effect, lets turn it on by default.

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: d89de2399ce0e6c213a742c246574f2ca0afad0d
      https://github.com/lxc/lxc/commit/d89de2399ce0e6c213a742c246574f2ca0afad0d
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-20 (Tue, 20 Jan 2015)

  Changed paths:
    M config/templates/archlinux.common.conf.in
    M doc/lxc.container.conf.sgml.in
    M src/lxc/conf.c
    M templates/lxc-debian.in
    M templates/lxc-fedora.in
    M templates/lxc-oracle.in
    M templates/lxc-sshd.in

  Log Message:
  -----------
  Set kmsg to 0 by default

It's now been proven over and over again that the symlink from /dev/kmsg
to /dev/console is harmful for everything but upstart systems. As Ubuntu
is now switching over to systemd too, lets switch the default.

Upstart users wishing to see boot messages can always set lxc.kmsg = 1
manually in their config (so long as they don't expect to then
dist-upgrade the container to systemd succesfuly).

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 4662c6dee0b2f3ee065897aac616b6a8ad02b67e
      https://github.com/lxc/lxc/commit/4662c6dee0b2f3ee065897aac616b6a8ad02b67e
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-20 (Tue, 20 Jan 2015)

  Changed paths:
    M config/templates/Makefile.am
    A config/templates/common.conf.d/Makefile.am
    A config/templates/common.conf.d/README
    M config/templates/common.conf.in
    M configure.ac

  Log Message:
  -----------
  Add common.conf.d

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge Hallyn <serge.hallyn at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/5fdd4b0c119f...4662c6dee0b2

From mail at ojkastl.de  Wed Jan 21 07:46:04 2015
From: mail at ojkastl.de (Johannes Kastl)
Date: Wed, 21 Jan 2015 08:46:04 +0100
Subject: [lxc-devel] rc1 and 1.1 right around the corner
In-Reply-To: <20150120235206.GE18736@dakara>
References: <20150120235206.GE18736@dakara>
Message-ID: <m9nlfs$li9$1@ger.gmane.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 21.01.15 Stéphane Graber wrote:

> That means that anyone intending on shipping LXC 1.1 rather than 
> sticking to the long term supported 1.0 should really start testing
> git master now and make sure to send us patches for any bug they
> notice ASAP.

First, thanks everyone for your work. Nice to see so much progress on lxc.

For openSUSE, there are builds available on the openSUSE Build Service:

> https://build.opensuse.org/project/monitor/home:ojkastl_buildservice:LXC_Vanilla_HEAD_git_snapshot

These
> 
contain small changes to the spec, so it builds on openSUSE
(package names, conventions, etc.). I hope I find time to get them
upstream soon.

And I have to get back with the openSUSE guys (jslaby, tbehrens) to
see why openSUSE uses a different spec currently.

Once 1.1 is released and branched, the link above will continue to be
master/bleeding edge, and the builds for 1.1 will be here:

> https://build.opensuse.org/project/show/home:ojkastl_buildservice:LXC_Vanilla_stable-1.1
(Currently
> 
this is alpha3)

git Snapshots from both stable-1.0 and stable-1.1 branch are/will be here:

> https://build.opensuse.org/project/show/home:ojkastl_buildservice:LXC_Vanilla_stable-1.0_git_snapshot

>
> 
https://build.opensuse.org/project/show/home:ojkastl_buildservice:LXC_Vanilla_stable-1.1_git_snapshot

Regards,
Johannes
- -- 
`Even if I could, I wouldn't. Scars can come in useful. I have one
myself above my left knee which is a perfect map of the London
Underground.´
(Albus Dumbledore, Harry Potter I)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/

iEYEARECAAYFAlS/WTwACgkQzi3gQ/xETbJxMwCcDp9fSz3nwMju01R/fvpg5yYH
+hMAn3nb0GxIW/qy6zq3bedES/bnD0Lj
=g6Bs
-----END PGP SIGNATURE-----


From neumann at cgws.de  Wed Jan 21 12:23:53 2015
From: neumann at cgws.de (Axel Neumann)
Date: Wed, 21 Jan 2015 13:23:53 +0100
Subject: [lxc-devel] Problem when using same vlan.id for multiple vlan
 interfaces
In-Reply-To: <20120709224134.GB5987@sergelap>
References: <4FFAF6BC.5050204@cgws.de> <20120709224134.GB5987@sergelap>
Message-ID: <54BF9A59.1000308@cgws.de>

On 10.07.2012 00:41, Serge Hallyn wrote:
> Quoting Axel Neumann (neumann at cgws.de):
>> Hello,
>>
>> First, thanks a lot for your good work!
>> We are using LXC in the CONFINE project (confine-project.eu) to provide 
>> researchers with a virtualized linux evironment in a distributed testbed.
>>
>> We found a problem when a container config looks like this (uses the 
>> same vlan id for several type=vlan container interfaces):
>>
>> lxc.network.type      = vlan
>> lxc.network.flags     = up
>> lxc.network.link      = eth1
>> lxc.network.vlan.id   = 3842
>> lxc.network.name      = iso0
>>
>> lxc.network.type      = vlan
>> lxc.network.flags     = up
>> lxc.network.link      = eth2
>> lxc.network.vlan.id   = 3842
>> lxc.network.name      = iso1
>>
>> Then, during the instantiation of the vlan interfaces an error occurs 
>> because the lxc code tries to assign the same name to both of them 
>> before it is bound into the container.
>>
>> Maybe you can have a look at the  following patch which solves the problem
>> (see also here: 
>> https://github.com/axn/lxc/commit/32fb8a007a95ad4beb9d9d7dade032a50f5da0db 
>>   )
>> and consider this or an alternative solution for your 0.8.0 branch.
>>
>> Thanks a lot
>> /axel
> 
> Acked-by: Serge E. Hallyn <serge at hallyn.com>
> 
> Looks reasonable.  Thanks

Could you have a look on this problem again. It's still valid.

I created a new patch based on recent lxc/master branch which could be
pulled here: https://github.com/lxc/lxc/pull/397

Thanks
/axel

> 
>>
>> neumann at sid:/usr/src/lxc/lxc.git$ git diff HEAD^
>> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
>> index e8088bb..4f21464 100644
>> --- a/src/lxc/conf.c
>> +++ b/src/lxc/conf.c
>> @@ -1733,13 +1733,14 @@ static int instanciate_vlan(struct lxc_handler 
>> *handler, struct lxc_netdev *netd
>>   {
>>          char peer[IFNAMSIZ];
>>          int err;
>> +        static uint16_t vlan_cntr = 0;
>>
>>          if (!netdev->link) {
>>                  ERROR("no link specified for vlan netdev");
>>                  return -1;
>> -       }
>> +        }
>>
>> -       snprintf(peer, sizeof(peer), "vlan%d", netdev->priv.vlan_attr.vid);
>> +        snprintf(peer, sizeof (peer), "vlan%d-%d", 
>> netdev->priv.vlan_attr.vid, vlan_cntr++);
>>
>>          err = lxc_vlan_create(netdev->link, peer, 
>> netdev->priv.vlan_attr.vid);
>>          if (err) {
>>
>>
>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and 
>> threat landscape has changed and how IT managers can respond. Discussions 
>> will include endpoint security, mobile security and the latest in malware 
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> Lxc-devel mailing list
>> Lxc-devel at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/lxc-devel
> 
> 


From noreply at github.com  Wed Jan 21 15:34:03 2015
From: noreply at github.com (GitHub)
Date: Wed, 21 Jan 2015 07:34:03 -0800
Subject: [lxc-devel] [lxc/lxc] 82f58d: Fix instantiation of multiple vlan
 interfaces with...
Message-ID: <54bfc6eb38e5a_29923fd3e79d32bc68690@hookshot-fe4-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 82f58d0396ecb3ffaecbc957a917a87f4e29a938
      https://github.com/lxc/lxc/commit/82f58d0396ecb3ffaecbc957a917a87f4e29a938
  Author: Axel Neumann <neumann at cgws.de>
  Date:   2015-01-13 (Tue, 13 Jan 2015)

  Changed paths:
    M src/lxc/conf.c

  Log Message:
  -----------
  Fix instantiation of multiple vlan interfaces with same id

Container fail to start with configs (as shown below) where the same
vlan id is used for several type=vlan container interfaces.
Then, during the instantiation of the vlan interfaces, an error occurs
because the lxc code tries to assign the same temporary name to both
of them before it is bound into the container.

> lxc.network.type      = vlan
> lxc.network.flags     = up
> lxc.network.link      = eth1
> lxc.network.vlan.id   = 3842
> lxc.network.name      = iso0
>
> lxc.network.type      = vlan
> lxc.network.flags     = up
> lxc.network.link      = eth2
> lxc.network.vlan.id   = 3842
> lxc.network.name      = iso1

Signed-off-by: Axel Neumann <neumann at cgws.de>


  Commit: 6b1aa947ad5b92a8415aa204b020462abdb183b4
      https://github.com/lxc/lxc/commit/6b1aa947ad5b92a8415aa204b020462abdb183b4
  Author: hallyn <serge at hallyn.com>
  Date:   2015-01-21 (Wed, 21 Jan 2015)

  Changed paths:
    M src/lxc/conf.c

  Log Message:
  -----------
  Merge pull request #397 from axn/master

Fix instantiation of multiple vlan interfaces with same id


Compare: https://github.com/lxc/lxc/compare/4662c6dee0b2...6b1aa947ad5b

From noreply at github.com  Wed Jan 21 15:40:25 2015
From: noreply at github.com (GitHub)
Date: Wed, 21 Jan 2015 07:40:25 -0800
Subject: [lxc-devel] [lxc/lxc] a34181: big big login delays in CentOS 7
	systemd
Message-ID: <54bfc86997a6b_f9d3fd1b25db2b84166c@hookshot-fe2-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/stable-1.0
  Home:   https://github.com/lxc/lxc
  Commit: a341816ba6ed9d725e50f373c821ad04acca44d5
      https://github.com/lxc/lxc/commit/a341816ba6ed9d725e50f373c821ad04acca44d5
  Author: tukiyo <tukiyo3 at gmail.com>
  Date:   2014-10-10 (Fri, 10 Oct 2014)

  Changed paths:
    M config/templates/centos.common.conf.in

  Log Message:
  -----------
  big big login delays in CentOS 7 systemd


  Commit: a4aed378f802ad9caf74ee1c20dc74a6f9d7ca17
      https://github.com/lxc/lxc/commit/a4aed378f802ad9caf74ee1c20dc74a6f9d7ca17
  Author: hallyn <serge at hallyn.com>
  Date:   2015-01-21 (Wed, 21 Jan 2015)

  Changed paths:
    M config/templates/centos.common.conf.in

  Log Message:
  -----------
  Merge pull request #342 from tukiyo/patch-2

big big login delays in CentOS 7 systemd


Compare: https://github.com/lxc/lxc/compare/5cb9ed613b2b...a4aed378f802

From serge.hallyn at ubuntu.com  Wed Jan 21 15:45:05 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Wed, 21 Jan 2015 15:45:05 +0000
Subject: [lxc-devel] Problem when using same vlan.id for multiple vlan
 interfaces
In-Reply-To: <54BF9A59.1000308@cgws.de>
References: <4FFAF6BC.5050204@cgws.de> <20120709224134.GB5987@sergelap>
 <54BF9A59.1000308@cgws.de>
Message-ID: <20150121154505.GA1362@ubuntumail>

Quoting Axel Neumann (neumann at cgws.de):
> On 10.07.2012 00:41, Serge Hallyn wrote:
> > Quoting Axel Neumann (neumann at cgws.de):
> >> Hello,
> >>
> >> First, thanks a lot for your good work!
> >> We are using LXC in the CONFINE project (confine-project.eu) to provide 
> >> researchers with a virtualized linux evironment in a distributed testbed.
> >>
> >> We found a problem when a container config looks like this (uses the 
> >> same vlan id for several type=vlan container interfaces):
> >>
> >> lxc.network.type      = vlan
> >> lxc.network.flags     = up
> >> lxc.network.link      = eth1
> >> lxc.network.vlan.id   = 3842
> >> lxc.network.name      = iso0
> >>
> >> lxc.network.type      = vlan
> >> lxc.network.flags     = up
> >> lxc.network.link      = eth2
> >> lxc.network.vlan.id   = 3842
> >> lxc.network.name      = iso1
> >>
> >> Then, during the instantiation of the vlan interfaces an error occurs 
> >> because the lxc code tries to assign the same name to both of them 
> >> before it is bound into the container.
> >>
> >> Maybe you can have a look at the  following patch which solves the problem
> >> (see also here: 
> >> https://github.com/axn/lxc/commit/32fb8a007a95ad4beb9d9d7dade032a50f5da0db 
> >>   )
> >> and consider this or an alternative solution for your 0.8.0 branch.
> >>
> >> Thanks a lot
> >> /axel
> > 
> > Acked-by: Serge E. Hallyn <serge at hallyn.com>
> > 
> > Looks reasonable.  Thanks
> 
> Could you have a look on this problem again. It's still valid.
> 
> I created a new patch based on recent lxc/master branch which could be
> pulled here: https://github.com/lxc/lxc/pull/397

Thanks, merged.

From serge.hallyn at ubuntu.com  Wed Jan 21 17:48:05 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Wed, 21 Jan 2015 17:48:05 +0000
Subject: [lxc-devel] [PATCH] restore the dropped bits of 1c1bb85ad2b6
 and also implement the logic suggested at
 https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-December/010985.html
In-Reply-To: <1421539606-3477-1-git-send-email-caglar@10ur.org>
References: <1421539606-3477-1-git-send-email-caglar@10ur.org>
Message-ID: <20150121174805.GE1362@ubuntumail>

Quoting S.Çağlar Onur (caglar at 10ur.org):

(No signed-off-by)

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  config/init/common/lxc-net.in | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/config/init/common/lxc-net.in b/config/init/common/lxc-net.in
> index 5567fee..dcbe155 100644
> --- a/config/init/common/lxc-net.in
> +++ b/config/init/common/lxc-net.in
> @@ -115,7 +115,15 @@ start() {
>      if [ -n "$LXC_DOMAIN" ]; then
>          LXC_DOMAIN_ARG="-s $LXC_DOMAIN -S /$LXC_DOMAIN/"
>      fi
> -    dnsmasq $LXC_DOMAIN_ARG -u lxc-dnsmasq --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid --conf-file=${LXC_DHCP_CONFILE} --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override --except-interface=lo --interface=${LXC_BRIDGE} --dhcp-leasefile=/var/lib/misc/dnsmasq.${LXC_BRIDGE}.leases --dhcp-authoritative || cleanup
> +
> +    # https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-October/010561.html
> +    for DNSMASQ_USER in lxc-dnsmasq dnsmasq nobody
> +    do
> +        if getent passwd ${DNSMASQ_USER} >/dev/null; then
> +            break
> +        fi
> +    done
> +    dnsmasq $LXC_DOMAIN_ARG -u ${DNSMASQ_USER} --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid --conf-file=${LXC_DHCP_CONFILE} --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override --except-interface=lo --interface=${LXC_BRIDGE} --dhcp-leasefile=/var/lib/misc/dnsmasq.${LXC_BRIDGE}.leases --dhcp-authoritative || cleanup
>      touch "${varrun}"/network_up
>      touch "${lockdir}"/lxc-net
>  }
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Wed Jan 21 18:19:58 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Wed, 21 Jan 2015 18:19:58 +0000
Subject: [lxc-devel] [obnox@samba.org: Re: [PATCHES] add "--mask-tmp" to
 lxc-fedora, plus some template script fixes]
In-Reply-To: <20150119215058.GC3436@obnox.de>
References: <20150119215058.GC3436@obnox.de>
Message-ID: <20150121181958.GG1362@ubuntumail>

Quoting Michael Adam (obnox at samba.org):
> Hi Michael,
> 
> do you have any concerns with the attached patch to
> the fedora template that adds an option --mask-tmp
> that prevents fedora/systemd from over-mounting
> /tmp with tmpfs, which is useful in some cases?
> 
> Thanks - Michael
> 
> ----- Forwarded message from Michael Adam <obnox at samba.org> -----
> 
> Date: Sat, 10 Jan 2015 13:12:06 +0100
> From: Michael Adam <obnox at samba.org>
> To: LXC development mailing-list <lxc-devel at lists.linuxcontainers.org>
> Subject: Re: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora, plus some
> 	template script fixes
> User-Agent: Mutt/1.5.23 (2014-03-12)
> 
> On 2015-01-10 at 13:08 +0100, Michael Adam wrote:
> > On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
> > 
> > > The less controversial one is adding mask-tmp to the fedora template.
> > > It looks fine to me, but that should go separately to mwarfield, our
> > > fedora template maintainer :)
> > 
> > I had notified mhw of my patches on irc, but apparently he is
> > currently very busy.
> > 
> > For a start, following is an update of the uncontroversial fix
> > patches, i.e. the fix patche without the path ones, and without
> > the mask-tmp patch.
> 
> And here comes the mask-tmp patch.
> It needs to be applied onto the previous fix-patchset.
> 
> 
> From 9589dca113535ed2f4faad89db2fab33bb8a9d7e Mon Sep 17 00:00:00 2001
> From: Michael Adam <obnox at samba.org>
> Date: Thu, 8 Jan 2015 10:25:24 +0100
> Subject: [PATCH] lxc-fedora: add a new option --mask-tmp
> 
> This will configure the container to prevent the standard
> behaviour of over-mounting /tmp with tmpfs, which can be
> undesirable in some cases.
> 
> My personal use case is vagrant-lxc in combination with
> vagrant-cachier.
> 
> Signed-off-by: Michael Adam <obnox at samba.org>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  templates/lxc-fedora.in | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
> index 210f2e7..49e14eb 100644
> --- a/templates/lxc-fedora.in
> +++ b/templates/lxc-fedora.in
> @@ -372,6 +372,12 @@ configure_fedora_systemd()
>      chroot ${rootfs_path} ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
>      # Make systemd honor SIGPWR
>      chroot ${rootfs_path} ln -s /usr/lib/systemd/system/halt.target /etc/systemd/system/sigpwr.target
> +
> +    # if desired, prevent systemd from over-mounting /tmp with tmpfs
> +    if [ $masktmp -eq 1 ]; then
> +        chroot ${rootfs_path} ln -s /dev/null /etc/systemd/system/tmp.mount
> +    fi
> +
>      #dependency on a device unit fails it specially that we disabled udev
>      # sed -i 's/After=dev-%i.device/After=/' ${rootfs_path}/lib/systemd/system/getty\@.service
>      #
> @@ -1186,6 +1192,7 @@ usage:
>      $1 -n|--name=<container_name>
>          [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>]
>          [--fqdn=<network name of container>] [-a|--arch=<arch of the container>]
> +        [--mask-tmp]
>          [-h|--help]
>  Mandatory args:
>    -n,--name         container name, used to as an identifier for that container
> @@ -1198,18 +1205,21 @@ Optional args:
>                      Defaults to host's release if the host is Fedora.
>       --fqdn         fully qualified domain name (FQDN) for DNS and system naming
>    -a,--arch         Define what arch the container will be [i686,x86_64]
> +  --mask-tmp        Prevent systemd from over-mounting /tmp with tmpfs.
>    -h,--help         print this help
>  EOF
>      return 0
>  }
>  
> -options=$(getopt -o a:hp:n:cR: -l help,path:,rootfs:,name:,clean,release:,arch:,fqdn: -- "$@")
> +options=$(getopt -o a:hp:n:cR: -l help,path:,rootfs:,name:,clean,release:,arch:,fqdn:,mask-tmp -- "$@")
>  if [ $? -ne 0 ]; then
>      usage $(basename $0)
>      exit 1
>  fi
>  
>  arch=$(uname -m)
> +masktmp=0
> +
>  eval set -- "$options"
>  while true
>  do
> @@ -1222,6 +1232,7 @@ do
>          -R|--release)   release=$2; shift 2;;
>          -a|--arch)      newarch=$2; shift 2;;
>          --fqdn)         utsname=$2; shift 2;;
> +        --mask-tmp)     masktmp=1; shift 1;;
>          --)             shift 1; break ;;
>          *)              break ;;
>      esac
> -- 
> 2.1.0
> 
> 
> 
> 
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel
> 
> 
> ----- End forwarded message -----



> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From serge.hallyn at ubuntu.com  Wed Jan 21 18:28:32 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Wed, 21 Jan 2015 18:28:32 +0000
Subject: [lxc-devel] external N/W support.
In-Reply-To: <1478781162.3723313.1421741042552.JavaMail.yahoo@jws10669.mail.bf1.yahoo.com>
References: <1478781162.3723313.1421741042552.JavaMail.yahoo@jws10669.mail.bf1.yahoo.com>
Message-ID: <20150121182832.GH1362@ubuntumail>

Quoting Mohan G (mohan_gg at yahoo.com):
> Hi.How do i configure Ip on a container which can be reached by clients outside of the host. I see that by default when i install or start a container i get a already configured IP. 

A few answers are at https://help.ubuntu.com/stable/serverguide/lxc.html#lxc-network

Personally I tend to nat just the ports I want to the container, but
that doesn't suffice for other use cases.

From noreply at github.com  Wed Jan 21 18:49:13 2015
From: noreply at github.com (GitHub)
Date: Wed, 21 Jan 2015 10:49:13 -0800
Subject: [lxc-devel] [lxc/lxc] c2af30: add "--mask-tmp" to lxc-fedora,
 plus some template...
Message-ID: <54bff4a934222_37bf3fc8b60a52bc16762@hookshot-fe3-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: c2af30847aeaaadeea962015de083c46c271bfbc
      https://github.com/lxc/lxc/commit/c2af30847aeaaadeea962015de083c46c271bfbc
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-21 (Wed, 21 Jan 2015)

  Changed paths:
    M templates/lxc-fedora.in

  Log Message:
  -----------
  add "--mask-tmp" to lxc-fedora, plus some template script fixes]

Hi Michael,

do you have any concerns with the attached patch to
the fedora template that adds an option --mask-tmp
that prevents fedora/systemd from over-mounting
/tmp with tmpfs, which is useful in some cases?

Thanks - Michael

----- Forwarded message from Michael Adam <obnox at samba.org> -----

Date: Sat, 10 Jan 2015 13:12:06 +0100
From: Michael Adam <obnox at samba.org>
To: LXC development mailing-list <lxc-devel at lists.linuxcontainers.org>
Subject: Re: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora, plus some
	template script fixes
User-Agent: Mutt/1.5.23 (2014-03-12)

On 2015-01-10 at 13:08 +0100, Michael Adam wrote:
> On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
>
> > The less controversial one is adding mask-tmp to the fedora template.
> > It looks fine to me, but that should go separately to mwarfield, our
> > fedora template maintainer :)
>
> I had notified mhw of my patches on irc, but apparently he is
> currently very busy.
>
> For a start, following is an update of the uncontroversial fix
> patches, i.e. the fix patche without the path ones, and without
> the mask-tmp patch.

And here comes the mask-tmp patch.
It needs to be applied onto the previous fix-patchset.

>From 9589dca113535ed2f4faad89db2fab33bb8a9d7e Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:25:24 +0100
Subject: [PATCH] lxc-fedora: add a new option --mask-tmp

This will configure the container to prevent the standard
behaviour of over-mounting /tmp with tmpfs, which can be
undesirable in some cases.

My personal use case is vagrant-lxc in combination with
vagrant-cachier.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>



From noreply at github.com  Wed Jan 21 21:20:29 2015
From: noreply at github.com (GitHub)
Date: Wed, 21 Jan 2015 13:20:29 -0800
Subject: [lxc-devel] [lxc/lxc]
Message-ID: <54c0181d30dbf_df33fb4800f52c07689@hookshot-fe2-cp1-prd.iad.github.net.mail>

  Branch: refs/tags/lxc-1.1.0.rc1
  Home:   https://github.com/lxc/lxc

From noreply at github.com  Wed Jan 21 21:20:26 2015
From: noreply at github.com (GitHub)
Date: Wed, 21 Jan 2015 13:20:26 -0800
Subject: [lxc-devel] [lxc/lxc] 3e73d6: change version to 1.1.0.rc1 in
	configure.ac
Message-ID: <54c0181ad158d_74e83ff86d99f2a0654b9@hookshot-fe1-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 3e73d667577102f9286f18f773de174d4fe810bb
      https://github.com/lxc/lxc/commit/3e73d667577102f9286f18f773de174d4fe810bb
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-21 (Wed, 21 Jan 2015)

  Changed paths:
    M configure.ac

  Log Message:
  -----------
  change version to 1.1.0.rc1 in configure.ac

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>



From stgraber at ubuntu.com  Wed Jan 21 21:27:16 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Wed, 21 Jan 2015 16:27:16 -0500
Subject: [lxc-devel] LXC 1.1 rc1 has been released
Message-ID: <20150121212716.GA22897@dakara>

Hey everyone,

So after doing a fair amount of additional manual testing on it, I've
just released LXC 1.1 rc1.

That means that from now on, we won't be taking new features and will
instead work on fixing any remaining rough edges with 1.1.


The target final release date remains Monday the 26th of January.

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150121/b732171e/attachment-0001.sig>

From builds at travis-ci.org  Wed Jan 21 21:32:45 2015
From: builds at travis-ci.org (Travis CI)
Date: Wed, 21 Jan 2015 21:32:45 +0000
Subject: [lxc-devel] Passed: lxc/lxc#813 (lxc-1.1.0.rc1 - 3e73d66)
In-Reply-To: <lxc/lxc+47840851+passed@travis-ci.org>
Message-ID: <54c01afd7a120_3152d6f05051fe@8bb8489c-4a1e-486a-85f9-c925d4be8e72.mail>

Build Update for lxc/lxc
-------------------------------------

Build: #813
Status: Passed

Duration: 3 minutes and 15 seconds
Commit: 3e73d66 (lxc-1.1.0.rc1)
Author: Stéphane Graber
Message: change version to 1.1.0.rc1 in configure.ac

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

View the changeset: https://github.com/lxc/lxc/compare/lxc-1.1.0.rc1

View the full build log and details: https://travis-ci.org/lxc/lxc/builds/47840851

--

You can configure recipients for build notifications in your .travis.yml file. See http://docs.travis-ci.com/user/notifications



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150121/d1588a52/attachment.html>

From caglar at 10ur.org  Thu Jan 22 03:15:24 2015
From: caglar at 10ur.org (=?UTF-8?B?Uy7Dh2HEn2xhciBPbnVy?=)
Date: Wed, 21 Jan 2015 22:15:24 -0500
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <20150121212716.GA22897@dakara>
References: <20150121212716.GA22897@dakara>
Message-ID: <CAF+rbZN5wg2mKca81fwU39yyRqj9y2WHY6tStCcsfRhWuzG+=g@mail.gmail.com>

Hey Stéphane,

On Wed, Jan 21, 2015 at 4:27 PM, Stéphane Graber <stgraber at ubuntu.com> wrote:
> Hey everyone,
>
> So after doing a fair amount of additional manual testing on it, I've
> just released LXC 1.1 rc1.
>
> That means that from now on, we won't be taking new features and will
> instead work on fixing any remaining rough edges with 1.1.
>

On my trusty box where everything (including cgmanager/lxcfs and lxc)
compiled from source, this is what I'm getting while starting a
container;

[...]
      lxc-start 1421896313.531 ERROR    lxc_apparmor -
lsm/apparmor.c:apparmor_process_label_set:185 - No such file or
directory - failed to change apparmor profile to lxc-container-default
      lxc-start 1421896313.531 ERROR    lxc_sync -
sync.c:__sync_wait:51 - invalid sequence number 1. expected 4
      lxc-start 1421896313.531 ERROR    lxc_start -
start.c:__lxc_start:1099 - failed to spawn 'rubik'
      lxc-start 1421896313.532 WARN     lxc_commands -
commands.c:lxc_cmd_rsp_recv:172 - command get_init_pid failed to
receive response
      lxc-start 1421896313.532 WARN     lxc_cgmanager -
cgmanager.c:cgm_get:963 - do_cgm_get exited with error
      lxc-start 1421896313.534 ERROR    lxc_cgmanager -
cgmanager.c:cgm_remove_cgroup:518 - call to cgmanager_remove_sync
failed: invalid request
      lxc-start 1421896313.534 ERROR    lxc_cgmanager -
cgmanager.c:cgm_remove_cgroup:520 - Error removing all:lxc/rubik-2
      lxc-start 1421896318.539 ERROR    lxc_start_ui -
lxc_start.c:main:345 - The container failed to start.
      lxc-start 1421896318.539 ERROR    lxc_start_ui -
lxc_start.c:main:347 - To get more details, run the container in
foreground mode.
      lxc-start 1421896318.539 ERROR    lxc_start_ui -
lxc_start.c:main:349 - Additional information can be obtained by
setting the --logfile and --logpriority options.
[...]

unconfined containers seems to work fine. This very well could be
because of me not using the ppa but I wanted to report anyway.

> The target final release date remains Monday the 26th of January.
>
> --
> Stéphane Graber
> Ubuntu developer
> http://www.ubuntu.com
>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel
>

Best,
-- 
S.Çağlar Onur <caglar at 10ur.org>

From caglar at 10ur.org  Thu Jan 22 03:20:32 2015
From: caglar at 10ur.org (=?UTF-8?B?Uy7Dh2HEn2xhciBPbnVy?=)
Date: Wed, 21 Jan 2015 22:20:32 -0500
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <CAF+rbZN5wg2mKca81fwU39yyRqj9y2WHY6tStCcsfRhWuzG+=g@mail.gmail.com>
References: <20150121212716.GA22897@dakara>
 <CAF+rbZN5wg2mKca81fwU39yyRqj9y2WHY6tStCcsfRhWuzG+=g@mail.gmail.com>
Message-ID: <CAF+rbZMYmmu3t_87CtuU1Hjq4CLas=VtL6xcE3oZtXSHPg+taQ@mail.gmail.com>

On Wed, Jan 21, 2015 at 10:15 PM, S.Çağlar Onur <caglar at 10ur.org> wrote:
> Hey Stéphane,
>
> On Wed, Jan 21, 2015 at 4:27 PM, Stéphane Graber <stgraber at ubuntu.com> wrote:
>> Hey everyone,
>>
>> So after doing a fair amount of additional manual testing on it, I've
>> just released LXC 1.1 rc1.
>>
>> That means that from now on, we won't be taking new features and will
>> instead work on fixing any remaining rough edges with 1.1.
>>
>
> On my trusty box where everything (including cgmanager/lxcfs and lxc)
> compiled from source, this is what I'm getting while starting a
> container;
>
> [...]
>       lxc-start 1421896313.531 ERROR    lxc_apparmor -
> lsm/apparmor.c:apparmor_process_label_set:185 - No such file or
> directory - failed to change apparmor profile to lxc-container-default
>       lxc-start 1421896313.531 ERROR    lxc_sync -
> sync.c:__sync_wait:51 - invalid sequence number 1. expected 4
>       lxc-start 1421896313.531 ERROR    lxc_start -
> start.c:__lxc_start:1099 - failed to spawn 'rubik'
>       lxc-start 1421896313.532 WARN     lxc_commands -
> commands.c:lxc_cmd_rsp_recv:172 - command get_init_pid failed to
> receive response
>       lxc-start 1421896313.532 WARN     lxc_cgmanager -
> cgmanager.c:cgm_get:963 - do_cgm_get exited with error
>       lxc-start 1421896313.534 ERROR    lxc_cgmanager -
> cgmanager.c:cgm_remove_cgroup:518 - call to cgmanager_remove_sync
> failed: invalid request
>       lxc-start 1421896313.534 ERROR    lxc_cgmanager -
> cgmanager.c:cgm_remove_cgroup:520 - Error removing all:lxc/rubik-2
>       lxc-start 1421896318.539 ERROR    lxc_start_ui -
> lxc_start.c:main:345 - The container failed to start.
>       lxc-start 1421896318.539 ERROR    lxc_start_ui -
> lxc_start.c:main:347 - To get more details, run the container in
> foreground mode.
>       lxc-start 1421896318.539 ERROR    lxc_start_ui -
> lxc_start.c:main:349 - Additional information can be obtained by
> setting the --logfile and --logpriority options.
> [...]
>
> unconfined containers seems to work fine. This very well could be
> because of me not using the ppa but I wanted to report anyway.

Haha I've a memory like a fish :)

https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-December/010962.html

Sorry for the noise...

>> The target final release date remains Monday the 26th of January.
>>
>> --
>> Stéphane Graber
>> Ubuntu developer
>> http://www.ubuntu.com
>>
>> _______________________________________________
>> lxc-devel mailing list
>> lxc-devel at lists.linuxcontainers.org
>> http://lists.linuxcontainers.org/listinfo/lxc-devel
>>
>
> Best,
> --
> S.Çağlar Onur <caglar at 10ur.org>



-- 
S.Çağlar Onur <caglar at 10ur.org>

From stgraber at ubuntu.com  Thu Jan 22 03:24:47 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Wed, 21 Jan 2015 22:24:47 -0500
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <CAF+rbZMYmmu3t_87CtuU1Hjq4CLas=VtL6xcE3oZtXSHPg+taQ@mail.gmail.com>
References: <20150121212716.GA22897@dakara>
 <CAF+rbZN5wg2mKca81fwU39yyRqj9y2WHY6tStCcsfRhWuzG+=g@mail.gmail.com>
 <CAF+rbZMYmmu3t_87CtuU1Hjq4CLas=VtL6xcE3oZtXSHPg+taQ@mail.gmail.com>
Message-ID: <20150122032447.GB22897@dakara>

On Wed, Jan 21, 2015 at 10:20:32PM -0500, S.Çağlar Onur wrote:
> On Wed, Jan 21, 2015 at 10:15 PM, S.Çağlar Onur <caglar at 10ur.org> wrote:
> > Hey Stéphane,
> >
> > On Wed, Jan 21, 2015 at 4:27 PM, Stéphane Graber <stgraber at ubuntu.com> wrote:
> >> Hey everyone,
> >>
> >> So after doing a fair amount of additional manual testing on it, I've
> >> just released LXC 1.1 rc1.
> >>
> >> That means that from now on, we won't be taking new features and will
> >> instead work on fixing any remaining rough edges with 1.1.
> >>
> >
> > On my trusty box where everything (including cgmanager/lxcfs and lxc)
> > compiled from source, this is what I'm getting while starting a
> > container;
> >
> > [...]
> >       lxc-start 1421896313.531 ERROR    lxc_apparmor -
> > lsm/apparmor.c:apparmor_process_label_set:185 - No such file or
> > directory - failed to change apparmor profile to lxc-container-default
> >       lxc-start 1421896313.531 ERROR    lxc_sync -
> > sync.c:__sync_wait:51 - invalid sequence number 1. expected 4
> >       lxc-start 1421896313.531 ERROR    lxc_start -
> > start.c:__lxc_start:1099 - failed to spawn 'rubik'
> >       lxc-start 1421896313.532 WARN     lxc_commands -
> > commands.c:lxc_cmd_rsp_recv:172 - command get_init_pid failed to
> > receive response
> >       lxc-start 1421896313.532 WARN     lxc_cgmanager -
> > cgmanager.c:cgm_get:963 - do_cgm_get exited with error
> >       lxc-start 1421896313.534 ERROR    lxc_cgmanager -
> > cgmanager.c:cgm_remove_cgroup:518 - call to cgmanager_remove_sync
> > failed: invalid request
> >       lxc-start 1421896313.534 ERROR    lxc_cgmanager -
> > cgmanager.c:cgm_remove_cgroup:520 - Error removing all:lxc/rubik-2
> >       lxc-start 1421896318.539 ERROR    lxc_start_ui -
> > lxc_start.c:main:345 - The container failed to start.
> >       lxc-start 1421896318.539 ERROR    lxc_start_ui -
> > lxc_start.c:main:347 - To get more details, run the container in
> > foreground mode.
> >       lxc-start 1421896318.539 ERROR    lxc_start_ui -
> > lxc_start.c:main:349 - Additional information can be obtained by
> > setting the --logfile and --logpriority options.
> > [...]
> >
> > unconfined containers seems to work fine. This very well could be
> > because of me not using the ppa but I wanted to report anyway.
> 
> Haha I've a memory like a fish :)
> 
> https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-December/010962.html
> 
> Sorry for the noise...

Isn't that fixed?

All my testing here was done using Ubuntu 14.04 with the LXC daily PPA
and lxc, cgmanager and lxcfs coming from it without seeing any kind of
problem.

> 
> >> The target final release date remains Monday the 26th of January.
> >>
> >> --
> >> Stéphane Graber
> >> Ubuntu developer
> >> http://www.ubuntu.com
> >>
> >> _______________________________________________
> >> lxc-devel mailing list
> >> lxc-devel at lists.linuxcontainers.org
> >> http://lists.linuxcontainers.org/listinfo/lxc-devel
> >>
> >
> > Best,
> > --
> > S.Çağlar Onur <caglar at 10ur.org>
> 
> 
> 
> -- 
> S.Çağlar Onur <caglar at 10ur.org>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150121/92fdc707/attachment.sig>

From caglar at 10ur.org  Thu Jan 22 04:06:07 2015
From: caglar at 10ur.org (=?UTF-8?B?Uy7Dh2HEn2xhciBPbnVy?=)
Date: Wed, 21 Jan 2015 23:06:07 -0500
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <20150122032447.GB22897@dakara>
References: <20150121212716.GA22897@dakara>
 <CAF+rbZN5wg2mKca81fwU39yyRqj9y2WHY6tStCcsfRhWuzG+=g@mail.gmail.com>
 <CAF+rbZMYmmu3t_87CtuU1Hjq4CLas=VtL6xcE3oZtXSHPg+taQ@mail.gmail.com>
 <20150122032447.GB22897@dakara>
Message-ID: <CAF+rbZOj4zCdVNE5zsVpbLmMK-82iG-T+X41-Q2UCE3nMrV3nA@mail.gmail.com>

On Wed, Jan 21, 2015 at 10:24 PM, Stéphane Graber <stgraber at ubuntu.com> wrote:
> On Wed, Jan 21, 2015 at 10:20:32PM -0500, S.Çağlar Onur wrote:
>> On Wed, Jan 21, 2015 at 10:15 PM, S.Çağlar Onur <caglar at 10ur.org> wrote:
>> > Hey Stéphane,
>> >
>> > On Wed, Jan 21, 2015 at 4:27 PM, Stéphane Graber <stgraber at ubuntu.com> wrote:
>> >> Hey everyone,
>> >>
>> >> So after doing a fair amount of additional manual testing on it, I've
>> >> just released LXC 1.1 rc1.
>> >>
>> >> That means that from now on, we won't be taking new features and will
>> >> instead work on fixing any remaining rough edges with 1.1.
>> >>
>> >
>> > On my trusty box where everything (including cgmanager/lxcfs and lxc)
>> > compiled from source, this is what I'm getting while starting a
>> > container;
>> >
>> > [...]
>> >       lxc-start 1421896313.531 ERROR    lxc_apparmor -
>> > lsm/apparmor.c:apparmor_process_label_set:185 - No such file or
>> > directory - failed to change apparmor profile to lxc-container-default
>> >       lxc-start 1421896313.531 ERROR    lxc_sync -
>> > sync.c:__sync_wait:51 - invalid sequence number 1. expected 4
>> >       lxc-start 1421896313.531 ERROR    lxc_start -
>> > start.c:__lxc_start:1099 - failed to spawn 'rubik'
>> >       lxc-start 1421896313.532 WARN     lxc_commands -
>> > commands.c:lxc_cmd_rsp_recv:172 - command get_init_pid failed to
>> > receive response
>> >       lxc-start 1421896313.532 WARN     lxc_cgmanager -
>> > cgmanager.c:cgm_get:963 - do_cgm_get exited with error
>> >       lxc-start 1421896313.534 ERROR    lxc_cgmanager -
>> > cgmanager.c:cgm_remove_cgroup:518 - call to cgmanager_remove_sync
>> > failed: invalid request
>> >       lxc-start 1421896313.534 ERROR    lxc_cgmanager -
>> > cgmanager.c:cgm_remove_cgroup:520 - Error removing all:lxc/rubik-2
>> >       lxc-start 1421896318.539 ERROR    lxc_start_ui -
>> > lxc_start.c:main:345 - The container failed to start.
>> >       lxc-start 1421896318.539 ERROR    lxc_start_ui -
>> > lxc_start.c:main:347 - To get more details, run the container in
>> > foreground mode.
>> >       lxc-start 1421896318.539 ERROR    lxc_start_ui -
>> > lxc_start.c:main:349 - Additional information can be obtained by
>> > setting the --logfile and --logpriority options.
>> > [...]
>> >
>> > unconfined containers seems to work fine. This very well could be
>> > because of me not using the ppa but I wanted to report anyway.
>>
>> Haha I've a memory like a fish :)
>>
>> https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-December/010962.html
>>
>> Sorry for the noise...
>
> Isn't that fixed?

I'm sure it is fixed with PPA but as I wrote I compiled everything
from source manually.

> All my testing here was done using Ubuntu 14.04 with the LXC daily PPA
> and lxc, cgmanager and lxcfs coming from it without seeing any kind of
> problem.
>
>>
>> >> The target final release date remains Monday the 26th of January.
>> >>
>> >> --
>> >> Stéphane Graber
>> >> Ubuntu developer
>> >> http://www.ubuntu.com
>> >>
>> >> _______________________________________________
>> >> lxc-devel mailing list
>> >> lxc-devel at lists.linuxcontainers.org
>> >> http://lists.linuxcontainers.org/listinfo/lxc-devel
>> >>
>> >
>> > Best,
>> > --
>> > S.Çağlar Onur <caglar at 10ur.org>
>>
>>
>>
>> --
>> S.Çağlar Onur <caglar at 10ur.org>
>> _______________________________________________
>> lxc-devel mailing list
>> lxc-devel at lists.linuxcontainers.org
>> http://lists.linuxcontainers.org/listinfo/lxc-devel
>
> --
> Stéphane Graber
> Ubuntu developer
> http://www.ubuntu.com
>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel
>



-- 
S.Çağlar Onur <caglar at 10ur.org>

From overlayfs at gmail.com  Thu Jan 22 05:41:09 2015
From: overlayfs at gmail.com (overlay fs)
Date: Thu, 22 Jan 2015 16:41:09 +1100
Subject: [lxc-devel] [PATCH RFC] yet another problem with new overlay fs
Message-ID: <CAEdj=z8gUAc6u-iHGPJfEK2+GQFzisDxCKcEAoT7mU6-4BWQnw@mail.gmail.com>

Traceback when running lxc-start-ephemeral on ubuntu-14.04 with the
lxc-daily ppa:


Traceback (most recent call last):
   File "/usr/bin/lxc-start-ephemeral", line 242, in <module>
      deltdir = "%s/delta%s" % (tmpdir, count)
NameError: name 'tmpdir' is not defined


Setting the environmental variables TMPDIR, TMP and TEMP doesn't
resolve the problem.

From stgraber at ubuntu.com  Thu Jan 22 16:55:21 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Thu, 22 Jan 2015 11:55:21 -0500
Subject: [lxc-devel] [PATCH] lxc-start-ephemeral: fix pep-8 and pyflakes3
Message-ID: <1421945721-13425-1-git-send-email-stgraber@ubuntu.com>

This defines a missing variable and re-indents the code a bit.

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 src/lxc/lxc-start-ephemeral.in | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
index 66abe56..b049f80 100644
--- a/src/lxc/lxc-start-ephemeral.in
+++ b/src/lxc/lxc-start-ephemeral.in
@@ -239,6 +239,7 @@ LXC_NAME="%s"
 
     count = 0
     for entry in overlay_dirs:
+        tmpdir = "%s/tmpfs" % dest_path
         deltdir = "%s/delta%s" % (tmpdir, count)
         workdir = "%s/work%s" % (tmpdir, count)
         fd.write("mkdir -p %s %s\n" % (deltdir, entry[1]))
@@ -250,23 +251,25 @@ LXC_NAME="%s"
             fd.write("mkdir %s\n" % deltdir)
             fd.write("mkdir %s\n" % workdir)
 
-        fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], deltdir))
-        fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
+        fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" %
+                 (entry[0], deltdir))
+        fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" %
+                 (entry[0], entry[1]))
 
         if args.union_type == "overlayfs":
             if have_new_overlay:
                 fd.write("mount -n -t overlay"
-                     " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
-                         deltdir,
-                         entry[0],
-                         workdir,
-                         entry[1]))
+                         " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
+                             deltdir,
+                             entry[0],
+                             workdir,
+                             entry[1]))
             else:
                 fd.write("mount -n -t overlayfs"
-                     " -oupperdir=%s,lowerdir=%s none %s\n" % (
-                         deltdir,
-                         entry[0],
-                         entry[1]))
+                         " -oupperdir=%s,lowerdir=%s none %s\n" % (
+                             deltdir,
+                             entry[0],
+                             entry[1]))
         elif args.union_type == "aufs":
             xino_path = "%s/lxc/aufs.xino" % get_rundir()
             if not os.path.exists(os.path.basename(xino_path)):
-- 
1.9.1


From serge.hallyn at ubuntu.com  Thu Jan 22 16:58:51 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Thu, 22 Jan 2015 16:58:51 +0000
Subject: [lxc-devel] [PATCH] lxc-start-ephemeral: fix pep-8 and pyflakes3
In-Reply-To: <1421945721-13425-1-git-send-email-stgraber@ubuntu.com>
References: <1421945721-13425-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150122165851.GB1702@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> This defines a missing variable and re-indents the code a bit.
> 
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  src/lxc/lxc-start-ephemeral.in | 25 ++++++++++++++-----------
>  1 file changed, 14 insertions(+), 11 deletions(-)
> 
> diff --git a/src/lxc/lxc-start-ephemeral.in b/src/lxc/lxc-start-ephemeral.in
> index 66abe56..b049f80 100644
> --- a/src/lxc/lxc-start-ephemeral.in
> +++ b/src/lxc/lxc-start-ephemeral.in
> @@ -239,6 +239,7 @@ LXC_NAME="%s"
>  
>      count = 0
>      for entry in overlay_dirs:
> +        tmpdir = "%s/tmpfs" % dest_path
>          deltdir = "%s/delta%s" % (tmpdir, count)
>          workdir = "%s/work%s" % (tmpdir, count)
>          fd.write("mkdir -p %s %s\n" % (deltdir, entry[1]))
> @@ -250,23 +251,25 @@ LXC_NAME="%s"
>              fd.write("mkdir %s\n" % deltdir)
>              fd.write("mkdir %s\n" % workdir)
>  
> -        fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], deltdir))
> -        fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" % (entry[0], entry[1]))
> +        fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" %
> +                 (entry[0], deltdir))
> +        fd.write("getfacl -a %s | setfacl --set-file=- %s || true\n" %
> +                 (entry[0], entry[1]))
>  
>          if args.union_type == "overlayfs":
>              if have_new_overlay:
>                  fd.write("mount -n -t overlay"
> -                     " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
> -                         deltdir,
> -                         entry[0],
> -                         workdir,
> -                         entry[1]))
> +                         " -oupperdir=%s,lowerdir=%s,workdir=%s none %s\n" % (
> +                             deltdir,
> +                             entry[0],
> +                             workdir,
> +                             entry[1]))
>              else:
>                  fd.write("mount -n -t overlayfs"
> -                     " -oupperdir=%s,lowerdir=%s none %s\n" % (
> -                         deltdir,
> -                         entry[0],
> -                         entry[1]))
> +                         " -oupperdir=%s,lowerdir=%s none %s\n" % (
> +                             deltdir,
> +                             entry[0],
> +                             entry[1]))
>          elif args.union_type == "aufs":
>              xino_path = "%s/lxc/aufs.xino" % get_rundir()
>              if not os.path.exists(os.path.basename(xino_path)):
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From stgraber at ubuntu.com  Thu Jan 22 17:02:22 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 22 Jan 2015 12:02:22 -0500
Subject: [lxc-devel] [PATCH RFC] yet another problem with new overlay fs
In-Reply-To: <CAEdj=z8gUAc6u-iHGPJfEK2+GQFzisDxCKcEAoT7mU6-4BWQnw@mail.gmail.com>
References: <CAEdj=z8gUAc6u-iHGPJfEK2+GQFzisDxCKcEAoT7mU6-4BWQnw@mail.gmail.com>
Message-ID: <20150122170222.GE22897@dakara>

On Thu, Jan 22, 2015 at 04:41:09PM +1100, overlay fs wrote:
> Traceback when running lxc-start-ephemeral on ubuntu-14.04 with the
> lxc-daily ppa:
> 
> 
> Traceback (most recent call last):
>    File "/usr/bin/lxc-start-ephemeral", line 242, in <module>
>       deltdir = "%s/delta%s" % (tmpdir, count)
> NameError: name 'tmpdir' is not defined
> 
> 
> Setting the environmental variables TMPDIR, TMP and TEMP doesn't
> resolve the problem.

Just pushed what should be a working fix for this now to git master.

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150122/1aff78a3/attachment.sig>

From noreply at github.com  Thu Jan 22 17:01:45 2015
From: noreply at github.com (GitHub)
Date: Thu, 22 Jan 2015 09:01:45 -0800
Subject: [lxc-devel] [lxc/lxc] ce72f6: lxc-start-ephemeral: fix pep-8 and
	pyflakes3
Message-ID: <54c12cf9c41b0_460c3ff811f6d29c227df@hookshot-fe1-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: ce72f6b466f714b4e7de912ed5546179ddf36a21
      https://github.com/lxc/lxc/commit/ce72f6b466f714b4e7de912ed5546179ddf36a21
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-22 (Thu, 22 Jan 2015)

  Changed paths:
    M src/lxc/lxc-start-ephemeral.in

  Log Message:
  -----------
  lxc-start-ephemeral: fix pep-8 and pyflakes3

This defines a missing variable and re-indents the code a bit.

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>



From mail at ojkastl.de  Thu Jan 22 20:00:05 2015
From: mail at ojkastl.de (Johannes Kastl)
Date: Thu, 22 Jan 2015 21:00:05 +0100
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <20150121212716.GA22897@dakara>
References: <20150121212716.GA22897@dakara>
Message-ID: <m9rks6$ljv$1@ger.gmane.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 21.01.2015 Stéphane Graber wrote:

> That means that from now on, we won't be taking new features and
> will instead work on fixing any remaining rough edges with 1.1.

I just tested the packages from my repository on the openSUSE build
service, and I can't start any container on my openSUSE Tumbleweed host:

> $ sudo lxc-start -n DEBIAN lxc-start: lxc_start.c: main: 345 The
> container failed to start. lxc-start: lxc_start.c: main: 347 To get
> more details, run the container in foreground mode. lxc-start:
> lxc_start.c: main: 349 Additional information can be obtained by
> setting the --logfile and --logpriority options.

Apparently this is an issue with apparmor:
> lxc-start 1421956341.455 ERROR    lxc_apparmor -
> lsm/apparmor.c:apparmor_process_label_set:171 - If you really want
> to start this container, set lxc-start 1421956341.455 ERROR
> lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:172 -
> lxc.aa_allow_incomplete = 1 lxc-start 1421956341.455 ERROR
> lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:173 - in
> your container configuration file

Adding lxc.aa_allow_incomplete = 1 allows me to start the container.

How to solve this for the 1.1 release? I am not familiar with
apparmor, and I have no idea where the error is. Apparmor profile? lxc?

Regards,
Johannes

BTW: What happened to the nice output of lxc-ls --fancy? Is there any
replacement for it? Apart from listing the directories I found no use
for it anymore. The old one showed stuff about autostart, IPs, etc.


- -- 
The problem with the world is stupidity. Not saying there should be a
capital punishment for stupidity, but why don't we just take the
safety labels off of everything and let the problem solve itself?
(Frank Zappa)
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/

iEYEARECAAYFAlTBVsAACgkQzi3gQ/xETbLmzwCfQDiRqvyYxiTF5aW96+mBIm4E
3uAAn1DdijN5qOHq2PHhWl2FNYVCByPV
=4mXJ
-----END PGP SIGNATURE-----


From stgraber at ubuntu.com  Thu Jan 22 20:04:36 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 22 Jan 2015 15:04:36 -0500
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <m9rks6$ljv$1@ger.gmane.org>
References: <20150121212716.GA22897@dakara>
 <m9rks6$ljv$1@ger.gmane.org>
Message-ID: <20150122200436.GH22897@dakara>

That error suggests that you don't have the lxc-container-default
profile loaded into your local apparmor.

That may be because you didn't reload apparmor or because the profiles
aren't installed in the right location or because your apparmor doesn't
support all the features in our profile (in which case you need to
comment the offending lines, possibly doing that in your packaging).


It's true that 1.1 is slightly different in that regard since we added
more things to the profile and also made any error when loading the
profile fatal (so that you're not under the false impression that you
are protected).

On Thu, Jan 22, 2015 at 09:00:05PM +0100, Johannes Kastl wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 21.01.2015 Stéphane Graber wrote:
> 
> > That means that from now on, we won't be taking new features and
> > will instead work on fixing any remaining rough edges with 1.1.
> 
> I just tested the packages from my repository on the openSUSE build
> service, and I can't start any container on my openSUSE Tumbleweed host:
> 
> > $ sudo lxc-start -n DEBIAN lxc-start: lxc_start.c: main: 345 The
> > container failed to start. lxc-start: lxc_start.c: main: 347 To get
> > more details, run the container in foreground mode. lxc-start:
> > lxc_start.c: main: 349 Additional information can be obtained by
> > setting the --logfile and --logpriority options.
> 
> Apparently this is an issue with apparmor:
> > lxc-start 1421956341.455 ERROR    lxc_apparmor -
> > lsm/apparmor.c:apparmor_process_label_set:171 - If you really want
> > to start this container, set lxc-start 1421956341.455 ERROR
> > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:172 -
> > lxc.aa_allow_incomplete = 1 lxc-start 1421956341.455 ERROR
> > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:173 - in
> > your container configuration file
> 
> Adding lxc.aa_allow_incomplete = 1 allows me to start the container.
> 
> How to solve this for the 1.1 release? I am not familiar with
> apparmor, and I have no idea where the error is. Apparmor profile? lxc?
> 
> Regards,
> Johannes
> 
> BTW: What happened to the nice output of lxc-ls --fancy? Is there any
> replacement for it? Apart from listing the directories I found no use
> for it anymore. The old one showed stuff about autostart, IPs, etc.
> 
> 
> - -- 
> The problem with the world is stupidity. Not saying there should be a
> capital punishment for stupidity, but why don't we just take the
> safety labels off of everything and let the problem solve itself?
> (Frank Zappa)
> -----BEGIN PGP SIGNATURE-----
> Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/
> 
> iEYEARECAAYFAlTBVsAACgkQzi3gQ/xETbLmzwCfQDiRqvyYxiTF5aW96+mBIm4E
> 3uAAn1DdijN5qOHq2PHhWl2FNYVCByPV
> =4mXJ
> -----END PGP SIGNATURE-----
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150122/016d92b3/attachment.sig>

From stgraber at ubuntu.com  Thu Jan 22 20:05:21 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 22 Jan 2015 15:05:21 -0500
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <m9rks6$ljv$1@ger.gmane.org>
References: <20150121212716.GA22897@dakara>
 <m9rks6$ljv$1@ger.gmane.org>
Message-ID: <20150122200521.GI22897@dakara>

On Thu, Jan 22, 2015 at 09:00:05PM +0100, Johannes Kastl wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 21.01.2015 Stéphane Graber wrote:
> 
> > That means that from now on, we won't be taking new features and
> > will instead work on fixing any remaining rough edges with 1.1.
> 
> I just tested the packages from my repository on the openSUSE build
> service, and I can't start any container on my openSUSE Tumbleweed host:
> 
> > $ sudo lxc-start -n DEBIAN lxc-start: lxc_start.c: main: 345 The
> > container failed to start. lxc-start: lxc_start.c: main: 347 To get
> > more details, run the container in foreground mode. lxc-start:
> > lxc_start.c: main: 349 Additional information can be obtained by
> > setting the --logfile and --logpriority options.
> 
> Apparently this is an issue with apparmor:
> > lxc-start 1421956341.455 ERROR    lxc_apparmor -
> > lsm/apparmor.c:apparmor_process_label_set:171 - If you really want
> > to start this container, set lxc-start 1421956341.455 ERROR
> > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:172 -
> > lxc.aa_allow_incomplete = 1 lxc-start 1421956341.455 ERROR
> > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:173 - in
> > your container configuration file
> 
> Adding lxc.aa_allow_incomplete = 1 allows me to start the container.
> 
> How to solve this for the 1.1 release? I am not familiar with
> apparmor, and I have no idea where the error is. Apparmor profile? lxc?
> 
> Regards,
> Johannes
> 
> BTW: What happened to the nice output of lxc-ls --fancy? Is there any
> replacement for it? Apart from listing the directories I found no use
> for it anymore. The old one showed stuff about autostart, IPs, etc.

It's still there. Did you compile with python3 support enabled? sounds
like you're getting the shell fallback script which doesn't have --fancy
(and never did).

> 
> 
> - -- 
> The problem with the world is stupidity. Not saying there should be a
> capital punishment for stupidity, but why don't we just take the
> safety labels off of everything and let the problem solve itself?
> (Frank Zappa)
> -----BEGIN PGP SIGNATURE-----
> Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/
> 
> iEYEARECAAYFAlTBVsAACgkQzi3gQ/xETbLmzwCfQDiRqvyYxiTF5aW96+mBIm4E
> 3uAAn1DdijN5qOHq2PHhWl2FNYVCByPV
> =4mXJ
> -----END PGP SIGNATURE-----
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150122/125377f9/attachment.sig>

From serge.hallyn at ubuntu.com  Thu Jan 22 21:32:50 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Thu, 22 Jan 2015 21:32:50 +0000
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <m9rks6$ljv$1@ger.gmane.org>
References: <20150121212716.GA22897@dakara>
 <m9rks6$ljv$1@ger.gmane.org>
Message-ID: <20150122213250.GC1702@ubuntumail>

Quoting Johannes Kastl (mail at ojkastl.de):
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 21.01.2015 Stéphane Graber wrote:
> 
> > That means that from now on, we won't be taking new features and
> > will instead work on fixing any remaining rough edges with 1.1.
> 
> I just tested the packages from my repository on the openSUSE build
> service, and I can't start any container on my openSUSE Tumbleweed host:
> 
> > $ sudo lxc-start -n DEBIAN lxc-start: lxc_start.c: main: 345 The
> > container failed to start. lxc-start: lxc_start.c: main: 347 To get
> > more details, run the container in foreground mode. lxc-start:
> > lxc_start.c: main: 349 Additional information can be obtained by
> > setting the --logfile and --logpriority options.
> 
> Apparently this is an issue with apparmor:
> > lxc-start 1421956341.455 ERROR    lxc_apparmor -
> > lsm/apparmor.c:apparmor_process_label_set:171 - If you really want
> > to start this container, set lxc-start 1421956341.455 ERROR
> > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:172 -
> > lxc.aa_allow_incomplete = 1 lxc-start 1421956341.455 ERROR
> > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:173 - in
> > your container configuration file
> 
> Adding lxc.aa_allow_incomplete = 1 allows me to start the container.
> 
> How to solve this for the 1.1 release? I am not familiar with
> apparmor, and I have no idea where the error is. Apparmor profile? lxc?

Your kernel doesn't have the patches for apparmor mount restrictions.
(You can verify this by looking for the file
/sys/kernel/security/apparmor/features/mount/mask )

(The patches to provide that are not yet upstream, unfortunately,
but hopefully that'll be fixed soon)

The three possible workarounds are:

1. get the apparmor mount feature patchset into your kernel (probably
not very feasible?)
2. run containers unconfined by default
3. add lxc.aa_allow_incomplete = 1 to  /usr/share/lxc/config/common.conf
or (perhaps better) a file under /usr/share/lxc/config/common.conf.d

The lack of mount restrictions significantly weakens the security
guarantees apparmor can provide, so unless you will default to
unprivileged containers, (1) may be the hardest but would be the
best solution.

> Regards,
> Johannes
> 
> BTW: What happened to the nice output of lxc-ls --fancy? Is there any
> replacement for it? Apart from listing the directories I found no use
> for it anymore. The old one showed stuff about autostart, IPs, etc.
> 
> 
> - -- 
> The problem with the world is stupidity. Not saying there should be a
> capital punishment for stupidity, but why don't we just take the
> safety labels off of everything and let the problem solve itself?
> (Frank Zappa)
> -----BEGIN PGP SIGNATURE-----
> Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/
> 
> iEYEARECAAYFAlTBVsAACgkQzi3gQ/xETbLmzwCfQDiRqvyYxiTF5aW96+mBIm4E
> 3uAAn1DdijN5qOHq2PHhWl2FNYVCByPV
> =4mXJ
> -----END PGP SIGNATURE-----
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From stgraber at ubuntu.com  Thu Jan 22 21:36:15 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 22 Jan 2015 16:36:15 -0500
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <20150122213250.GC1702@ubuntumail>
References: <20150121212716.GA22897@dakara> <m9rks6$ljv$1@ger.gmane.org>
 <20150122213250.GC1702@ubuntumail>
Message-ID: <20150122213615.GA17513@dakara>

On Thu, Jan 22, 2015 at 09:32:50PM +0000, Serge Hallyn wrote:
> Quoting Johannes Kastl (mail at ojkastl.de):
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> > 
> > On 21.01.2015 Stéphane Graber wrote:
> > 
> > > That means that from now on, we won't be taking new features and
> > > will instead work on fixing any remaining rough edges with 1.1.
> > 
> > I just tested the packages from my repository on the openSUSE build
> > service, and I can't start any container on my openSUSE Tumbleweed host:
> > 
> > > $ sudo lxc-start -n DEBIAN lxc-start: lxc_start.c: main: 345 The
> > > container failed to start. lxc-start: lxc_start.c: main: 347 To get
> > > more details, run the container in foreground mode. lxc-start:
> > > lxc_start.c: main: 349 Additional information can be obtained by
> > > setting the --logfile and --logpriority options.
> > 
> > Apparently this is an issue with apparmor:
> > > lxc-start 1421956341.455 ERROR    lxc_apparmor -
> > > lsm/apparmor.c:apparmor_process_label_set:171 - If you really want
> > > to start this container, set lxc-start 1421956341.455 ERROR
> > > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:172 -
> > > lxc.aa_allow_incomplete = 1 lxc-start 1421956341.455 ERROR
> > > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:173 - in
> > > your container configuration file
> > 
> > Adding lxc.aa_allow_incomplete = 1 allows me to start the container.
> > 
> > How to solve this for the 1.1 release? I am not familiar with
> > apparmor, and I have no idea where the error is. Apparmor profile? lxc?
> 
> Your kernel doesn't have the patches for apparmor mount restrictions.
> (You can verify this by looking for the file
> /sys/kernel/security/apparmor/features/mount/mask )
> 
> (The patches to provide that are not yet upstream, unfortunately,
> but hopefully that'll be fixed soon)
> 
> The three possible workarounds are:
> 
> 1. get the apparmor mount feature patchset into your kernel (probably
> not very feasible?)
> 2. run containers unconfined by default
> 3. add lxc.aa_allow_incomplete = 1 to  /usr/share/lxc/config/common.conf
> or (perhaps better) a file under /usr/share/lxc/config/common.conf.d
> 
> The lack of mount restrictions significantly weakens the security
> guarantees apparmor can provide, so unless you will default to
> unprivileged containers, (1) may be the hardest but would be the
> best solution.

Or just comment those lines?

> 
> > Regards,
> > Johannes
> > 
> > BTW: What happened to the nice output of lxc-ls --fancy? Is there any
> > replacement for it? Apart from listing the directories I found no use
> > for it anymore. The old one showed stuff about autostart, IPs, etc.
> > 
> > 
> > - -- 
> > The problem with the world is stupidity. Not saying there should be a
> > capital punishment for stupidity, but why don't we just take the
> > safety labels off of everything and let the problem solve itself?
> > (Frank Zappa)
> > -----BEGIN PGP SIGNATURE-----
> > Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/
> > 
> > iEYEARECAAYFAlTBVsAACgkQzi3gQ/xETbLmzwCfQDiRqvyYxiTF5aW96+mBIm4E
> > 3uAAn1DdijN5qOHq2PHhWl2FNYVCByPV
> > =4mXJ
> > -----END PGP SIGNATURE-----
> > 
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150122/d3647c7b/attachment-0001.sig>

From serge.hallyn at ubuntu.com  Thu Jan 22 22:36:50 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Thu, 22 Jan 2015 22:36:50 +0000
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <20150122213615.GA17513@dakara>
References: <20150121212716.GA22897@dakara> <m9rks6$ljv$1@ger.gmane.org>
 <20150122213250.GC1702@ubuntumail> <20150122213615.GA17513@dakara>
Message-ID: <20150122223650.GD1702@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> On Thu, Jan 22, 2015 at 09:32:50PM +0000, Serge Hallyn wrote:
> > Quoting Johannes Kastl (mail at ojkastl.de):
> > > -----BEGIN PGP SIGNED MESSAGE-----
> > > Hash: SHA1
> > > 
> > > On 21.01.2015 Stéphane Graber wrote:
> > > 
> > > > That means that from now on, we won't be taking new features and
> > > > will instead work on fixing any remaining rough edges with 1.1.
> > > 
> > > I just tested the packages from my repository on the openSUSE build
> > > service, and I can't start any container on my openSUSE Tumbleweed host:
> > > 
> > > > $ sudo lxc-start -n DEBIAN lxc-start: lxc_start.c: main: 345 The
> > > > container failed to start. lxc-start: lxc_start.c: main: 347 To get
> > > > more details, run the container in foreground mode. lxc-start:
> > > > lxc_start.c: main: 349 Additional information can be obtained by
> > > > setting the --logfile and --logpriority options.
> > > 
> > > Apparently this is an issue with apparmor:
> > > > lxc-start 1421956341.455 ERROR    lxc_apparmor -
> > > > lsm/apparmor.c:apparmor_process_label_set:171 - If you really want
> > > > to start this container, set lxc-start 1421956341.455 ERROR
> > > > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:172 -
> > > > lxc.aa_allow_incomplete = 1 lxc-start 1421956341.455 ERROR
> > > > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:173 - in
> > > > your container configuration file
> > > 
> > > Adding lxc.aa_allow_incomplete = 1 allows me to start the container.
> > > 
> > > How to solve this for the 1.1 release? I am not familiar with
> > > apparmor, and I have no idea where the error is. Apparmor profile? lxc?
> > 
> > Your kernel doesn't have the patches for apparmor mount restrictions.
> > (You can verify this by looking for the file
> > /sys/kernel/security/apparmor/features/mount/mask )
> > 
> > (The patches to provide that are not yet upstream, unfortunately,
> > but hopefully that'll be fixed soon)
> > 
> > The three possible workarounds are:
> > 
> > 1. get the apparmor mount feature patchset into your kernel (probably
> > not very feasible?)
> > 2. run containers unconfined by default
> > 3. add lxc.aa_allow_incomplete = 1 to  /usr/share/lxc/config/common.conf
> > or (perhaps better) a file under /usr/share/lxc/config/common.conf.d
> > 
> > The lack of mount restrictions significantly weakens the security
> > guarantees apparmor can provide, so unless you will default to
> > unprivileged containers, (1) may be the hardest but would be the
> > best solution.
> 
> Or just comment those lines?

You mean the lines in src/lxc/lsm/apparmor.c?

From stgraber at ubuntu.com  Fri Jan 23 00:14:12 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 22 Jan 2015 19:14:12 -0500
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <20150122223650.GD1702@ubuntumail>
References: <20150121212716.GA22897@dakara> <m9rks6$ljv$1@ger.gmane.org>
 <20150122213250.GC1702@ubuntumail> <20150122213615.GA17513@dakara>
 <20150122223650.GD1702@ubuntumail>
Message-ID: <20150123001358.GA882@dakara>

On Thu, Jan 22, 2015 at 10:36:50PM +0000, Serge Hallyn wrote:
> Quoting Stéphane Graber (stgraber at ubuntu.com):
> > On Thu, Jan 22, 2015 at 09:32:50PM +0000, Serge Hallyn wrote:
> > > Quoting Johannes Kastl (mail at ojkastl.de):
> > > > -----BEGIN PGP SIGNED MESSAGE-----
> > > > Hash: SHA1
> > > > 
> > > > On 21.01.2015 Stéphane Graber wrote:
> > > > 
> > > > > That means that from now on, we won't be taking new features and
> > > > > will instead work on fixing any remaining rough edges with 1.1.
> > > > 
> > > > I just tested the packages from my repository on the openSUSE build
> > > > service, and I can't start any container on my openSUSE Tumbleweed host:
> > > > 
> > > > > $ sudo lxc-start -n DEBIAN lxc-start: lxc_start.c: main: 345 The
> > > > > container failed to start. lxc-start: lxc_start.c: main: 347 To get
> > > > > more details, run the container in foreground mode. lxc-start:
> > > > > lxc_start.c: main: 349 Additional information can be obtained by
> > > > > setting the --logfile and --logpriority options.
> > > > 
> > > > Apparently this is an issue with apparmor:
> > > > > lxc-start 1421956341.455 ERROR    lxc_apparmor -
> > > > > lsm/apparmor.c:apparmor_process_label_set:171 - If you really want
> > > > > to start this container, set lxc-start 1421956341.455 ERROR
> > > > > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:172 -
> > > > > lxc.aa_allow_incomplete = 1 lxc-start 1421956341.455 ERROR
> > > > > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:173 - in
> > > > > your container configuration file
> > > > 
> > > > Adding lxc.aa_allow_incomplete = 1 allows me to start the container.
> > > > 
> > > > How to solve this for the 1.1 release? I am not familiar with
> > > > apparmor, and I have no idea where the error is. Apparmor profile? lxc?
> > > 
> > > Your kernel doesn't have the patches for apparmor mount restrictions.
> > > (You can verify this by looking for the file
> > > /sys/kernel/security/apparmor/features/mount/mask )
> > > 
> > > (The patches to provide that are not yet upstream, unfortunately,
> > > but hopefully that'll be fixed soon)
> > > 
> > > The three possible workarounds are:
> > > 
> > > 1. get the apparmor mount feature patchset into your kernel (probably
> > > not very feasible?)
> > > 2. run containers unconfined by default
> > > 3. add lxc.aa_allow_incomplete = 1 to  /usr/share/lxc/config/common.conf
> > > or (perhaps better) a file under /usr/share/lxc/config/common.conf.d
> > > 
> > > The lack of mount restrictions significantly weakens the security
> > > guarantees apparmor can provide, so unless you will default to
> > > unprivileged containers, (1) may be the hardest but would be the
> > > best solution.
> > 
> > Or just comment those lines?
> 
> You mean the lines in src/lxc/lsm/apparmor.c?

I mean the mount, or socket or whatever lines in the apparmor profile
isn't understood by the apparmor parser on the system.

Basically what we do with the Ubuntu package where we strip any apparmor
profile stanza which the parser on the given release doesn't support.

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150122/a62182bc/attachment.sig>

From mathias at calenhad.com  Fri Jan 23 00:48:10 2015
From: mathias at calenhad.com (Mathias Gibbens)
Date: Fri, 23 Jan 2015 00:48:10 +0000
Subject: [lxc-devel] `top` within unprivileged container breaks host
Message-ID: <1421974090.4981.53.camel@olorin.calenhad.com>

Hello,

  I've been testing LXC 1.1-rc1 on a Debian jessie system. Specifically,
since all the pieces are now in place to support systemd in unprivileged
containers, I've been testing running Debian jessie within an
unprivileged container.

  The jessie container successfully starts (there are some errors along
the way, but that's another issue), and I can do a `lxc-attach`, add a
user and log in. However, if I run `top` within the container I only get
two lines of output:

top - 00:13:25 up 4 min,  0 users,  load average: 0.01, 0.05, 0.05
Tasks:  10 total,   1 running,   9 sleeping,   0 stopped,   0 zombie

  Furthermore, the host system breaks spectacularly:

lxc at lxc:~$ top
Error, do this: mount -t proc proc /proc
lxc at lxc:~$ /sbin/ifconfig
Warning: cannot open /proc/net/dev (No such file or directory). Limited
output.
lxc at lxc:~$ mount
mount: failed to read mtab: No such file or directory
lxc at lxc:~$ df
df: cannot read table of mounted file systems: No such file or directory
lxc at lxc:~$ sudo reboot
Running in chroot, ignoring request.

  It seems that /proc is being unmounted somehow on the host. I can
re-mount /proc on the host, and things seem to work again. (I haven't
tested too much after re-mounting, instead opting to just reboot the
host back to a known good state.)

  Any idea what is causing this to happen? I have also tried running
Ubuntu Vivid as an unprivileged container and see the same results. I
have not yet tried a different Linux distro for the host system.

  Host system details: Debian jessie with kernel 3.16.7-ckt2-1 x86_64,
systemd-215, LXC-1.1-rc1 and lxcfs built from current git checkout,
cgmanager-0.35 as packaged from the sid repository.

Thanks for any ideas,
Mathias
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150123/5a43f06b/attachment.sig>

From serge.hallyn at ubuntu.com  Fri Jan 23 02:55:32 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 23 Jan 2015 02:55:32 +0000
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <20150123001358.GA882@dakara>
References: <20150121212716.GA22897@dakara> <m9rks6$ljv$1@ger.gmane.org>
 <20150122213250.GC1702@ubuntumail> <20150122213615.GA17513@dakara>
 <20150122223650.GD1702@ubuntumail> <20150123001358.GA882@dakara>
Message-ID: <20150123025532.GE1702@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> On Thu, Jan 22, 2015 at 10:36:50PM +0000, Serge Hallyn wrote:
> > Quoting Stéphane Graber (stgraber at ubuntu.com):
> > > On Thu, Jan 22, 2015 at 09:32:50PM +0000, Serge Hallyn wrote:
> > > > Quoting Johannes Kastl (mail at ojkastl.de):
> > > > > -----BEGIN PGP SIGNED MESSAGE-----
> > > > > Hash: SHA1
> > > > > 
> > > > > On 21.01.2015 Stéphane Graber wrote:
> > > > > 
> > > > > > That means that from now on, we won't be taking new features and
> > > > > > will instead work on fixing any remaining rough edges with 1.1.
> > > > > 
> > > > > I just tested the packages from my repository on the openSUSE build
> > > > > service, and I can't start any container on my openSUSE Tumbleweed host:
> > > > > 
> > > > > > $ sudo lxc-start -n DEBIAN lxc-start: lxc_start.c: main: 345 The
> > > > > > container failed to start. lxc-start: lxc_start.c: main: 347 To get
> > > > > > more details, run the container in foreground mode. lxc-start:
> > > > > > lxc_start.c: main: 349 Additional information can be obtained by
> > > > > > setting the --logfile and --logpriority options.
> > > > > 
> > > > > Apparently this is an issue with apparmor:
> > > > > > lxc-start 1421956341.455 ERROR    lxc_apparmor -
> > > > > > lsm/apparmor.c:apparmor_process_label_set:171 - If you really want
> > > > > > to start this container, set lxc-start 1421956341.455 ERROR
> > > > > > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:172 -
> > > > > > lxc.aa_allow_incomplete = 1 lxc-start 1421956341.455 ERROR
> > > > > > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:173 - in
> > > > > > your container configuration file
> > > > > 
> > > > > Adding lxc.aa_allow_incomplete = 1 allows me to start the container.
> > > > > 
> > > > > How to solve this for the 1.1 release? I am not familiar with
> > > > > apparmor, and I have no idea where the error is. Apparmor profile? lxc?
> > > > 
> > > > Your kernel doesn't have the patches for apparmor mount restrictions.
> > > > (You can verify this by looking for the file
> > > > /sys/kernel/security/apparmor/features/mount/mask )
> > > > 
> > > > (The patches to provide that are not yet upstream, unfortunately,
> > > > but hopefully that'll be fixed soon)
> > > > 
> > > > The three possible workarounds are:
> > > > 
> > > > 1. get the apparmor mount feature patchset into your kernel (probably
> > > > not very feasible?)
> > > > 2. run containers unconfined by default
> > > > 3. add lxc.aa_allow_incomplete = 1 to  /usr/share/lxc/config/common.conf
> > > > or (perhaps better) a file under /usr/share/lxc/config/common.conf.d
> > > > 
> > > > The lack of mount restrictions significantly weakens the security
> > > > guarantees apparmor can provide, so unless you will default to
> > > > unprivileged containers, (1) may be the hardest but would be the
> > > > best solution.
> > > 
> > > Or just comment those lines?
> > 
> > You mean the lines in src/lxc/lsm/apparmor.c?
> 
> I mean the mount, or socket or whatever lines in the apparmor profile
> isn't understood by the apparmor parser on the system.
> 
> Basically what we do with the Ubuntu package where we strip any apparmor
> profile stanza which the parser on the given release doesn't support.

This isn't that kind of problem.  The code is actually saying "the host
won't be as safe from the container as you think it will, so we won't
run the container unless you specifically say to do so".  This is to
prevent users who had the mount features but now booted a regressed
kernel from starting containers which are now less safe than they were
before.

(see the commit msg for 7aff4f43fd)

If you know your distro won't provide the apparmor mount feature, then
setting the aa_allow_incomplete flag globally is the way to go.  (Before
that commit, you would have ended up with no apparmor at all rather
than incomplete apparmor, or running under lxc-start profile, so the new
behavior is still better)

-serge

From mail at ojkastl.de  Fri Jan 23 08:21:02 2015
From: mail at ojkastl.de (Johannes Kastl)
Date: Fri, 23 Jan 2015 09:21:02 +0100
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <20150122200521.GI22897@dakara>
References: <20150121212716.GA22897@dakara> <m9rks6$ljv$1@ger.gmane.org>
 <20150122200521.GI22897@dakara>
Message-ID: <m9t09e$pei$1@ger.gmane.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 22.01.2015 Stéphane Graber wrote:
> On Thu, Jan 22, 2015 at 09:00:05PM +0100, Johannes Kastl wrote:

> BTW: What happened to the nice output of lxc-ls --fancy? Is there
> any replacement for it? Apart from listing the directories I found
> no use for it anymore. The old one showed stuff about autostart,
> IPs, etc.
> 
>> It's still there. Did you compile with python3 support enabled?
>> sounds like you're getting the shell fallback script which
>> doesn't have --fancy (and never did).

Right, enabling python was missing. Is now fixed in the builds.

Regards,
Johannes
- -- 
The first half of our lives is ruined by our parents, and the second
half by our children.
(Clarence Darrow, 1857-1938)
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/

iEYEARECAAYFAlTCBG0ACgkQzi3gQ/xETbKGrgCbBrWwB104V0qEsD29MWkrnw3d
YuwAnRFrgYtDWLH7DxOw/WetDE3rIF3K
=FMQA
-----END PGP SIGNATURE-----


From mail at ojkastl.de  Fri Jan 23 08:38:26 2015
From: mail at ojkastl.de (Johannes Kastl)
Date: Fri, 23 Jan 2015 09:38:26 +0100
Subject: [lxc-devel] Dependency on correct lxc-libs missing in the spec?
Message-ID: <m9t1a2$pei$2@ger.gmane.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi everyone,

as I have multiple repositories enabled on my openSUSE machine, each
of with contains a different version of lxc and lxc-libs, I found that
it is possible mix versions of lxc and lxc-libs. That means, that lxc
does not depend on a matching version of lxc-libs.

> $ zypper search --details --match-exact lxc-libs Loading repository
> data... Reading installed packages...
> 
> S | Name     | Type    | Version                 | Arch   |
> Repository
>  
> --+----------+---------+-------------------------+--------+-----------------------------------------------------------------------------
>
> 
v | lxc-libs | package | 1.99.ce72f6b.HEAD-8.1   | x86_64 |
openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_HEAD_git_snapshot
> v | lxc-libs | package | 1.1.99.ce72f6b.rc1-11.1 | x86_64 |
> openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.1_git_snapshot
>
> 
i | lxc-libs | package | 1.1.0~rc1-2.1           | x86_64 |
openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.1
> v | lxc-libs | package | 1.0.99.a4aed37-7.1      | x86_64 |
> openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.0_git_snapshot
>
> 
v | lxc-libs | package | 1.0.7-3.1               | x86_64 |
openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.0
> v | lxc-libs | package | 1.99.ce72f6b.HEAD-8.1   | i586   |
> openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_HEAD_git_snapshot
>  v | lxc-libs | package | 1.1.99.ce72f6b.rc1-11.1 | i586   |
> openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.1_git_snapshot
>
> 
v | lxc-libs | package | 1.1.0~rc1-2.1           | i586   |
openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.1
> v | lxc-libs | package | 1.0.99.a4aed37-7.1      | i586   |
> openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.0_git_snapshot
>
> 
v | lxc-libs | package | 1.0.7-3.1               | i586   |
openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.0

Basically, if I just tell zypper to install lxc-1.0.7, the lxc-libs
package would remain at whatever is installed at the moment. Probably
not what the user wants.

Adding a Requires to the libs-section in the spec should help, I
guess. I'll try it locally and report back.

Regards,
Johannes
- -- 
Coming back to where you started is not the same as never leaving.
(Terry Pratchett)
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/

iEQEARECAAYFAlTCCH0ACgkQzi3gQ/xETbIRzgCXYQXyRw9PblpB3adbb8VzzYeI
SgCTBAWrm0S4pKnFYgyS5jsMP0RUAw==
=YDY7
-----END PGP SIGNATURE-----


From serge.hallyn at ubuntu.com  Fri Jan 23 17:06:51 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 23 Jan 2015 17:06:51 +0000
Subject: [lxc-devel] Dependency on correct lxc-libs missing in the spec?
In-Reply-To: <m9t1a2$pei$2@ger.gmane.org>
References: <m9t1a2$pei$2@ger.gmane.org>
Message-ID: <20150123170651.GH1702@ubuntumail>

Quoting Johannes Kastl (mail at ojkastl.de):
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi everyone,
> 
> as I have multiple repositories enabled on my openSUSE machine, each
> of with contains a different version of lxc and lxc-libs, I found that
> it is possible mix versions of lxc and lxc-libs. That means, that lxc
> does not depend on a matching version of lxc-libs.
> 
> > $ zypper search --details --match-exact lxc-libs Loading repository
> > data... Reading installed packages...
> > 
> > S | Name     | Type    | Version                 | Arch   |
> > Repository
> >  
> > --+----------+---------+-------------------------+--------+-----------------------------------------------------------------------------
> >
> > 
> v | lxc-libs | package | 1.99.ce72f6b.HEAD-8.1   | x86_64 |
> openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_HEAD_git_snapshot
> > v | lxc-libs | package | 1.1.99.ce72f6b.rc1-11.1 | x86_64 |
> > openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.1_git_snapshot
> >
> > 
> i | lxc-libs | package | 1.1.0~rc1-2.1           | x86_64 |
> openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.1
> > v | lxc-libs | package | 1.0.99.a4aed37-7.1      | x86_64 |
> > openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.0_git_snapshot
> >
> > 
> v | lxc-libs | package | 1.0.7-3.1               | x86_64 |
> openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.0
> > v | lxc-libs | package | 1.99.ce72f6b.HEAD-8.1   | i586   |
> > openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_HEAD_git_snapshot
> >  v | lxc-libs | package | 1.1.99.ce72f6b.rc1-11.1 | i586   |
> > openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.1_git_snapshot
> >
> > 
> v | lxc-libs | package | 1.1.0~rc1-2.1           | i586   |
> openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.1
> > v | lxc-libs | package | 1.0.99.a4aed37-7.1      | i586   |
> > openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.0_git_snapshot
> >
> > 
> v | lxc-libs | package | 1.0.7-3.1               | i586   |
> openSUSE_Tumbleweed_ojkastl_buildservice_LXC_Vanilla_stable-1.0
> 
> Basically, if I just tell zypper to install lxc-1.0.7, the lxc-libs
> package would remain at whatever is installed at the moment. Probably
> not what the user wants.
> 
> Adding a Requires to the libs-section in the spec should help, I
> guess. I'll try it locally and report back.

Cool, sounds reasonable, patch appreciated :)

thanks

-serge

From mathias at calenhad.com  Fri Jan 23 17:25:36 2015
From: mathias at calenhad.com (Mathias Gibbens)
Date: Fri, 23 Jan 2015 17:25:36 +0000
Subject: [lxc-devel] `top` within unprivileged container breaks host
In-Reply-To: <1421974090.4981.53.camel@olorin.calenhad.com>
References: <1421974090.4981.53.camel@olorin.calenhad.com>
Message-ID: <1422033936.4981.64.camel@olorin.calenhad.com>

On Fri, 2015-01-23 at 00:48 +0000, Mathias Gibbens wrote:
> Hello,
> 
>   I've been testing LXC 1.1-rc1 on a Debian jessie system. Specifically,
> since all the pieces are now in place to support systemd in unprivileged
> containers, I've been testing running Debian jessie within an
> unprivileged container.
> 
>   The jessie container successfully starts (there are some errors along
> the way, but that's another issue), and I can do a `lxc-attach`, add a
> user and log in. However, if I run `top` within the container I only get
> two lines of output:
> 
> top - 00:13:25 up 4 min,  0 users,  load average: 0.01, 0.05, 0.05
> Tasks:  10 total,   1 running,   9 sleeping,   0 stopped,   0 zombie
> 
>   Furthermore, the host system breaks spectacularly:
> 
> lxc at lxc:~$ top
> Error, do this: mount -t proc proc /proc
> lxc at lxc:~$ /sbin/ifconfig
> Warning: cannot open /proc/net/dev (No such file or directory). Limited
> output.
> lxc at lxc:~$ mount
> mount: failed to read mtab: No such file or directory
> lxc at lxc:~$ df
> df: cannot read table of mounted file systems: No such file or directory
> lxc at lxc:~$ sudo reboot
> Running in chroot, ignoring request.
> 
>   It seems that /proc is being unmounted somehow on the host. I can
> re-mount /proc on the host, and things seem to work again. (I haven't
> tested too much after re-mounting, instead opting to just reboot the
> host back to a known good state.)
> 
>   Any idea what is causing this to happen? I have also tried running
> Ubuntu Vivid as an unprivileged container and see the same results. I
> have not yet tried a different Linux distro for the host system.
> 
>   Host system details: Debian jessie with kernel 3.16.7-ckt2-1 x86_64,
> systemd-215, LXC-1.1-rc1 and lxcfs built from current git checkout,
> cgmanager-0.35 as packaged from the sid repository.
> 
> Thanks for any ideas,
> Mathias

  This morning I setup a host running Ubuntu Vivid with cgmanager, lxc,
and lxcfs packages installed from the daily PPA. I setup two
unprivileged containers, Debian jessie and Ubuntu Vivid, and ran `top`
within each one. On the Vivid host, `top` runs properly and the host
system does not break.

  So, it seems that the breakage is due to running jessie on the host
system. Any ideas why this is happening, or where I could begin looking
to debug this problem?

Mathias
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150123/86d636bb/attachment.sig>

From thomas.moschny at gmail.com  Fri Jan 23 18:03:42 2015
From: thomas.moschny at gmail.com (Thomas Moschny)
Date: Fri, 23 Jan 2015 19:03:42 +0100
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <20150121212716.GA22897@dakara>
References: <20150121212716.GA22897@dakara>
Message-ID: <CAGZbLYnXjyyOB7_j9ipgMFnXQJ_pLz01ba6mDGmrGXWCiq5z3w@mail.gmail.com>

In order to build against Lua 5.3, a small patch is needed.


- Thomas
-------------- next part --------------
A non-text attachment was scrubbed...
Name: lxc-1.1rc1-lua-5.3.patch
Type: text/x-patch
Size: 409 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150123/6580cb4b/attachment.bin>

From serge.hallyn at ubuntu.com  Fri Jan 23 18:13:52 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 23 Jan 2015 18:13:52 +0000
Subject: [lxc-devel] `top` within unprivileged container breaks host
In-Reply-To: <1421974090.4981.53.camel@olorin.calenhad.com>
References: <1421974090.4981.53.camel@olorin.calenhad.com>
Message-ID: <20150123181352.GJ1702@ubuntumail>

Quoting Mathias Gibbens (mathias at calenhad.com):
> Hello,
> 
>   I've been testing LXC 1.1-rc1 on a Debian jessie system. Specifically,
> since all the pieces are now in place to support systemd in unprivileged
> containers, I've been testing running Debian jessie within an
> unprivileged container.
> 
>   The jessie container successfully starts (there are some errors along
> the way, but that's another issue), and I can do a `lxc-attach`, add a
> user and log in. However, if I run `top` within the container I only get
> two lines of output:
> 
> top - 00:13:25 up 4 min,  0 users,  load average: 0.01, 0.05, 0.05
> Tasks:  10 total,   1 running,   9 sleeping,   0 stopped,   0 zombie
> 
>   Furthermore, the host system breaks spectacularly:
> 
> lxc at lxc:~$ top
> Error, do this: mount -t proc proc /proc
> lxc at lxc:~$ /sbin/ifconfig
> Warning: cannot open /proc/net/dev (No such file or directory). Limited
> output.
> lxc at lxc:~$ mount
> mount: failed to read mtab: No such file or directory
> lxc at lxc:~$ df
> df: cannot read table of mounted file systems: No such file or directory
> lxc at lxc:~$ sudo reboot
> Running in chroot, ignoring request.
> 
>   It seems that /proc is being unmounted somehow on the host. I can
> re-mount /proc on the host, and things seem to work again. (I haven't
> tested too much after re-mounting, instead opting to just reboot the
> host back to a known good state.)
> 
>   Any idea what is causing this to happen? I have also tried running
> Ubuntu Vivid as an unprivileged container and see the same results. I
> have not yet tried a different Linux distro for the host system.
> 
>   Host system details: Debian jessie with kernel 3.16.7-ckt2-1 x86_64,
> systemd-215, LXC-1.1-rc1 and lxcfs built from current git checkout,
> cgmanager-0.35 as packaged from the sid repository.

Wowzer.  I can confirm I'm having the same behavior on a ubuntu vivid
host with systemd as pid1.

From serge.hallyn at ubuntu.com  Fri Jan 23 18:19:46 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 23 Jan 2015 18:19:46 +0000
Subject: [lxc-devel] `top` within unprivileged container breaks host
In-Reply-To: <1422033936.4981.64.camel@olorin.calenhad.com>
References: <1421974090.4981.53.camel@olorin.calenhad.com>
 <1422033936.4981.64.camel@olorin.calenhad.com>
Message-ID: <20150123181946.GK1702@ubuntumail>

Quoting Mathias Gibbens (mathias at calenhad.com):
> On Fri, 2015-01-23 at 00:48 +0000, Mathias Gibbens wrote:
> > Hello,
> > 
> >   I've been testing LXC 1.1-rc1 on a Debian jessie system. Specifically,
> > since all the pieces are now in place to support systemd in unprivileged
> > containers, I've been testing running Debian jessie within an
> > unprivileged container.
> > 
> >   The jessie container successfully starts (there are some errors along
> > the way, but that's another issue), and I can do a `lxc-attach`, add a
> > user and log in. However, if I run `top` within the container I only get
> > two lines of output:
> > 
> > top - 00:13:25 up 4 min,  0 users,  load average: 0.01, 0.05, 0.05
> > Tasks:  10 total,   1 running,   9 sleeping,   0 stopped,   0 zombie
> > 
> >   Furthermore, the host system breaks spectacularly:
> > 
> > lxc at lxc:~$ top
> > Error, do this: mount -t proc proc /proc
> > lxc at lxc:~$ /sbin/ifconfig
> > Warning: cannot open /proc/net/dev (No such file or directory). Limited
> > output.
> > lxc at lxc:~$ mount
> > mount: failed to read mtab: No such file or directory
> > lxc at lxc:~$ df
> > df: cannot read table of mounted file systems: No such file or directory
> > lxc at lxc:~$ sudo reboot
> > Running in chroot, ignoring request.
> > 
> >   It seems that /proc is being unmounted somehow on the host. I can
> > re-mount /proc on the host, and things seem to work again. (I haven't
> > tested too much after re-mounting, instead opting to just reboot the
> > host back to a known good state.)
> > 
> >   Any idea what is causing this to happen? I have also tried running
> > Ubuntu Vivid as an unprivileged container and see the same results. I
> > have not yet tried a different Linux distro for the host system.
> > 
> >   Host system details: Debian jessie with kernel 3.16.7-ckt2-1 x86_64,
> > systemd-215, LXC-1.1-rc1 and lxcfs built from current git checkout,
> > cgmanager-0.35 as packaged from the sid repository.
> > 
> > Thanks for any ideas,
> > Mathias
> 
>   This morning I setup a host running Ubuntu Vivid with cgmanager, lxc,
> and lxcfs packages installed from the daily PPA. I setup two

But did you install the systemd-sysv package?

> unprivileged containers, Debian jessie and Ubuntu Vivid, and ran `top`
> within each one. On the Vivid host, `top` runs properly and the host
> system does not break.
> 
>   So, it seems that the breakage is due to running jessie on the host
> system. Any ideas why this is happening, or where I could begin looking
> to debug this problem?

No, I've just reproduced it, but it requires systemd to do so.

Note that you'll have to manually chown your name=systemd cgroup
to your user for the lxc-start to succeed.

From mail at ojkastl.de  Fri Jan 23 18:28:10 2015
From: mail at ojkastl.de (Johannes Kastl)
Date: Fri, 23 Jan 2015 19:28:10 +0100
Subject: [lxc-devel] [PATCH] added dependency to lxc-libs to lxc package,
 to ensure matching versions of lxc and lxc-libs being installed
 (was: Dependency on correct lxc-libs missing in the spec?)
In-Reply-To: <20150123170651.GH1702@ubuntumail>
References: <m9t1a2$pei$2@ger.gmane.org> <20150123170651.GH1702@ubuntumail>
Message-ID: <m9u3rq$cq2$1@ger.gmane.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 23.01.2015 Serge Hallyn wrote:

>> Adding a Requires to the libs-section in the spec should help, I 
>> guess. I'll try it locally and report back.
> 
> Cool, sounds reasonable, patch appreciated :)

You call, you get. ;-)

See attachment, this is against master. Comments welcome.

Regards,
Johannes
- -- 
The first half of our lives is ruined by our parents, and the second
half by our children.
(Clarence Darrow, 1857-1938)
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/

iEYEARECAAYFAlTCkrUACgkQzi3gQ/xETbLH4ACeORQ71c3pzPKE4UbecwBAmjMD
iVIAnA1pboJkhWuTyhTI7n9DQqnFFquX
=Vge4
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-added-dependency-to-lxc-libs-to-lxc-package-to-ensur.patch
Type: text/x-patch
Size: 812 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150123/7ab60f3d/attachment.bin>

From stgraber at ubuntu.com  Fri Jan 23 18:42:49 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 23 Jan 2015 13:42:49 -0500
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <CAGZbLYnXjyyOB7_j9ipgMFnXQJ_pLz01ba6mDGmrGXWCiq5z3w@mail.gmail.com>
References: <20150121212716.GA22897@dakara>
 <CAGZbLYnXjyyOB7_j9ipgMFnXQJ_pLz01ba6mDGmrGXWCiq5z3w@mail.gmail.com>
Message-ID: <20150123184249.GC882@dakara>

On Fri, Jan 23, 2015 at 07:03:42PM +0100, Thomas Moschny wrote:
> In order to build against Lua 5.3, a small patch is needed.
> 
> 
> - Thomas

Hi,

Can you reply to that e-mail with the required Signed-off-by line as per
CONTRIBUTING?

Thanks!

> diff --git a/src/lua-lxc/core.c b/src/lua-lxc/core.c
> index 2e073d8..630a3e4 100644
> --- a/src/lua-lxc/core.c
> +++ b/src/lua-lxc/core.c
> @@ -38,6 +38,10 @@
>  #define luaL_checkunsigned(L,n) luaL_checknumber(L,n)
>  #endif
>  
> +#if LUA_VERSION_NUM >= 503
> +#define luaL_checkunsigned(L,n) ((lua_Unsigned)luaL_checkinteger(L,n))
> +#endif
> +
>  #ifdef NO_CHECK_UDATA
>  #define checkudata(L,i,tname)	lua_touserdata(L, i)
>  #else

> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150123/8a3196f4/attachment.sig>

From stgraber at ubuntu.com  Fri Jan 23 18:47:50 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 23 Jan 2015 13:47:50 -0500
Subject: [lxc-devel] `top` within unprivileged container breaks host
In-Reply-To: <20150123181946.GK1702@ubuntumail>
References: <1421974090.4981.53.camel@olorin.calenhad.com>
 <1422033936.4981.64.camel@olorin.calenhad.com>
 <20150123181946.GK1702@ubuntumail>
Message-ID: <20150123184750.GD882@dakara>

On Fri, Jan 23, 2015 at 06:19:46PM +0000, Serge Hallyn wrote:
> Quoting Mathias Gibbens (mathias at calenhad.com):
> > On Fri, 2015-01-23 at 00:48 +0000, Mathias Gibbens wrote:
> > > Hello,
> > > 
> > >   I've been testing LXC 1.1-rc1 on a Debian jessie system. Specifically,
> > > since all the pieces are now in place to support systemd in unprivileged
> > > containers, I've been testing running Debian jessie within an
> > > unprivileged container.
> > > 
> > >   The jessie container successfully starts (there are some errors along
> > > the way, but that's another issue), and I can do a `lxc-attach`, add a
> > > user and log in. However, if I run `top` within the container I only get
> > > two lines of output:
> > > 
> > > top - 00:13:25 up 4 min,  0 users,  load average: 0.01, 0.05, 0.05
> > > Tasks:  10 total,   1 running,   9 sleeping,   0 stopped,   0 zombie
> > > 
> > >   Furthermore, the host system breaks spectacularly:
> > > 
> > > lxc at lxc:~$ top
> > > Error, do this: mount -t proc proc /proc
> > > lxc at lxc:~$ /sbin/ifconfig
> > > Warning: cannot open /proc/net/dev (No such file or directory). Limited
> > > output.
> > > lxc at lxc:~$ mount
> > > mount: failed to read mtab: No such file or directory
> > > lxc at lxc:~$ df
> > > df: cannot read table of mounted file systems: No such file or directory
> > > lxc at lxc:~$ sudo reboot
> > > Running in chroot, ignoring request.
> > > 
> > >   It seems that /proc is being unmounted somehow on the host. I can
> > > re-mount /proc on the host, and things seem to work again. (I haven't
> > > tested too much after re-mounting, instead opting to just reboot the
> > > host back to a known good state.)
> > > 
> > >   Any idea what is causing this to happen? I have also tried running
> > > Ubuntu Vivid as an unprivileged container and see the same results. I
> > > have not yet tried a different Linux distro for the host system.
> > > 
> > >   Host system details: Debian jessie with kernel 3.16.7-ckt2-1 x86_64,
> > > systemd-215, LXC-1.1-rc1 and lxcfs built from current git checkout,
> > > cgmanager-0.35 as packaged from the sid repository.
> > > 
> > > Thanks for any ideas,
> > > Mathias
> > 
> >   This morning I setup a host running Ubuntu Vivid with cgmanager, lxc,
> > and lxcfs packages installed from the daily PPA. I setup two
> 
> But did you install the systemd-sysv package?
> 
> > unprivileged containers, Debian jessie and Ubuntu Vivid, and ran `top`
> > within each one. On the Vivid host, `top` runs properly and the host
> > system does not break.
> > 
> >   So, it seems that the breakage is due to running jessie on the host
> > system. Any ideas why this is happening, or where I could begin looking
> > to debug this problem?
> 
> No, I've just reproduced it, but it requires systemd to do so.
> 
> Note that you'll have to manually chown your name=systemd cgroup
> to your user for the lxc-start to succeed.


Hey,

So we've just tracked down that bug and it's a critical flaw in lxcfs
which we've now fixed upstream. I tagged LXCFS 0.4 with the fix and am
publishing it now on our website and uploading it to Ubuntu.

Thanks for reporting this!

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150123/be817fde/attachment.sig>

From serge.hallyn at ubuntu.com  Fri Jan 23 18:57:25 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 23 Jan 2015 18:57:25 +0000
Subject: [lxc-devel] [PATCH] added dependency to lxc-libs to lxc package,
 to ensure matching versions of lxc and lxc-libs being installed (was:
 Dependency on correct lxc-libs missing in the spec?)
In-Reply-To: <m9u3rq$cq2$1@ger.gmane.org>
References: <m9t1a2$pei$2@ger.gmane.org> <20150123170651.GH1702@ubuntumail>
 <m9u3rq$cq2$1@ger.gmane.org>
Message-ID: <20150123185725.GL1702@ubuntumail>

Quoting Johannes Kastl (mail at ojkastl.de):
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 23.01.2015 Serge Hallyn wrote:
> 
> >> Adding a Requires to the libs-section in the spec should help, I 
> >> guess. I'll try it locally and report back.
> > 
> > Cool, sounds reasonable, patch appreciated :)
> 
> You call, you get. ;-)

Awesome, thanks.

> See attachment, this is against master. Comments welcome.
> 
> Regards,
> Johannes
> - -- 
> The first half of our lives is ruined by our parents, and the second
> half by our children.
> (Clarence Darrow, 1857-1938)
> -----BEGIN PGP SIGNATURE-----
> Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/
> 
> iEYEARECAAYFAlTCkrUACgkQzi3gQ/xETbLH4ACeORQ71c3pzPKE4UbecwBAmjMD
> iVIAnA1pboJkhWuTyhTI7n9DQqnFFquX
> =Vge4
> -----END PGP SIGNATURE-----

> From ad84f4f4f87f0a0ea074ab383499f1a72d6ce29b Mon Sep 17 00:00:00 2001
> From: Johannes Kastl <mail at ojkastl.de>
> Date: Fri, 23 Jan 2015 19:25:28 +0100
> Subject: [PATCH] added dependency to lxc-libs to lxc package, to ensure
>  matching versions of lxc and lxc-libs being installed
> 
> Signed-off-by: Johannes Kastl <mail at ojkastl.de>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  lxc.spec.in | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/lxc.spec.in b/lxc.spec.in
> index e64122c..a3cb6af 100644
> --- a/lxc.spec.in
> +++ b/lxc.spec.in
> @@ -69,6 +69,7 @@ Group: Applications/System
>  License: LGPLv2+
>  BuildRoot: %{_tmppath}/%{name}-%{version}-build
>  Requires: openssl rsync dnsmasq bridge-utils
> +Requires: %{name}-libs = %{version}-%{release}
>  Requires(pre): /usr/sbin/useradd
>  Requires(postun): /usr/sbin/userdel
>  %if 0%{?fedora} < 15 || 0%{?rhel} < 7
> -- 
> 2.2.2
> 

> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel


From thomas.moschny at gmail.com  Fri Jan 23 19:01:03 2015
From: thomas.moschny at gmail.com (Thomas Moschny)
Date: Fri, 23 Jan 2015 20:01:03 +0100
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <20150123184249.GC882@dakara>
References: <20150121212716.GA22897@dakara>
 <CAGZbLYnXjyyOB7_j9ipgMFnXQJ_pLz01ba6mDGmrGXWCiq5z3w@mail.gmail.com>
 <20150123184249.GC882@dakara>
Message-ID: <CAGZbLYkicED9L0EC968zX2eJptUZE0TmHz8rPNJYkxH=fmTPFw@mail.gmail.com>

2015-01-23 19:42 GMT+01:00 Stéphane Graber <stgraber at ubuntu.com>:
> On Fri, Jan 23, 2015 at 07:03:42PM +0100, Thomas Moschny wrote:
>> In order to build against Lua 5.3, a small patch is needed.
>>
>>
>> - Thomas
>
> Hi,
>
> Can you reply to that e-mail with the required Signed-off-by line as per
> CONTRIBUTING?
>
> Thanks!
>
>> diff --git a/src/lua-lxc/core.c b/src/lua-lxc/core.c
>> index 2e073d8..630a3e4 100644
>> --- a/src/lua-lxc/core.c
>> +++ b/src/lua-lxc/core.c
>> @@ -38,6 +38,10 @@
>>  #define luaL_checkunsigned(L,n) luaL_checknumber(L,n)
>>  #endif
>>
>> +#if LUA_VERSION_NUM >= 503
>> +#define luaL_checkunsigned(L,n) ((lua_Unsigned)luaL_checkinteger(L,n))
>> +#endif
>> +
>>  #ifdef NO_CHECK_UDATA
>>  #define checkudata(L,i,tname)        lua_touserdata(L, i)
>>  #else
>

Signed-off-by: Thomas Moschny <thomas.moschny at gmail.com>

- Thomas

From mathias at calenhad.com  Fri Jan 23 20:27:38 2015
From: mathias at calenhad.com (Mathias Gibbens)
Date: Fri, 23 Jan 2015 20:27:38 +0000
Subject: [lxc-devel] `top` within unprivileged container breaks host
In-Reply-To: <20150123184750.GD882@dakara>
References: <1421974090.4981.53.camel@olorin.calenhad.com>
 <1422033936.4981.64.camel@olorin.calenhad.com>
 <20150123181946.GK1702@ubuntumail> <20150123184750.GD882@dakara>
Message-ID: <1422044858.4981.71.camel@olorin.calenhad.com>

On Fri, 2015-01-23 at 13:47 -0500, Stéphane Graber wrote:
> On Fri, Jan 23, 2015 at 06:19:46PM +0000, Serge Hallyn wrote:
> > Quoting Mathias Gibbens (mathias at calenhad.com):
> > > On Fri, 2015-01-23 at 00:48 +0000, Mathias Gibbens wrote:
> > > > Hello,
> > > > 
> > > >   I've been testing LXC 1.1-rc1 on a Debian jessie system. Specifically,
> > > > since all the pieces are now in place to support systemd in unprivileged
> > > > containers, I've been testing running Debian jessie within an
> > > > unprivileged container.
> > > > 
> > > >   The jessie container successfully starts (there are some errors along
> > > > the way, but that's another issue), and I can do a `lxc-attach`, add a
> > > > user and log in. However, if I run `top` within the container I only get
> > > > two lines of output:
> > > > 
> > > > top - 00:13:25 up 4 min,  0 users,  load average: 0.01, 0.05, 0.05
> > > > Tasks:  10 total,   1 running,   9 sleeping,   0 stopped,   0 zombie
> > > > 
> > > >   Furthermore, the host system breaks spectacularly:
> > > > 
> > > > lxc at lxc:~$ top
> > > > Error, do this: mount -t proc proc /proc
> > > > lxc at lxc:~$ /sbin/ifconfig
> > > > Warning: cannot open /proc/net/dev (No such file or directory). Limited
> > > > output.
> > > > lxc at lxc:~$ mount
> > > > mount: failed to read mtab: No such file or directory
> > > > lxc at lxc:~$ df
> > > > df: cannot read table of mounted file systems: No such file or directory
> > > > lxc at lxc:~$ sudo reboot
> > > > Running in chroot, ignoring request.
> > > > 
> > > >   It seems that /proc is being unmounted somehow on the host. I can
> > > > re-mount /proc on the host, and things seem to work again. (I haven't
> > > > tested too much after re-mounting, instead opting to just reboot the
> > > > host back to a known good state.)
> > > > 
> > > >   Any idea what is causing this to happen? I have also tried running
> > > > Ubuntu Vivid as an unprivileged container and see the same results. I
> > > > have not yet tried a different Linux distro for the host system.
> > > > 
> > > >   Host system details: Debian jessie with kernel 3.16.7-ckt2-1 x86_64,
> > > > systemd-215, LXC-1.1-rc1 and lxcfs built from current git checkout,
> > > > cgmanager-0.35 as packaged from the sid repository.
> > > > 
> > > > Thanks for any ideas,
> > > > Mathias
> > > 
> > >   This morning I setup a host running Ubuntu Vivid with cgmanager, lxc,
> > > and lxcfs packages installed from the daily PPA. I setup two
> > 
> > But did you install the systemd-sysv package?
> > 
> > > unprivileged containers, Debian jessie and Ubuntu Vivid, and ran `top`
> > > within each one. On the Vivid host, `top` runs properly and the host
> > > system does not break.
> > > 
> > >   So, it seems that the breakage is due to running jessie on the host
> > > system. Any ideas why this is happening, or where I could begin looking
> > > to debug this problem?
> > 
> > No, I've just reproduced it, but it requires systemd to do so.

  Ah, I had assumed that Vivid was using systemd by default, but didn't
check. pid1 in Vivid still defaults to upstart.

> > 
> > Note that you'll have to manually chown your name=systemd cgroup
> > to your user for the lxc-start to succeed.
> 
> 
> Hey,
> 
> So we've just tracked down that bug and it's a critical flaw in lxcfs
> which we've now fixed upstream. I tagged LXCFS 0.4 with the fix and am
> publishing it now on our website and uploading it to Ubuntu.
> 
> Thanks for reporting this!

  I can confirm that the fix in lxcfs resolves this issue and `top` now
operates as expected without trashing the host system.

Mathias
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150123/11540edf/attachment.sig>

From harri at afaics.de  Sat Jan 24 15:09:55 2015
From: harri at afaics.de (Harald Dunkel)
Date: Sat, 24 Jan 2015 16:09:55 +0100
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <20150121212716.GA22897@dakara>
References: <20150121212716.GA22897@dakara>
Message-ID: <54C3B5C3.3070909@afaics.de>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 01/21/15 22:27, Stéphane Graber wrote:
> Hey everyone,
> 
> So after doing a fair amount of additional manual testing on it, I've just released LXC 1.1 rc1.
> 
> That means that from now on, we won't be taking new features and will instead work on fixing any remaining rough edges with 1.1.
> 

Do you have some preliminary release notes?


Regards
Harri

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJUw7XDAAoJEAqeKp5m04HLK3QH/3bzf80Az+dV0rO/KaOV7dwY
7N+AjJDJXKJHHCBLkKWOT40WowEc5w7XlmCIC8HABNl/pthhvN9Xwr6MJ54zP0fT
e36DLZRzap7lq3PZ16/394mt2/EajSP5mUJcLX+SCeLa8odd60QXYcKCatGMPQoi
ObhcINUuagN5EEV6cOSNGq2mSyWs0N5yQRwDjaA8cb0u5sme7oPiV/MJtrxWFFVs
zMTqwSIkouAToFvoiGOHKnRE7ZFbDHqRjj2zB0rCyKel6zUjP1sh6Ruq4rrxla12
XmR8he4Ktsf1cZQE6hSJnfl4h2IsVfroSjzcP//XDDz8hyqOkSiET7EVLSiI0nE=
=O5l/
-----END PGP SIGNATURE-----

From mail at ojkastl.de  Sat Jan 24 18:24:28 2015
From: mail at ojkastl.de (Johannes Kastl)
Date: Sat, 24 Jan 2015 19:24:28 +0100
Subject: [lxc-devel] LXC 1.1 rc1 has been released
In-Reply-To: <20150122213250.GC1702@ubuntumail>
References: <20150121212716.GA22897@dakara> <m9rks6$ljv$1@ger.gmane.org>
 <20150122213250.GC1702@ubuntumail>
Message-ID: <ma0o0s$g3r$2@ger.gmane.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 22.01.15 Serge Hallyn wrote:

>> 3. add lxc.aa_allow_incomplete = 1 to
>> /usr/share/lxc/config/common.conf or (perhaps better) a file
>> under /usr/share/lxc/config/common.conf.d

I did that (on the builds service repositories), and it seems to work.
I am not completely sure about the security implications, but will
discuss this with the openSUSE package maintainers.

Thanks for the help!

Regards,
Johannes
- -- 
Is our children learning?
(George W. Bush)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/

iEYEARECAAYFAlTD41sACgkQzi3gQ/xETbK5NQCdF/3KmNIL2ywIYSSOQLGyJrcW
tNMAn0bNWH8n9VIeLvuDNl5+hN5bJd5J
=4I20
-----END PGP SIGNATURE-----


From caglar at 10ur.org  Sat Jan 24 19:14:15 2015
From: caglar at 10ur.org (=?UTF-8?B?Uy7Dh2HEn2xhciBPbnVy?=)
Date: Sat, 24 Jan 2015 14:14:15 -0500
Subject: [lxc-devel] `top` within unprivileged container breaks host
In-Reply-To: <20150123184750.GD882@dakara>
References: <1421974090.4981.53.camel@olorin.calenhad.com>
 <1422033936.4981.64.camel@olorin.calenhad.com>
 <20150123181946.GK1702@ubuntumail> <20150123184750.GD882@dakara>
Message-ID: <CAF+rbZNuge6Nqy1-T69s855ZTMwV3v+4qYHHH5M-7cxMWvscOQ@mail.gmail.com>

Hey Stéphane,

On Fri, Jan 23, 2015 at 1:47 PM, Stéphane Graber <stgraber at ubuntu.com> wrote:
> On Fri, Jan 23, 2015 at 06:19:46PM +0000, Serge Hallyn wrote:
>> Quoting Mathias Gibbens (mathias at calenhad.com):
>> > On Fri, 2015-01-23 at 00:48 +0000, Mathias Gibbens wrote:
>> > > Hello,
>> > >
>> > >   I've been testing LXC 1.1-rc1 on a Debian jessie system. Specifically,
>> > > since all the pieces are now in place to support systemd in unprivileged
>> > > containers, I've been testing running Debian jessie within an
>> > > unprivileged container.
>> > >
>> > >   The jessie container successfully starts (there are some errors along
>> > > the way, but that's another issue), and I can do a `lxc-attach`, add a
>> > > user and log in. However, if I run `top` within the container I only get
>> > > two lines of output:
>> > >
>> > > top - 00:13:25 up 4 min,  0 users,  load average: 0.01, 0.05, 0.05
>> > > Tasks:  10 total,   1 running,   9 sleeping,   0 stopped,   0 zombie
>> > >
>> > >   Furthermore, the host system breaks spectacularly:
>> > >
>> > > lxc at lxc:~$ top
>> > > Error, do this: mount -t proc proc /proc
>> > > lxc at lxc:~$ /sbin/ifconfig
>> > > Warning: cannot open /proc/net/dev (No such file or directory). Limited
>> > > output.
>> > > lxc at lxc:~$ mount
>> > > mount: failed to read mtab: No such file or directory
>> > > lxc at lxc:~$ df
>> > > df: cannot read table of mounted file systems: No such file or directory
>> > > lxc at lxc:~$ sudo reboot
>> > > Running in chroot, ignoring request.
>> > >
>> > >   It seems that /proc is being unmounted somehow on the host. I can
>> > > re-mount /proc on the host, and things seem to work again. (I haven't
>> > > tested too much after re-mounting, instead opting to just reboot the
>> > > host back to a known good state.)
>> > >
>> > >   Any idea what is causing this to happen? I have also tried running
>> > > Ubuntu Vivid as an unprivileged container and see the same results. I
>> > > have not yet tried a different Linux distro for the host system.
>> > >
>> > >   Host system details: Debian jessie with kernel 3.16.7-ckt2-1 x86_64,
>> > > systemd-215, LXC-1.1-rc1 and lxcfs built from current git checkout,
>> > > cgmanager-0.35 as packaged from the sid repository.
>> > >
>> > > Thanks for any ideas,
>> > > Mathias
>> >
>> >   This morning I setup a host running Ubuntu Vivid with cgmanager, lxc,
>> > and lxcfs packages installed from the daily PPA. I setup two
>>
>> But did you install the systemd-sysv package?
>>
>> > unprivileged containers, Debian jessie and Ubuntu Vivid, and ran `top`
>> > within each one. On the Vivid host, `top` runs properly and the host
>> > system does not break.
>> >
>> >   So, it seems that the breakage is due to running jessie on the host
>> > system. Any ideas why this is happening, or where I could begin looking
>> > to debug this problem?
>>
>> No, I've just reproduced it, but it requires systemd to do so.
>>
>> Note that you'll have to manually chown your name=systemd cgroup
>> to your user for the lxc-start to succeed.
>
>
> Hey,
>
> So we've just tracked down that bug and it's a critical flaw in lxcfs
> which we've now fixed upstream. I tagged LXCFS 0.4 with the fix and am
> publishing it now on our website and uploading it to Ubuntu.

https://launchpad.net/~ubuntu-lxc/+archive/ubuntu/daily still shows
the old lxcfs version. Should I be tracking some other repo?

> Thanks for reporting this!
>
> --
> Stéphane Graber
> Ubuntu developer
> http://www.ubuntu.com
>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel
>

-- 
S.Çağlar Onur <caglar at 10ur.org>

From stgraber at ubuntu.com  Sat Jan 24 19:29:55 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Sat, 24 Jan 2015 14:29:55 -0500
Subject: [lxc-devel] `top` within unprivileged container breaks host
In-Reply-To: <CAF+rbZNuge6Nqy1-T69s855ZTMwV3v+4qYHHH5M-7cxMWvscOQ@mail.gmail.com>
References: <1421974090.4981.53.camel@olorin.calenhad.com>
 <1422033936.4981.64.camel@olorin.calenhad.com>
 <20150123181946.GK1702@ubuntumail> <20150123184750.GD882@dakara>
 <CAF+rbZNuge6Nqy1-T69s855ZTMwV3v+4qYHHH5M-7cxMWvscOQ@mail.gmail.com>
Message-ID: <20150124192955.GF882@dakara>

On Sat, Jan 24, 2015 at 02:14:15PM -0500, S.Çağlar Onur wrote:
> Hey Stéphane,
> 
> On Fri, Jan 23, 2015 at 1:47 PM, Stéphane Graber <stgraber at ubuntu.com> wrote:
> > On Fri, Jan 23, 2015 at 06:19:46PM +0000, Serge Hallyn wrote:
> >> Quoting Mathias Gibbens (mathias at calenhad.com):
> >> > On Fri, 2015-01-23 at 00:48 +0000, Mathias Gibbens wrote:
> >> > > Hello,
> >> > >
> >> > >   I've been testing LXC 1.1-rc1 on a Debian jessie system. Specifically,
> >> > > since all the pieces are now in place to support systemd in unprivileged
> >> > > containers, I've been testing running Debian jessie within an
> >> > > unprivileged container.
> >> > >
> >> > >   The jessie container successfully starts (there are some errors along
> >> > > the way, but that's another issue), and I can do a `lxc-attach`, add a
> >> > > user and log in. However, if I run `top` within the container I only get
> >> > > two lines of output:
> >> > >
> >> > > top - 00:13:25 up 4 min,  0 users,  load average: 0.01, 0.05, 0.05
> >> > > Tasks:  10 total,   1 running,   9 sleeping,   0 stopped,   0 zombie
> >> > >
> >> > >   Furthermore, the host system breaks spectacularly:
> >> > >
> >> > > lxc at lxc:~$ top
> >> > > Error, do this: mount -t proc proc /proc
> >> > > lxc at lxc:~$ /sbin/ifconfig
> >> > > Warning: cannot open /proc/net/dev (No such file or directory). Limited
> >> > > output.
> >> > > lxc at lxc:~$ mount
> >> > > mount: failed to read mtab: No such file or directory
> >> > > lxc at lxc:~$ df
> >> > > df: cannot read table of mounted file systems: No such file or directory
> >> > > lxc at lxc:~$ sudo reboot
> >> > > Running in chroot, ignoring request.
> >> > >
> >> > >   It seems that /proc is being unmounted somehow on the host. I can
> >> > > re-mount /proc on the host, and things seem to work again. (I haven't
> >> > > tested too much after re-mounting, instead opting to just reboot the
> >> > > host back to a known good state.)
> >> > >
> >> > >   Any idea what is causing this to happen? I have also tried running
> >> > > Ubuntu Vivid as an unprivileged container and see the same results. I
> >> > > have not yet tried a different Linux distro for the host system.
> >> > >
> >> > >   Host system details: Debian jessie with kernel 3.16.7-ckt2-1 x86_64,
> >> > > systemd-215, LXC-1.1-rc1 and lxcfs built from current git checkout,
> >> > > cgmanager-0.35 as packaged from the sid repository.
> >> > >
> >> > > Thanks for any ideas,
> >> > > Mathias
> >> >
> >> >   This morning I setup a host running Ubuntu Vivid with cgmanager, lxc,
> >> > and lxcfs packages installed from the daily PPA. I setup two
> >>
> >> But did you install the systemd-sysv package?
> >>
> >> > unprivileged containers, Debian jessie and Ubuntu Vivid, and ran `top`
> >> > within each one. On the Vivid host, `top` runs properly and the host
> >> > system does not break.
> >> >
> >> >   So, it seems that the breakage is due to running jessie on the host
> >> > system. Any ideas why this is happening, or where I could begin looking
> >> > to debug this problem?
> >>
> >> No, I've just reproduced it, but it requires systemd to do so.
> >>
> >> Note that you'll have to manually chown your name=systemd cgroup
> >> to your user for the lxc-start to succeed.
> >
> >
> > Hey,
> >
> > So we've just tracked down that bug and it's a critical flaw in lxcfs
> > which we've now fixed upstream. I tagged LXCFS 0.4 with the fix and am
> > publishing it now on our website and uploading it to Ubuntu.
> 
> https://launchpad.net/~ubuntu-lxc/+archive/ubuntu/daily still shows
> the old lxcfs version. Should I be tracking some other repo?

Oops, no. I uploaded to vivid but forgot to refresh the PPA. Doing that now.

> 
> > Thanks for reporting this!
> >
> > --
> > Stéphane Graber
> > Ubuntu developer
> > http://www.ubuntu.com
> >
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> >
> 
> -- 
> S.Çağlar Onur <caglar at 10ur.org>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150124/f55cb534/attachment.sig>

From caglar at 10ur.org  Sat Jan 24 19:45:52 2015
From: caglar at 10ur.org (=?UTF-8?B?Uy7Dh2HEn2xhciBPbnVy?=)
Date: Sat, 24 Jan 2015 14:45:52 -0500
Subject: [lxc-devel] `top` within unprivileged container breaks host
In-Reply-To: <20150124192955.GF882@dakara>
References: <1421974090.4981.53.camel@olorin.calenhad.com>
 <1422033936.4981.64.camel@olorin.calenhad.com>
 <20150123181946.GK1702@ubuntumail> <20150123184750.GD882@dakara>
 <CAF+rbZNuge6Nqy1-T69s855ZTMwV3v+4qYHHH5M-7cxMWvscOQ@mail.gmail.com>
 <20150124192955.GF882@dakara>
Message-ID: <CAF+rbZOmQYQiYg_bJ-wAGD6yXEqt=SPEgHEfRmNp76M8f4F5kw@mail.gmail.com>

On Sat, Jan 24, 2015 at 2:29 PM, Stéphane Graber <stgraber at ubuntu.com> wrote:
> On Sat, Jan 24, 2015 at 02:14:15PM -0500, S.Çağlar Onur wrote:
>> Hey Stéphane,
>>
>> On Fri, Jan 23, 2015 at 1:47 PM, Stéphane Graber <stgraber at ubuntu.com> wrote:
>> > On Fri, Jan 23, 2015 at 06:19:46PM +0000, Serge Hallyn wrote:
>> >> Quoting Mathias Gibbens (mathias at calenhad.com):
>> >> > On Fri, 2015-01-23 at 00:48 +0000, Mathias Gibbens wrote:
>> >> > > Hello,
>> >> > >
>> >> > >   I've been testing LXC 1.1-rc1 on a Debian jessie system. Specifically,
>> >> > > since all the pieces are now in place to support systemd in unprivileged
>> >> > > containers, I've been testing running Debian jessie within an
>> >> > > unprivileged container.
>> >> > >
>> >> > >   The jessie container successfully starts (there are some errors along
>> >> > > the way, but that's another issue), and I can do a `lxc-attach`, add a
>> >> > > user and log in. However, if I run `top` within the container I only get
>> >> > > two lines of output:
>> >> > >
>> >> > > top - 00:13:25 up 4 min,  0 users,  load average: 0.01, 0.05, 0.05
>> >> > > Tasks:  10 total,   1 running,   9 sleeping,   0 stopped,   0 zombie
>> >> > >
>> >> > >   Furthermore, the host system breaks spectacularly:
>> >> > >
>> >> > > lxc at lxc:~$ top
>> >> > > Error, do this: mount -t proc proc /proc
>> >> > > lxc at lxc:~$ /sbin/ifconfig
>> >> > > Warning: cannot open /proc/net/dev (No such file or directory). Limited
>> >> > > output.
>> >> > > lxc at lxc:~$ mount
>> >> > > mount: failed to read mtab: No such file or directory
>> >> > > lxc at lxc:~$ df
>> >> > > df: cannot read table of mounted file systems: No such file or directory
>> >> > > lxc at lxc:~$ sudo reboot
>> >> > > Running in chroot, ignoring request.
>> >> > >
>> >> > >   It seems that /proc is being unmounted somehow on the host. I can
>> >> > > re-mount /proc on the host, and things seem to work again. (I haven't
>> >> > > tested too much after re-mounting, instead opting to just reboot the
>> >> > > host back to a known good state.)
>> >> > >
>> >> > >   Any idea what is causing this to happen? I have also tried running
>> >> > > Ubuntu Vivid as an unprivileged container and see the same results. I
>> >> > > have not yet tried a different Linux distro for the host system.
>> >> > >
>> >> > >   Host system details: Debian jessie with kernel 3.16.7-ckt2-1 x86_64,
>> >> > > systemd-215, LXC-1.1-rc1 and lxcfs built from current git checkout,
>> >> > > cgmanager-0.35 as packaged from the sid repository.
>> >> > >
>> >> > > Thanks for any ideas,
>> >> > > Mathias
>> >> >
>> >> >   This morning I setup a host running Ubuntu Vivid with cgmanager, lxc,
>> >> > and lxcfs packages installed from the daily PPA. I setup two
>> >>
>> >> But did you install the systemd-sysv package?
>> >>
>> >> > unprivileged containers, Debian jessie and Ubuntu Vivid, and ran `top`
>> >> > within each one. On the Vivid host, `top` runs properly and the host
>> >> > system does not break.
>> >> >
>> >> >   So, it seems that the breakage is due to running jessie on the host
>> >> > system. Any ideas why this is happening, or where I could begin looking
>> >> > to debug this problem?
>> >>
>> >> No, I've just reproduced it, but it requires systemd to do so.
>> >>
>> >> Note that you'll have to manually chown your name=systemd cgroup
>> >> to your user for the lxc-start to succeed.
>> >
>> >
>> > Hey,
>> >
>> > So we've just tracked down that bug and it's a critical flaw in lxcfs
>> > which we've now fixed upstream. I tagged LXCFS 0.4 with the fix and am
>> > publishing it now on our website and uploading it to Ubuntu.
>>
>> https://launchpad.net/~ubuntu-lxc/+archive/ubuntu/daily still shows
>> the old lxcfs version. Should I be tracking some other repo?
>
> Oops, no. I uploaded to vivid but forgot to refresh the PPA. Doing that now.

Thanks! Restarting lxcfs breaks running containers, is this expected?
This happened just after upgrade;

[caglar at qop:~/go/src/gopkg.in/lxc/go-lxc.v2/examples] sudo apt-get dist-upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
  lxcfs
1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 19.1 kB of archives.
After this operation, 0 B of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 http://ppa.launchpad.net/ubuntu-lxc/daily/ubuntu/ trusty/main
lxcfs amd64 0.4-0ubuntu1~ubuntu14.04.1~ppa1 [19.1 kB]
Fetched 19.1 kB in 0s (42.2 kB/s)
(Reading database ... 204049 files and directories currently installed.)
Preparing to unpack .../lxcfs_0.4-0ubuntu1~ubuntu14.04.1~ppa1_amd64.deb ...
lxcfs stop/waiting
Unpacking lxcfs (0.4-0ubuntu1~ubuntu14.04.1~ppa1) over
(0.3-0ubuntu1~ubuntu14.04.1~ppa1) ...
Processing triggers for man-db (2.6.7.1-1ubuntu1) ...
Processing triggers for ureadahead (0.100.0-16) ...
Setting up lxcfs (0.4-0ubuntu1~ubuntu14.04.1~ppa1) ...
lxcfs start/running, process 24251

[caglar at qop:~/go/src/gopkg.in/lxc/go-lxc.v2/examples] ./attach
2015/01/24 14:41:56 AttachShell
root at rubik:/# free -m
Error: /proc must be mounted
  To mount /proc at boot you need an /etc/fstab line like:
      proc   /proc   proc    defaults
  In the meantime, run "mount proc /proc -t proc"
root at rubik:/# exit

and I can reproduce it by just restarting the lxcfs service

[caglar at qop:~/go/src/gopkg.in/lxc/go-lxc.v2/examples] ./attach
2015/01/24 14:42:24 AttachShell
root at rubik:/# free -m
             total       used       free     shared    buffers     cached
Mem:           128         10        117          5          0          0
-/+ buffers/cache:         10        117
Swap:          975          0        975
root at rubik:/# exit
2015/01/24 14:42:29 RunCommand
uid=0(root) gid=0(root) groups=0(root)
[caglar at qop:~/go/src/gopkg.in/lxc/go-lxc.v2/examples] sudo restart lxcfs
lxcfs start/running, process 26069
[caglar at qop:~/go/src/gopkg.in/lxc/go-lxc.v2/examples] ./attach
2015/01/24 14:42:37 AttachShell
root at rubik:/# free -m
Error: /proc must be mounted
  To mount /proc at boot you need an /etc/fstab line like:
      proc   /proc   proc    defaults
  In the meantime, run "mount proc /proc -t proc"
root at rubik:/#


>>
>> > Thanks for reporting this!
>> >
>> > --
>> > Stéphane Graber
>> > Ubuntu developer
>> > http://www.ubuntu.com
>> >
>> > _______________________________________________
>> > lxc-devel mailing list
>> > lxc-devel at lists.linuxcontainers.org
>> > http://lists.linuxcontainers.org/listinfo/lxc-devel
>> >
>>
>> --
>> S.Çağlar Onur <caglar at 10ur.org>
>> _______________________________________________
>> lxc-devel mailing list
>> lxc-devel at lists.linuxcontainers.org
>> http://lists.linuxcontainers.org/listinfo/lxc-devel
>
> --
> Stéphane Graber
> Ubuntu developer
> http://www.ubuntu.com
>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel
>



-- 
S.Çağlar Onur <caglar at 10ur.org>

From stgraber at ubuntu.com  Sat Jan 24 19:56:44 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Sat, 24 Jan 2015 14:56:44 -0500
Subject: [lxc-devel] `top` within unprivileged container breaks host
In-Reply-To: <CAF+rbZOmQYQiYg_bJ-wAGD6yXEqt=SPEgHEfRmNp76M8f4F5kw@mail.gmail.com>
References: <1421974090.4981.53.camel@olorin.calenhad.com>
 <1422033936.4981.64.camel@olorin.calenhad.com>
 <20150123181946.GK1702@ubuntumail> <20150123184750.GD882@dakara>
 <CAF+rbZNuge6Nqy1-T69s855ZTMwV3v+4qYHHH5M-7cxMWvscOQ@mail.gmail.com>
 <20150124192955.GF882@dakara>
 <CAF+rbZOmQYQiYg_bJ-wAGD6yXEqt=SPEgHEfRmNp76M8f4F5kw@mail.gmail.com>
Message-ID: <20150124195644.GG882@dakara>

On Sat, Jan 24, 2015 at 02:45:52PM -0500, S.Çağlar Onur wrote:
> On Sat, Jan 24, 2015 at 2:29 PM, Stéphane Graber <stgraber at ubuntu.com> wrote:
> > On Sat, Jan 24, 2015 at 02:14:15PM -0500, S.Çağlar Onur wrote:
> >> Hey Stéphane,
> >>
> >> On Fri, Jan 23, 2015 at 1:47 PM, Stéphane Graber <stgraber at ubuntu.com> wrote:
> >> > On Fri, Jan 23, 2015 at 06:19:46PM +0000, Serge Hallyn wrote:
> >> >> Quoting Mathias Gibbens (mathias at calenhad.com):
> >> >> > On Fri, 2015-01-23 at 00:48 +0000, Mathias Gibbens wrote:
> >> >> > > Hello,
> >> >> > >
> >> >> > >   I've been testing LXC 1.1-rc1 on a Debian jessie system. Specifically,
> >> >> > > since all the pieces are now in place to support systemd in unprivileged
> >> >> > > containers, I've been testing running Debian jessie within an
> >> >> > > unprivileged container.
> >> >> > >
> >> >> > >   The jessie container successfully starts (there are some errors along
> >> >> > > the way, but that's another issue), and I can do a `lxc-attach`, add a
> >> >> > > user and log in. However, if I run `top` within the container I only get
> >> >> > > two lines of output:
> >> >> > >
> >> >> > > top - 00:13:25 up 4 min,  0 users,  load average: 0.01, 0.05, 0.05
> >> >> > > Tasks:  10 total,   1 running,   9 sleeping,   0 stopped,   0 zombie
> >> >> > >
> >> >> > >   Furthermore, the host system breaks spectacularly:
> >> >> > >
> >> >> > > lxc at lxc:~$ top
> >> >> > > Error, do this: mount -t proc proc /proc
> >> >> > > lxc at lxc:~$ /sbin/ifconfig
> >> >> > > Warning: cannot open /proc/net/dev (No such file or directory). Limited
> >> >> > > output.
> >> >> > > lxc at lxc:~$ mount
> >> >> > > mount: failed to read mtab: No such file or directory
> >> >> > > lxc at lxc:~$ df
> >> >> > > df: cannot read table of mounted file systems: No such file or directory
> >> >> > > lxc at lxc:~$ sudo reboot
> >> >> > > Running in chroot, ignoring request.
> >> >> > >
> >> >> > >   It seems that /proc is being unmounted somehow on the host. I can
> >> >> > > re-mount /proc on the host, and things seem to work again. (I haven't
> >> >> > > tested too much after re-mounting, instead opting to just reboot the
> >> >> > > host back to a known good state.)
> >> >> > >
> >> >> > >   Any idea what is causing this to happen? I have also tried running
> >> >> > > Ubuntu Vivid as an unprivileged container and see the same results. I
> >> >> > > have not yet tried a different Linux distro for the host system.
> >> >> > >
> >> >> > >   Host system details: Debian jessie with kernel 3.16.7-ckt2-1 x86_64,
> >> >> > > systemd-215, LXC-1.1-rc1 and lxcfs built from current git checkout,
> >> >> > > cgmanager-0.35 as packaged from the sid repository.
> >> >> > >
> >> >> > > Thanks for any ideas,
> >> >> > > Mathias
> >> >> >
> >> >> >   This morning I setup a host running Ubuntu Vivid with cgmanager, lxc,
> >> >> > and lxcfs packages installed from the daily PPA. I setup two
> >> >>
> >> >> But did you install the systemd-sysv package?
> >> >>
> >> >> > unprivileged containers, Debian jessie and Ubuntu Vivid, and ran `top`
> >> >> > within each one. On the Vivid host, `top` runs properly and the host
> >> >> > system does not break.
> >> >> >
> >> >> >   So, it seems that the breakage is due to running jessie on the host
> >> >> > system. Any ideas why this is happening, or where I could begin looking
> >> >> > to debug this problem?
> >> >>
> >> >> No, I've just reproduced it, but it requires systemd to do so.
> >> >>
> >> >> Note that you'll have to manually chown your name=systemd cgroup
> >> >> to your user for the lxc-start to succeed.
> >> >
> >> >
> >> > Hey,
> >> >
> >> > So we've just tracked down that bug and it's a critical flaw in lxcfs
> >> > which we've now fixed upstream. I tagged LXCFS 0.4 with the fix and am
> >> > publishing it now on our website and uploading it to Ubuntu.
> >>
> >> https://launchpad.net/~ubuntu-lxc/+archive/ubuntu/daily still shows
> >> the old lxcfs version. Should I be tracking some other repo?
> >
> > Oops, no. I uploaded to vivid but forgot to refresh the PPA. Doing that now.
> 
> Thanks! Restarting lxcfs breaks running containers, is this expected?
> This happened just after upgrade;

It unfortunately is and I haven't found a good way around this.

The mount disappearing on the host causes all the bind mounts to break.

I tried working around this by running lxcfs in a sub-directory of
/var/lib/lxcfs, bind-mounting the whole directory and then bind-mounting
symlinks but even that didn't work since the kernel followed the
symlinks at the time of the bind-mount...

> 
> [caglar at qop:~/go/src/gopkg.in/lxc/go-lxc.v2/examples] sudo apt-get dist-upgrade
> Reading package lists... Done
> Building dependency tree
> Reading state information... Done
> Calculating upgrade... Done
> The following packages will be upgraded:
>   lxcfs
> 1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
> Need to get 19.1 kB of archives.
> After this operation, 0 B of additional disk space will be used.
> Do you want to continue? [Y/n] y
> Get:1 http://ppa.launchpad.net/ubuntu-lxc/daily/ubuntu/ trusty/main
> lxcfs amd64 0.4-0ubuntu1~ubuntu14.04.1~ppa1 [19.1 kB]
> Fetched 19.1 kB in 0s (42.2 kB/s)
> (Reading database ... 204049 files and directories currently installed.)
> Preparing to unpack .../lxcfs_0.4-0ubuntu1~ubuntu14.04.1~ppa1_amd64.deb ...
> lxcfs stop/waiting
> Unpacking lxcfs (0.4-0ubuntu1~ubuntu14.04.1~ppa1) over
> (0.3-0ubuntu1~ubuntu14.04.1~ppa1) ...
> Processing triggers for man-db (2.6.7.1-1ubuntu1) ...
> Processing triggers for ureadahead (0.100.0-16) ...
> Setting up lxcfs (0.4-0ubuntu1~ubuntu14.04.1~ppa1) ...
> lxcfs start/running, process 24251
> 
> [caglar at qop:~/go/src/gopkg.in/lxc/go-lxc.v2/examples] ./attach
> 2015/01/24 14:41:56 AttachShell
> root at rubik:/# free -m
> Error: /proc must be mounted
>   To mount /proc at boot you need an /etc/fstab line like:
>       proc   /proc   proc    defaults
>   In the meantime, run "mount proc /proc -t proc"
> root at rubik:/# exit
> 
> and I can reproduce it by just restarting the lxcfs service
> 
> [caglar at qop:~/go/src/gopkg.in/lxc/go-lxc.v2/examples] ./attach
> 2015/01/24 14:42:24 AttachShell
> root at rubik:/# free -m
>              total       used       free     shared    buffers     cached
> Mem:           128         10        117          5          0          0
> -/+ buffers/cache:         10        117
> Swap:          975          0        975
> root at rubik:/# exit
> 2015/01/24 14:42:29 RunCommand
> uid=0(root) gid=0(root) groups=0(root)
> [caglar at qop:~/go/src/gopkg.in/lxc/go-lxc.v2/examples] sudo restart lxcfs
> lxcfs start/running, process 26069
> [caglar at qop:~/go/src/gopkg.in/lxc/go-lxc.v2/examples] ./attach
> 2015/01/24 14:42:37 AttachShell
> root at rubik:/# free -m
> Error: /proc must be mounted
>   To mount /proc at boot you need an /etc/fstab line like:
>       proc   /proc   proc    defaults
>   In the meantime, run "mount proc /proc -t proc"
> root at rubik:/#
> 
> 
> >>
> >> > Thanks for reporting this!
> >> >
> >> > --
> >> > Stéphane Graber
> >> > Ubuntu developer
> >> > http://www.ubuntu.com
> >> >
> >> > _______________________________________________
> >> > lxc-devel mailing list
> >> > lxc-devel at lists.linuxcontainers.org
> >> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> >> >
> >>
> >> --
> >> S.Çağlar Onur <caglar at 10ur.org>
> >> _______________________________________________
> >> lxc-devel mailing list
> >> lxc-devel at lists.linuxcontainers.org
> >> http://lists.linuxcontainers.org/listinfo/lxc-devel
> >
> > --
> > Stéphane Graber
> > Ubuntu developer
> > http://www.ubuntu.com
> >
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> >
> 
> 
> 
> -- 
> S.Çağlar Onur <caglar at 10ur.org>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150124/ad0266d6/attachment.sig>

From noreply at github.com  Sat Jan 24 21:51:32 2015
From: noreply at github.com (GitHub)
Date: Sat, 24 Jan 2015 13:51:32 -0800
Subject: [lxc-devel] [lxc/lxc] f10fad: Bug #158: Deletion of unnecessary
 checks before ca...
Message-ID: <54c413e42308d_51463ff6762cf2c04135d@hookshot-fe1-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: f10fad2f53e3f4f2f862bacf218a5aa7feceb505
      https://github.com/lxc/lxc/commit/f10fad2f53e3f4f2f862bacf218a5aa7feceb505
  Author: Markus Elfring <elfring at users.sourceforge.net>
  Date:   2015-01-24 (Sat, 24 Jan 2015)

  Changed paths:
    M src/lxc/attach.c
    M src/lxc/bdev.c
    M src/lxc/cgfs.c
    M src/lxc/cgmanager.c
    M src/lxc/conf.c
    M src/lxc/confile.c
    M src/lxc/lsm/apparmor.c
    M src/lxc/lxc_autostart.c
    M src/lxc/lxc_snapshot.c
    M src/lxc/lxc_start.c
    M src/lxc/lxc_top.c
    M src/lxc/lxc_user_nic.c
    M src/lxc/lxc_usernsexec.c
    M src/lxc/lxccontainer.c
    M src/lxc/lxclock.c
    M src/lxc/network.c
    M src/lxc/parse.c
    M src/lxc/seccomp.c
    M src/python-lxc/lxc.c

  Log Message:
  -----------
  Bug #158: Deletion of unnecessary checks before calls of the function "free"

The function "free" is documented in the way that no action shall occur for
a passed null pointer. It is therefore not needed that a function caller
repeats a corresponding check.
http://stackoverflow.com/questions/18775608/free-a-null-pointer-anyway-or-check-first

This issue was fixed by using the software Coccinelle 1.0.0-rc23.

Signed-off-by: Markus Elfring <elfring at users.sourceforge.net>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: c55d4505e354c203473f1532f785842ea16a16a6
      https://github.com/lxc/lxc/commit/c55d4505e354c203473f1532f785842ea16a16a6
  Author: Markus Elfring <elfring at users.sourceforge.net>
  Date:   2015-01-24 (Sat, 24 Jan 2015)

  Changed paths:
    M src/lxc/cgfs.c
    M src/lxc/lxc_autostart.c
    M src/lxc/lxccontainer.c

  Log Message:
  -----------
  Bug #158: Deletion of unnecessary checks before a few calls of LXC functions

The following functions return immediately if a null pointer was passed.
* container_destroy
* lxc_cgroup_process_info_free_and_remove
* lxc_cgroup_put_meta
* toss_list

It is therefore not needed that a function caller repeats a corresponding check.

This issue was fixed by using the software Coccinelle 1.0.0-rc23.

Signed-off-by: Markus Elfring <elfring at users.sourceforge.net>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 67f69573777d35b291c853733752c2c079bf14e8
      https://github.com/lxc/lxc/commit/67f69573777d35b291c853733752c2c079bf14e8
  Author: Thomas Moschny <thomas.moschny at gmx.de>
  Date:   2015-01-24 (Sat, 24 Jan 2015)

  Changed paths:
    M src/lua-lxc/core.c

  Log Message:
  -----------
  Small fix for Lua 5.3 compatibility.

Signed-off-by: Thomas Moschny <thomas.moschny at gmail.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 1f3fc0d73a88b01bb596b0ea812dc9a5b1f7e5e6
      https://github.com/lxc/lxc/commit/1f3fc0d73a88b01bb596b0ea812dc9a5b1f7e5e6
  Author: Johannes Kastl <mail at ojkastl.de>
  Date:   2015-01-24 (Sat, 24 Jan 2015)

  Changed paths:
    M lxc.spec.in

  Log Message:
  -----------
  rpm: added dependency to lxc-libs to lxc package

Ensures matching versions of lxc and lxc-libs being installed

Signed-off-by: Johannes Kastl <mail at ojkastl.de>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: b8ebaa9c78a78e3e3c4043a20d3c84cac9ca7fd1
      https://github.com/lxc/lxc/commit/b8ebaa9c78a78e3e3c4043a20d3c84cac9ca7fd1
  Author: Vicente Olivert Riera <Vincent.Riera at imgtec.com>
  Date:   2015-01-24 (Sat, 24 Jan 2015)

  Changed paths:
    M templates/lxc-gentoo.in

  Log Message:
  -----------
  Gentoo template - Add a hwaddr if there is only one veth

Reuse the code from the Debian template to associate a hwaddr if there
is only one veth interface in the container's config file.

Signed-off-by: Vicente Olivert Riera <Vincent.Riera at imgtec.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 6a9390e349c5df27d1dec072ef2fb30848a35055
      https://github.com/lxc/lxc/commit/6a9390e349c5df27d1dec072ef2fb30848a35055
  Author: Jörg Thalheim <joerg at higgsboson.tk>
  Date:   2015-01-24 (Sat, 24 Jan 2015)

  Changed paths:
    M config/init/systemd/lxc.service.in

  Log Message:
  -----------
  systemd: enable delegate in service file

Signed-off-by: Jörg Thalheim <joerg at higgsboson.tk>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/ce72f6b466f7...6a9390e349c5

From noreply at github.com  Sun Jan 25 00:01:26 2015
From: noreply at github.com (GitHub)
Date: Sat, 24 Jan 2015 16:01:26 -0800
Subject: [lxc-devel] [lxc/lxc] 669b63: fix failed to fallback at lxclock_name
Message-ID: <54c432566cc16_6aa63fa7bfddd2bc635d8@hookshot-fe5-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 669b632579c213da730c783ad13472fe8835480b
      https://github.com/lxc/lxc/commit/669b632579c213da730c783ad13472fe8835480b
  Author: Kohei YOSHIDA <kohei.yoshida at gehirn.co.jp>
  Date:   2015-01-22 (Thu, 22 Jan 2015)

  Changed paths:
    M src/lxc/lxclock.c

  Log Message:
  -----------
  fix failed to fallback at lxclock_name

lxclock_name will fallback to /tmp/$(id -u)/lxc$lxcpath/.$lxcname when failed
to create directories into rundir. But, in currently, lxclock_name returns
untill preparing directories under the /tmp, so invoker will fail to get
the container lock.  This patch fixes fixes this.

Signed-off-by: Kohei YOSHIDA <kohei.yoshida at gehirn.co.jp>


  Commit: 411c497411217948b00d7fdd2797a74fecd72925
      https://github.com/lxc/lxc/commit/411c497411217948b00d7fdd2797a74fecd72925
  Author: hallyn <serge at hallyn.com>
  Date:   2015-01-24 (Sat, 24 Jan 2015)

  Changed paths:
    M src/lxc/lxclock.c

  Log Message:
  -----------
  Merge pull request #408 from yosida95/patch-1

fix failed to fallback at lxclock_name


Compare: https://github.com/lxc/lxc/compare/6a9390e349c5...411c49741121

From noreply at github.com  Sun Jan 25 04:44:09 2015
From: noreply at github.com (GitHub)
Date: Sat, 24 Jan 2015 20:44:09 -0800
Subject: [lxc-devel] [lxc/lxc] 46cd28: replace deprecated `index` with
	`strchr`
Message-ID: <54c47499c2551_4f5d3fff403f52bc597f4@hookshot-fe1-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 46cd28455f8eedabcccf8fc1955b7199a7467807
      https://github.com/lxc/lxc/commit/46cd28455f8eedabcccf8fc1955b7199a7467807
  Author: Patrick O'Leary <patrick.oleary at gmail.com>
  Date:   2015-01-24 (Sat, 24 Jan 2015)

  Changed paths:
    M src/lxc/bdev.c
    M src/lxc/cgfs.c
    M src/lxc/conf.c
    M src/lxc/confile.c
    M src/lxc/lsm/apparmor.c
    M src/lxc/lxc_usernsexec.c
    M src/lxc/lxccontainer.c
    M src/tests/attach.c

  Log Message:
  -----------
  replace deprecated `index` with `strchr`

The `index` libc function was removed in POSIX 2008, and `strchr` is a direct
replacement. The bionic (Android) libc has removed `index` when you are
compiling for a 64-bit architecture, such as AArch64.

Signed-off-by: Patrick O'Leary <patrick.oleary at gmail.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>



From noreply at github.com  Sun Jan 25 17:10:40 2015
From: noreply at github.com (GitHub)
Date: Sun, 25 Jan 2015 09:10:40 -0800
Subject: [lxc-devel] [lxc/lxc] 9cbffb: improve "lxc-create -t debian -h"
	help text
Message-ID: <54c5239019a26_8d43f93b2ac32a079433@hookshot-fe3-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 9cbffb9f5767edb6f64c08f5e6e45dff6ac508a9
      https://github.com/lxc/lxc/commit/9cbffb9f5767edb6f64c08f5e6e45dff6ac508a9
  Author: Tomas Pospisek <tpo_hp at sourcepole.ch>
  Date:   2015-01-25 (Sun, 25 Jan 2015)

  Changed paths:
    M templates/lxc-debian.in

  Log Message:
  -----------
  improve "lxc-create -t debian -h" help text

- document environment variables
- add missing --packages switch to command line
- describe how to pass template options to lxc-create (since
  lxc-create -h doesn't tell you)
- render help text in the same pretty format as lxc-create does

Signed-off-by: Tomáš Posíšek <tpo_deb at sourcepole.ch>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>



From for-gmane at mutluit.com  Sun Jan 25 18:52:56 2015
From: for-gmane at mutluit.com (U.Mutlu)
Date: Sun, 25 Jan 2015 19:52:56 +0100
Subject: [lxc-devel] [lxc/lxc] 9cbffb: improve "lxc-create -t debian -h"
	help text
In-Reply-To: <54c5239019a26_8d43f93b2ac32a079433@hookshot-fe3-cp1-prd.iad.github.net.mail>
References: <54c5239019a26_8d43f93b2ac32a079433@hookshot-fe3-cp1-prd.iad.github.net.mail>
Message-ID: <ma3e29$pft$1@ger.gmane.org>

Also -w and -r are although listed as options, but the description
is missing, in both -h and also the man page.
lxc-create 1.0.6

cu
Uenal


GitHub wrote, On 01/25/2015 06:10 PM:
>    Branch: refs/heads/master
>    Home:   https://github.com/lxc/lxc
>    Commit: 9cbffb9f5767edb6f64c08f5e6e45dff6ac508a9
>        https://github.com/lxc/lxc/commit/9cbffb9f5767edb6f64c08f5e6e45dff6ac508a9
>    Author: Tomas Pospisek <tpo_hp-UQchlGytWBLoPl2ZpcX+cw at public.gmane.org>
>    Date:   2015-01-25 (Sun, 25 Jan 2015)
>
>    Changed paths:
>      M templates/lxc-debian.in
>
>    Log Message:
>    -----------
>    improve "lxc-create -t debian -h" help text
>
> - document environment variables
> - add missing --packages switch to command line
> - describe how to pass template options to lxc-create (since
>    lxc-create -h doesn't tell you)
> - render help text in the same pretty format as lxc-create does
>
> Signed-off-by: Tomáš Posíšek <tpo_deb-UQchlGytWBLoPl2ZpcX+cw at public.gmane.org>
> Acked-by: Stéphane Graber <stgraber-GeWIH/nMZzLQT0dZR+AlfA at public.gmane.org>




From noreply at github.com  Sun Jan 25 20:46:15 2015
From: noreply at github.com (GitHub)
Date: Sun, 25 Jan 2015 12:46:15 -0800
Subject: [lxc-devel] [lxc/lxc]
Message-ID: <54c556173c1c2_120f3f9a8c8df2a0342ac@hookshot-fe3-cp1-prd.iad.github.net.mail>

  Branch: refs/tags/lxc-1.1.0.rc2
  Home:   https://github.com/lxc/lxc

From noreply at github.com  Sun Jan 25 20:46:14 2015
From: noreply at github.com (GitHub)
Date: Sun, 25 Jan 2015 12:46:14 -0800
Subject: [lxc-devel] [lxc/lxc] e532f1: change version to 1.1.0.rc2 in
	configure.ac
Message-ID: <54c556163c2f9_cee3fa793d0d2a09845c@hookshot-fe3-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: e532f165e25b133e15c02747c8cf2236c9098a56
      https://github.com/lxc/lxc/commit/e532f165e25b133e15c02747c8cf2236c9098a56
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-25 (Sun, 25 Jan 2015)

  Changed paths:
    M configure.ac

  Log Message:
  -----------
  change version to 1.1.0.rc2 in configure.ac

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>



From stgraber at ubuntu.com  Sun Jan 25 20:58:27 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Sun, 25 Jan 2015 15:58:27 -0500
Subject: [lxc-devel] [lxc/lxc] e532f1: change version to 1.1.0.rc2 in
 configure.ac
In-Reply-To: <54c556163c2f9_cee3fa793d0d2a09845c@hookshot-fe3-cp1-prd.iad.github.net.mail>
References: <54c556163c2f9_cee3fa793d0d2a09845c@hookshot-fe3-cp1-prd.iad.github.net.mail>
Message-ID: <20150125205827.GA10697@dakara>

On Sun, Jan 25, 2015 at 12:46:14PM -0800, GitHub wrote:
>   Branch: refs/heads/master
>   Home:   https://github.com/lxc/lxc
>   Commit: e532f165e25b133e15c02747c8cf2236c9098a56
>       https://github.com/lxc/lxc/commit/e532f165e25b133e15c02747c8cf2236c9098a56
>   Author: Stéphane Graber <stgraber at ubuntu.com>
>   Date:   2015-01-25 (Sun, 25 Jan 2015)
> 
>   Changed paths:
>     M configure.ac
> 
>   Log Message:
>   -----------
>   change version to 1.1.0.rc2 in configure.ac
> 
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

And that means rc2 has now been tagged.

Current plan is for rc3 tomorrow after I go through all the github bug
reports and final on Tuesday afternoon Europe-time.

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150125/a1d4cb7b/attachment.sig>

From builds at travis-ci.org  Sun Jan 25 20:47:46 2015
From: builds at travis-ci.org (Travis CI)
Date: Sun, 25 Jan 2015 20:47:46 +0000
Subject: [lxc-devel] Passed: lxc/lxc#825 (lxc-1.1.0.rc2 - e532f16)
In-Reply-To: <lxc/lxc+48275286+passed@travis-ci.org>
Message-ID: <54c55671c9a90_312dce4e35625a@a933d16f-bbeb-4975-bb78-02f69fe0b913.mail>

Build Update for lxc/lxc
-------------------------------------

Build: #825
Status: Passed

Duration: 53 seconds
Commit: e532f16 (lxc-1.1.0.rc2)
Author: Stéphane Graber
Message: change version to 1.1.0.rc2 in configure.ac

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

View the changeset: https://github.com/lxc/lxc/compare/lxc-1.1.0.rc2

View the full build log and details: https://travis-ci.org/lxc/lxc/builds/48275286

--

You can configure recipients for build notifications in your .travis.yml file. See http://docs.travis-ci.com/user/notifications



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150125/26e723e8/attachment.html>

From noreply at github.com  Mon Jan 26 05:12:45 2015
From: noreply at github.com (GitHub)
Date: Sun, 25 Jan 2015 21:12:45 -0800
Subject: [lxc-devel] [lxc/lxc] ab3514: lua: fix crash on missing blkio
Message-ID: <54c5cccd900c9_50093f93517892bc17365@hookshot-fe5-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: ab35147cde2432d81f6752dc833979433d0fa76a
      https://github.com/lxc/lxc/commit/ab35147cde2432d81f6752dc833979433d0fa76a
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-26 (Mon, 26 Jan 2015)

  Changed paths:
    M src/lua-lxc/lxc.lua

  Log Message:
  -----------
  lua: fix crash on missing blkio

Closes: #403

Signed-off-by: Dwight Engen
Acked-by: Stéphane Graber <stgraber at ubuntu.com>



From serge.hallyn at ubuntu.com  Mon Jan 26 05:58:50 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 26 Jan 2015 05:58:50 +0000
Subject: [lxc-devel] [PATCH 1/1] Use 'overlay' as fs name when needed
Message-ID: <20150126055850.GA7540@ubuntumail>

This addresses https://github.com/lxc/lxc/issues/389

We will probably also want to switch the order of the mount attempts, as
the new overlay fs should quickly become the more common scenario.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/bdev.c | 29 +++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/src/lxc/bdev.c b/src/lxc/bdev.c
index ac387b1..721a72b 100644
--- a/src/lxc/bdev.c
+++ b/src/lxc/bdev.c
@@ -2138,6 +2138,28 @@ static int overlayfs_detect(const char *path)
 	return 0;
 }
 
+static char *overlayfs_name;
+static char *detect_overlayfs_name(void)
+{
+	char *v = "overlayfs";
+	char *line = NULL;
+	size_t len = 0;
+	FILE *f = fopen("/proc/filesystems", "r");
+	if (!f)
+		return v;
+
+	while (getline(&line, &len, f) != -1) {
+		if (strcmp(line, "nodev\toverlay\n") == 0) {
+			v = "overlay";
+			break;
+		}
+	}
+
+	fclose(f);
+	free(line);
+	return v;
+}
+
 //
 // XXXXXXX plain directory bind mount ops
 //
@@ -2156,6 +2178,9 @@ static int overlayfs_mount(struct bdev *bdev)
 	if (!bdev->src || !bdev->dest)
 		return -22;
 
+	if (!overlayfs_name)
+		overlayfs_name = detect_overlayfs_name();
+
 	//  separately mount it first
 	//  mount -t overlayfs -oupperdir=${upper},lowerdir=${lower} lower dest
 	dup = alloca(strlen(bdev->src)+1);
@@ -2216,13 +2241,13 @@ static int overlayfs_mount(struct bdev *bdev)
 	}
 
 	// mount without workdir option for overlayfs before v21
-	ret = mount(lower, bdev->dest, "overlayfs", MS_MGC_VAL | mntflags, options);
+	ret = mount(lower, bdev->dest, overlayfs_name, MS_MGC_VAL | mntflags, options);
 	if (ret < 0) {
 		INFO("overlayfs: error mounting %s onto %s options %s. retry with workdir",
 			lower, bdev->dest, options);
 
 		// retry with workdir option for overlayfs v22 and higher
-		ret = mount(lower, bdev->dest, "overlayfs", MS_MGC_VAL | mntflags, options_work);
+		ret = mount(lower, bdev->dest, overlayfs_name, MS_MGC_VAL | mntflags, options_work);
 		if (ret < 0)
 			SYSERROR("overlayfs: error mounting %s onto %s options %s",
 				lower, bdev->dest, options_work);
-- 
2.1.0


From karma at jazz.email.ne.jp  Mon Jan 26 08:46:43 2015
From: karma at jazz.email.ne.jp (KATOH Yasufumi)
Date: Mon, 26 Jan 2015 17:46:43 +0900
Subject: [lxc-devel] [PATCH 1/1] Use 'overlay' as fs name when needed
In-Reply-To: <20150126055850.GA7540@ubuntumail>
References: <20150126055850.GA7540@ubuntumail>
Message-ID: <87mw56yln0.wl%karma@jazz.email.ne.jp>

Hi,

I applied your patch and tested on:
* 3.18.3 kernel (module name is 'overlay' and needs 'workdir' option)
* 3.17.6 kernel with overlayfs.v24 (module name is 'overlayfs' and
  needs 'workdir' option)
* 3.13.8 kernel with overlayfs.v21 (module name is 'overlayfs' and
  do not need 'workdir' option)

It works fine on those.

>>> On Mon, 26 Jan 2015 05:58:50 +0000
    in message   "[lxc-devel] [PATCH 1/1] Use 'overlay' as fs name when needed"
                  Serge Hallyn-san wrote:

> This addresses https://github.com/lxc/lxc/issues/389

> We will probably also want to switch the order of the mount attempts, as
> the new overlay fs should quickly become the more common scenario.

> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: KATOH Yasufumi <karma at jazz.email.ne.jp>

> ---
>  src/lxc/bdev.c | 29 +++++++++++++++++++++++++++--
>  1 file changed, 27 insertions(+), 2 deletions(-)

> diff --git a/src/lxc/bdev.c b/src/lxc/bdev.c
> index ac387b1..721a72b 100644
> --- a/src/lxc/bdev.c
> +++ b/src/lxc/bdev.c
> @@ -2138,6 +2138,28 @@ static int overlayfs_detect(const char *path)
>  	return 0;
>  }
 
> +static char *overlayfs_name;
> +static char *detect_overlayfs_name(void)
> +{
> +	char *v = "overlayfs";
> +	char *line = NULL;
> +	size_t len = 0;
> +	FILE *f = fopen("/proc/filesystems", "r");
> +	if (!f)
> +		return v;
> +
> +	while (getline(&line, &len, f) != -1) {
> +		if (strcmp(line, "nodev\toverlay\n") == 0) {
> +			v = "overlay";
> +			break;
> +		}
> +	}
> +
> +	fclose(f);
> +	free(line);
> +	return v;
> +}
> +
>  //
>  // XXXXXXX plain directory bind mount ops
>  //
> @@ -2156,6 +2178,9 @@ static int overlayfs_mount(struct bdev *bdev)
>  	if (!bdev->src || !bdev->dest)
>  		return -22;
 
> +	if (!overlayfs_name)
> +		overlayfs_name = detect_overlayfs_name();
> +
>  	//  separately mount it first
>  	//  mount -t overlayfs -oupperdir=${upper},lowerdir=${lower} lower dest
>  	dup = alloca(strlen(bdev->src)+1);
> @@ -2216,13 +2241,13 @@ static int overlayfs_mount(struct bdev *bdev)
>  	}
 
>  	// mount without workdir option for overlayfs before v21
> -	ret = mount(lower, bdev->dest, "overlayfs", MS_MGC_VAL | mntflags, options);
> +	ret = mount(lower, bdev->dest, overlayfs_name, MS_MGC_VAL | mntflags, options);
>  	if (ret < 0) {
>  		INFO("overlayfs: error mounting %s onto %s options %s. retry with workdir",
>  			lower, bdev->dest, options);
 
>  		// retry with workdir option for overlayfs v22 and higher
> -		ret = mount(lower, bdev->dest, "overlayfs", MS_MGC_VAL | mntflags, options_work);
> +		ret = mount(lower, bdev->dest, overlayfs_name, MS_MGC_VAL | mntflags, options_work);
>  		if (ret < 0)
>  			SYSERROR("overlayfs: error mounting %s onto %s options %s",
>  				lower, bdev->dest, options_work);
> -- 
> 2.1.0

> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From noreply at github.com  Mon Jan 26 16:57:16 2015
From: noreply at github.com (GitHub)
Date: Mon, 26 Jan 2015 08:57:16 -0800
Subject: [lxc-devel] [lxc/lxc] 38b349: Use 'overlay' as fs name when needed
Message-ID: <54c671ecf11f1_53163ff1b0e2f2c063139@hookshot-fe3-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 38b34913fad2a4bcc842c2c377c0cb7bb90abe0f
      https://github.com/lxc/lxc/commit/38b34913fad2a4bcc842c2c377c0cb7bb90abe0f
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-26 (Mon, 26 Jan 2015)

  Changed paths:
    M src/lxc/bdev.c

  Log Message:
  -----------
  Use 'overlay' as fs name when needed

Close #389

We will probably also want to switch the order of the mount attempts, as
the new overlay fs should quickly become the more common scenario.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: KATOH Yasufumi <karma at jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>



From stgraber at ubuntu.com  Mon Jan 26 20:52:11 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Mon, 26 Jan 2015 15:52:11 -0500
Subject: [lxc-devel] [PATCH] clear_config_item should only work for lists
Message-ID: <1422305531-3987-1-git-send-email-stgraber@ubuntu.com>

Close #394

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 src/lxc/conf.c    | 21 ---------------------
 src/lxc/confile.c | 10 ++--------
 2 files changed, 2 insertions(+), 29 deletions(-)

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index c7db06f..2f22eaf 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -3953,27 +3953,6 @@ int lxc_clear_nic(struct lxc_conf *c, const char *key)
 			free(it2->elem);
 			free(it2);
 		}
-	} else if (strcmp(p1, ".link") == 0) {
-		free(netdev->link);
-		netdev->link = NULL;
-	} else if (strcmp(p1, ".name") == 0) {
-		free(netdev->name);
-		netdev->name = NULL;
-	} else if (strcmp(p1, ".script.up") == 0) {
-		free(netdev->upscript);
-		netdev->upscript = NULL;
-	} else if (strcmp(p1, ".hwaddr") == 0) {
-		free(netdev->hwaddr);
-		netdev->hwaddr = NULL;
-	} else if (strcmp(p1, ".mtu") == 0) {
-		free(netdev->mtu);
-		netdev->mtu = NULL;
-	} else if (strcmp(p1, ".ipv4.gateway") == 0) {
-		free(netdev->ipv4_gateway);
-		netdev->ipv4_gateway = NULL;
-	} else if (strcmp(p1, ".ipv6.gateway") == 0) {
-		free(netdev->ipv6_gateway);
-		netdev->ipv6_gateway = NULL;
 	}
 		else return -1;
 
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index a2e964b..be81f5d 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -2442,16 +2442,10 @@ int lxc_clear_config_item(struct lxc_conf *c, const char *key)
 		return lxc_clear_hooks(c, key);
 	else if (strncmp(key, "lxc.group", 9) == 0)
 		return lxc_clear_groups(c);
-	else if (strncmp(key, "lxc.seccomp", 11) == 0) {
-		lxc_seccomp_free(c);
-		return 0;
-	}
-	else if (strncmp(key, "lxc.environment", 15) == 0) {
+	else if (strncmp(key, "lxc.environment", 15) == 0)
 		return lxc_clear_environment(c);
-	}
-	else if (strncmp(key, "lxc.id_map", 10) == 0) {
+	else if (strncmp(key, "lxc.id_map", 10) == 0)
 		return lxc_clear_idmaps(c);
-	}
 	return -1;
 }
 
-- 
1.9.1


From serge.hallyn at ubuntu.com  Mon Jan 26 22:52:36 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Mon, 26 Jan 2015 22:52:36 +0000
Subject: [lxc-devel] [PATCH] clear_config_item should only work for lists
In-Reply-To: <1422305531-3987-1-git-send-email-stgraber@ubuntu.com>
References: <1422305531-3987-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150126225236.GE7540@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Close #394
> 
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  src/lxc/conf.c    | 21 ---------------------
>  src/lxc/confile.c | 10 ++--------
>  2 files changed, 2 insertions(+), 29 deletions(-)
> 
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index c7db06f..2f22eaf 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -3953,27 +3953,6 @@ int lxc_clear_nic(struct lxc_conf *c, const char *key)
>  			free(it2->elem);
>  			free(it2);
>  		}
> -	} else if (strcmp(p1, ".link") == 0) {
> -		free(netdev->link);
> -		netdev->link = NULL;
> -	} else if (strcmp(p1, ".name") == 0) {
> -		free(netdev->name);
> -		netdev->name = NULL;
> -	} else if (strcmp(p1, ".script.up") == 0) {
> -		free(netdev->upscript);
> -		netdev->upscript = NULL;
> -	} else if (strcmp(p1, ".hwaddr") == 0) {
> -		free(netdev->hwaddr);
> -		netdev->hwaddr = NULL;
> -	} else if (strcmp(p1, ".mtu") == 0) {
> -		free(netdev->mtu);
> -		netdev->mtu = NULL;
> -	} else if (strcmp(p1, ".ipv4.gateway") == 0) {
> -		free(netdev->ipv4_gateway);
> -		netdev->ipv4_gateway = NULL;
> -	} else if (strcmp(p1, ".ipv6.gateway") == 0) {
> -		free(netdev->ipv6_gateway);
> -		netdev->ipv6_gateway = NULL;
>  	}
>  		else return -1;
>  
> diff --git a/src/lxc/confile.c b/src/lxc/confile.c
> index a2e964b..be81f5d 100644
> --- a/src/lxc/confile.c
> +++ b/src/lxc/confile.c
> @@ -2442,16 +2442,10 @@ int lxc_clear_config_item(struct lxc_conf *c, const char *key)
>  		return lxc_clear_hooks(c, key);
>  	else if (strncmp(key, "lxc.group", 9) == 0)
>  		return lxc_clear_groups(c);
> -	else if (strncmp(key, "lxc.seccomp", 11) == 0) {
> -		lxc_seccomp_free(c);
> -		return 0;
> -	}
> -	else if (strncmp(key, "lxc.environment", 15) == 0) {
> +	else if (strncmp(key, "lxc.environment", 15) == 0)
>  		return lxc_clear_environment(c);
> -	}
> -	else if (strncmp(key, "lxc.id_map", 10) == 0) {
> +	else if (strncmp(key, "lxc.id_map", 10) == 0)
>  		return lxc_clear_idmaps(c);
> -	}
>  	return -1;
>  }
>  
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From stgraber at ubuntu.com  Mon Jan 26 22:56:11 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Mon, 26 Jan 2015 17:56:11 -0500
Subject: [lxc-devel] [PATCH] clear_config_item should only work for lists
In-Reply-To: <20150126225236.GE7540@ubuntumail>
References: <1422305531-3987-1-git-send-email-stgraber@ubuntu.com>
 <20150126225236.GE7540@ubuntumail>
Message-ID: <20150126225611.GA1109@castiana.ipv6.teksavvy.com>

On Mon, Jan 26, 2015 at 10:52:36PM +0000, Serge Hallyn wrote:
> Quoting Stéphane Graber (stgraber at ubuntu.com):
> > Close #394
> > 
> > Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
> 
> Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

Note that this exposed a slight problem with clearing values through
set_config_item for network keys. We won't be pushing that fix in rc3
but it will make it in final.

> 
> > ---
> >  src/lxc/conf.c    | 21 ---------------------
> >  src/lxc/confile.c | 10 ++--------
> >  2 files changed, 2 insertions(+), 29 deletions(-)
> > 
> > diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> > index c7db06f..2f22eaf 100644
> > --- a/src/lxc/conf.c
> > +++ b/src/lxc/conf.c
> > @@ -3953,27 +3953,6 @@ int lxc_clear_nic(struct lxc_conf *c, const char *key)
> >  			free(it2->elem);
> >  			free(it2);
> >  		}
> > -	} else if (strcmp(p1, ".link") == 0) {
> > -		free(netdev->link);
> > -		netdev->link = NULL;
> > -	} else if (strcmp(p1, ".name") == 0) {
> > -		free(netdev->name);
> > -		netdev->name = NULL;
> > -	} else if (strcmp(p1, ".script.up") == 0) {
> > -		free(netdev->upscript);
> > -		netdev->upscript = NULL;
> > -	} else if (strcmp(p1, ".hwaddr") == 0) {
> > -		free(netdev->hwaddr);
> > -		netdev->hwaddr = NULL;
> > -	} else if (strcmp(p1, ".mtu") == 0) {
> > -		free(netdev->mtu);
> > -		netdev->mtu = NULL;
> > -	} else if (strcmp(p1, ".ipv4.gateway") == 0) {
> > -		free(netdev->ipv4_gateway);
> > -		netdev->ipv4_gateway = NULL;
> > -	} else if (strcmp(p1, ".ipv6.gateway") == 0) {
> > -		free(netdev->ipv6_gateway);
> > -		netdev->ipv6_gateway = NULL;
> >  	}
> >  		else return -1;
> >  
> > diff --git a/src/lxc/confile.c b/src/lxc/confile.c
> > index a2e964b..be81f5d 100644
> > --- a/src/lxc/confile.c
> > +++ b/src/lxc/confile.c
> > @@ -2442,16 +2442,10 @@ int lxc_clear_config_item(struct lxc_conf *c, const char *key)
> >  		return lxc_clear_hooks(c, key);
> >  	else if (strncmp(key, "lxc.group", 9) == 0)
> >  		return lxc_clear_groups(c);
> > -	else if (strncmp(key, "lxc.seccomp", 11) == 0) {
> > -		lxc_seccomp_free(c);
> > -		return 0;
> > -	}
> > -	else if (strncmp(key, "lxc.environment", 15) == 0) {
> > +	else if (strncmp(key, "lxc.environment", 15) == 0)
> >  		return lxc_clear_environment(c);
> > -	}
> > -	else if (strncmp(key, "lxc.id_map", 10) == 0) {
> > +	else if (strncmp(key, "lxc.id_map", 10) == 0)
> >  		return lxc_clear_idmaps(c);
> > -	}
> >  	return -1;
> >  }
> >  
> > -- 
> > 1.9.1
> > 
> > _______________________________________________
> > lxc-devel mailing list
> > lxc-devel at lists.linuxcontainers.org
> > http://lists.linuxcontainers.org/listinfo/lxc-devel
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150126/1c20b182/attachment.sig>

From noreply at github.com  Mon Jan 26 23:05:01 2015
From: noreply at github.com (GitHub)
Date: Mon, 26 Jan 2015 15:05:01 -0800
Subject: [lxc-devel] [lxc/lxc]
Message-ID: <54c6c81d386c9_36f23fe242f232bc395bd@hookshot-fe6-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/lxc/stable-0.7.4
  Home:   https://github.com/lxc/lxc

From noreply at github.com  Mon Jan 26 23:05:14 2015
From: noreply at github.com (GitHub)
Date: Mon, 26 Jan 2015 15:05:14 -0800
Subject: [lxc-devel] [lxc/lxc]
Message-ID: <54c6c82adac04_36f23fe242f232bc3977e@hookshot-fe6-cp1-prd.iad.github.net.mail>

  Branch: refs/tags/lxc-1.1.0.rc3
  Home:   https://github.com/lxc/lxc

From noreply at github.com  Mon Jan 26 23:05:01 2015
From: noreply at github.com (GitHub)
Date: Mon, 26 Jan 2015 15:05:01 -0800
Subject: [lxc-devel] [lxc/lxc] adc1f9: change version to 1.1.0.rc3 in
	configure.ac
Message-ID: <54c6c81d41038_36373f88b692529c443e5@hookshot-fe6-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/lxc/master
  Home:   https://github.com/lxc/lxc
  Commit: adc1f9185f87d18dedfd322ecf9e6fde310b64ca
      https://github.com/lxc/lxc/commit/adc1f9185f87d18dedfd322ecf9e6fde310b64ca
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-26 (Mon, 26 Jan 2015)

  Changed paths:
    M configure.ac

  Log Message:
  -----------
  change version to 1.1.0.rc3 in configure.ac

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>



From noreply at github.com  Mon Jan 26 23:05:01 2015
From: noreply at github.com (GitHub)
Date: Mon, 26 Jan 2015 15:05:01 -0800
Subject: [lxc-devel] [lxc/lxc]
Message-ID: <54c6c81d3ebcb_4cf3fa22f1dd2b8381fc@hookshot-fe2-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/lxc/stable-1.0
  Home:   https://github.com/lxc/lxc

From noreply at github.com  Mon Jan 26 23:05:01 2015
From: noreply at github.com (GitHub)
Date: Mon, 26 Jan 2015 15:05:01 -0800
Subject: [lxc-devel] [lxc/lxc] fd83dd: Add common.conf.d
Message-ID: <54c6c81d4d156_26453ff64cb752a0848da@hookshot-fe1-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/stgraber/master
  Home:   https://github.com/lxc/lxc
  Commit: fd83dde5cb883d47c28c0cd6fb26b1ed0029cec8
      https://github.com/lxc/lxc/commit/fd83dde5cb883d47c28c0cd6fb26b1ed0029cec8
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-20 (Tue, 20 Jan 2015)

  Changed paths:
    M config/templates/Makefile.am
    A config/templates/common.conf.d/Makefile.am
    A config/templates/common.conf.d/README
    M config/templates/common.conf.in
    M configure.ac

  Log Message:
  -----------
  Add common.conf.d

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: d25e1ecf11cf3691290e1513a480791f6d6d91bc
      https://github.com/lxc/lxc/commit/d25e1ecf11cf3691290e1513a480791f6d6d91bc
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-20 (Tue, 20 Jan 2015)

  Changed paths:
    M config/templates/archlinux.common.conf.in
    M config/templates/opensuse.common.conf.in
    M doc/lxc.container.conf.sgml.in
    M src/lxc/conf.c
    M templates/lxc-centos.in
    M templates/lxc-debian.in
    M templates/lxc-fedora.in
    M templates/lxc-openmandriva.in
    M templates/lxc-oracle.in

  Log Message:
  -----------
  Turn autodev on by default

Now that autodev works fine with unprivileged containers and shouldn't
come with any side effect, lets turn it on by default.

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 336a2ce443f3e645c4a191247f3dd0684ea9fbe9
      https://github.com/lxc/lxc/commit/336a2ce443f3e645c4a191247f3dd0684ea9fbe9
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-20 (Tue, 20 Jan 2015)

  Changed paths:
    M config/templates/archlinux.common.conf.in
    M doc/lxc.container.conf.sgml.in
    M src/lxc/conf.c
    M templates/lxc-debian.in
    M templates/lxc-fedora.in
    M templates/lxc-oracle.in
    M templates/lxc-sshd.in

  Log Message:
  -----------
  Set kmsg to 0 by default

It's now been proven over and over again that the symlink from /dev/kmsg
to /dev/console is harmful for everything but upstart systems. As Ubuntu
is now switching over to systemd too, lets switch the default.

Upstart users wishing to see boot messages can always set lxc.kmsg = 1
manually in their config (so long as they don't expect to then
dist-upgrade the container to systemd succesfuly).

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/fd83dde5cb88^...336a2ce443f3

From noreply at github.com  Mon Jan 26 23:05:01 2015
From: noreply at github.com (GitHub)
Date: Mon, 26 Jan 2015 15:05:01 -0800
Subject: [lxc-devel] [lxc/lxc] 57d321: Initial work on new command line tool
Message-ID: <54c6c81da269c_4b6a3ff5a87b329c4529d@hookshot-fe4-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/stgraber/new-cmd
  Home:   https://github.com/lxc/lxc
  Commit: 57d3214ccbbcd4e01ef2d5bdded800d6d599aec1
      https://github.com/lxc/lxc/commit/57d3214ccbbcd4e01ef2d5bdded800d6d599aec1
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-07 (Mon, 07 Jul 2014)

  Changed paths:
    M .gitignore
    A src/lxccmd/lxc
    A src/lxccmd/lxccmd/__init__.py
    A src/lxccmd/lxccmd/certs.py
    A src/lxccmd/lxccmd/cli/__init__.py
    A src/lxccmd/lxccmd/commands/__init__.py
    A src/lxccmd/lxccmd/commands/server/__init__.py
    A src/lxccmd/lxccmd/commands/status/__init__.py
    A src/lxccmd/lxccmd/config.py
    A src/lxccmd/lxccmd/network/__init__.py
    A src/lxccmd/po/fr.po
    A src/lxccmd/po/lxccmd.pot
    A src/lxccmd/setup.py
    A src/lxccmd/tests/run
    A src/lxccmd/tests/test_cli.py
    A src/lxccmd/tests/test_command_status.py
    A src/lxccmd/tests/test_commands.py
    A src/lxccmd/tests/test_static.py

  Log Message:
  -----------
  Initial work on new command line tool

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 2c1f53f64e98ae8770741af23ed5fe99cb652c4c
      https://github.com/lxc/lxc/commit/2c1f53f64e98ae8770741af23ed5fe99cb652c4c
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-08 (Tue, 08 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/commands/server/__init__.py
    M src/lxccmd/tests/test_command_status.py

  Log Message:
  -----------
  server: Add support for all query types.

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 9aedf85986d5dbfe21f3409fc498f893a833712e
      https://github.com/lxc/lxc/commit/9aedf85986d5dbfe21f3409fc498f893a833712e
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-09 (Wed, 09 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/certs.py
    M src/lxccmd/lxccmd/commands/server/__init__.py

  Log Message:
  -----------
  Double check the client certificate

SSL occasionaly does some client certificate caching, so double check
all connections.

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 54aef6885cd2922ac26bd969f49a7d61512de406
      https://github.com/lxc/lxc/commit/54aef6885cd2922ac26bd969f49a7d61512de406
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-09 (Wed, 09 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/commands/server/__init__.py
    M src/lxccmd/lxccmd/commands/status/__init__.py

  Log Message:
  -----------
  Add basic role based authentication

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 83a5e8159a87b12973902441a01d82431fb8af21
      https://github.com/lxc/lxc/commit/83a5e8159a87b12973902441a01d82431fb8af21
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-09 (Wed, 09 Jul 2014)

  Changed paths:
    M src/lxccmd/lxc
    M src/lxccmd/lxccmd/commands/server/__init__.py
    M src/lxccmd/lxccmd/commands/status/__init__.py
    A src/lxccmd/lxccmd/exceptions.py
    M src/lxccmd/tests/test_command_status.py

  Log Message:
  -----------
  Use a more flexible error handling mechanism

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 0002babb0ddc77d06d5a80c04812663a2d19a186
      https://github.com/lxc/lxc/commit/0002babb0ddc77d06d5a80c04812663a2d19a186
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-09 (Wed, 09 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/config.py

  Log Message:
  -----------
  Add basic configuration file management

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: d3cd5dd8f7ac06d6774fbf65c4449ef135a63414
      https://github.com/lxc/lxc/commit/d3cd5dd8f7ac06d6774fbf65c4449ef135a63414
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-10 (Thu, 10 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/config.py

  Log Message:
  -----------
  Some tweaks to the config functions

Return the right type in config_get and allow to unset a key using config_set.

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 272a83f9e1ba53730a881e94973bc01c82cbd593
      https://github.com/lxc/lxc/commit/272a83f9e1ba53730a881e94973bc01c82cbd593
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-10 (Thu, 10 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/commands/server/__init__.py

  Log Message:
  -----------
  server: Implement set and use the config

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 52d779998b1d4e3390f0afa399bed1ede2b11ee3
      https://github.com/lxc/lxc/commit/52d779998b1d4e3390f0afa399bed1ede2b11ee3
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-10 (Thu, 10 Jul 2014)

  Changed paths:
    M src/lxccmd/po/fr.po
    M src/lxccmd/po/lxccmd.pot

  Log Message:
  -----------
  Update translations

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: dc2459cb58c4aa621de6d203b7b9dcf2bc1cfe61
      https://github.com/lxc/lxc/commit/dc2459cb58c4aa621de6d203b7b9dcf2bc1cfe61
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-10 (Thu, 10 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/config.py

  Log Message:
  -----------
  Use the configparser type helpers

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 60242ce3db8d8fe7ea12e991355adc58e1a4bbfd
      https://github.com/lxc/lxc/commit/60242ce3db8d8fe7ea12e991355adc58e1a4bbfd
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-10 (Thu, 10 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/commands/server/__init__.py
    M src/lxccmd/lxccmd/commands/status/__init__.py
    M src/lxccmd/lxccmd/network/__init__.py

  Log Message:
  -----------
  Add password protected trust relationship

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 48c9364830a450c7f362abe98c83b97a156820b4
      https://github.com/lxc/lxc/commit/48c9364830a450c7f362abe98c83b97a156820b4
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-10 (Thu, 10 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/network/__init__.py

  Log Message:
  -----------
  Fix error reporting a bit

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 6a2c36a6123cf1448384bb60ff4badbfb7ef2d2c
      https://github.com/lxc/lxc/commit/6a2c36a6123cf1448384bb60ff4badbfb7ef2d2c
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-14 (Mon, 14 Jul 2014)

  Changed paths:
    A src/lxccmd/lxccmd/commands/remote/__init__.py

  Log Message:
  -----------
  Add skeleton of the remote command

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 60a1bbb96935126c85829531448772a896c22743
      https://github.com/lxc/lxc/commit/60a1bbb96935126c85829531448772a896c22743
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-16 (Wed, 16 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/commands/remote/__init__.py
    M src/lxccmd/lxccmd/commands/server/__init__.py
    M src/lxccmd/lxccmd/commands/status/__init__.py
    M src/lxccmd/lxccmd/config.py
    M src/lxccmd/lxccmd/network/__init__.py

  Log Message:
  -----------
  Add most of "remote add"

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 61f4f2c6a81be9a76b45786f1d03066dc27c30b0
      https://github.com/lxc/lxc/commit/61f4f2c6a81be9a76b45786f1d03066dc27c30b0
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-16 (Wed, 16 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/commands/remote/__init__.py
    M src/lxccmd/lxccmd/config.py

  Log Message:
  -----------
  Add support for listing and removing remotes

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: b777ea053236442b8ba511a367f8f573ace0778d
      https://github.com/lxc/lxc/commit/b777ea053236442b8ba511a367f8f573ace0778d
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-16 (Wed, 16 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/certs.py
    M src/lxccmd/lxccmd/network/__init__.py

  Log Message:
  -----------
  Bump everything to sha256

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: bda512e7911f9eaf6c6fcd6f86b84ba6e57d4edb
      https://github.com/lxc/lxc/commit/bda512e7911f9eaf6c6fcd6f86b84ba6e57d4edb
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-16 (Wed, 16 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/commands/server/__init__.py
    M src/lxccmd/lxccmd/network/__init__.py

  Log Message:
  -----------
  Hide the server password and fix some error handling

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 294a8b32d032a05ee7efab760398761c3ca6961d
      https://github.com/lxc/lxc/commit/294a8b32d032a05ee7efab760398761c3ca6961d
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-07-16 (Wed, 16 Jul 2014)

  Changed paths:
    M src/lxccmd/lxccmd/commands/remote/__init__.py
    M src/lxccmd/lxccmd/commands/status/__init__.py
    M src/lxccmd/lxccmd/network/__init__.py

  Log Message:
  -----------
  Implement proper secure remote calls

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: eb60efeed06fc021cd4e422470705c9f3fcaa2ca
      https://github.com/lxc/lxc/commit/eb60efeed06fc021cd4e422470705c9f3fcaa2ca
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2014-08-01 (Fri, 01 Aug 2014)

  Changed paths:
    M src/lxccmd/lxc

  Log Message:
  -----------
  Create runtime dir if missing

Reported-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: fc524fe8b5acff445ffc6a2c2e54220525bc4781
      https://github.com/lxc/lxc/commit/fc524fe8b5acff445ffc6a2c2e54220525bc4781
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2014-08-01 (Fri, 01 Aug 2014)

  Changed paths:
    M src/lxccmd/lxccmd/commands/remote/__init__.py

  Log Message:
  -----------
  typo fix - s/args.passwd/args.password/

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/57d3214ccbbc^...fc524fe8b5ac

From noreply at github.com  Mon Jan 26 23:05:31 2015
From: noreply at github.com (GitHub)
Date: Mon, 26 Jan 2015 15:05:31 -0800
Subject: [lxc-devel] [lxc/lxc]
Message-ID: <54c6c83b4a994_6fbd3fa036c252c07093d@hookshot-fe5-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/lxc/master
  Home:   https://github.com/lxc/lxc

From noreply at github.com  Mon Jan 26 23:05:47 2015
From: noreply at github.com (GitHub)
Date: Mon, 26 Jan 2015 15:05:47 -0800
Subject: [lxc-devel] [lxc/lxc]
Message-ID: <54c6c84b3707a_785e3f99ccd8d2b83882b@hookshot-fe2-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/stgraber/new-cmd
  Home:   https://github.com/lxc/lxc

From noreply at github.com  Mon Jan 26 23:05:43 2015
From: noreply at github.com (GitHub)
Date: Mon, 26 Jan 2015 15:05:43 -0800
Subject: [lxc-devel] [lxc/lxc]
Message-ID: <54c6c84769192_1d373f93d3a7d2c08207c@hookshot-fe1-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/stgraber/master
  Home:   https://github.com/lxc/lxc

From noreply at github.com  Mon Jan 26 23:05:34 2015
From: noreply at github.com (GitHub)
Date: Mon, 26 Jan 2015 15:05:34 -0800
Subject: [lxc-devel] [lxc/lxc]
Message-ID: <54c6c83e61b2d_35323ff8bc3112b8372f0@hookshot-fe6-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/lxc/stable-1.0
  Home:   https://github.com/lxc/lxc

From noreply at github.com  Mon Jan 26 23:05:38 2015
From: noreply at github.com (GitHub)
Date: Mon, 26 Jan 2015 15:05:38 -0800
Subject: [lxc-devel] [lxc/lxc]
Message-ID: <54c6c84277a83_7b3a3fe0831932c033110@hookshot-fe5-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/lxc/stable-0.7.4
  Home:   https://github.com/lxc/lxc

From noreply at github.com  Mon Jan 26 23:06:07 2015
From: noreply at github.com (GitHub)
Date: Mon, 26 Jan 2015 15:06:07 -0800
Subject: [lxc-devel] [lxc/lxc] adc1f9: change version to 1.1.0.rc3 in
	configure.ac
Message-ID: <54c6c85f7c770_2b1f3ffbecf032a039733@hookshot-fe5-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: adc1f9185f87d18dedfd322ecf9e6fde310b64ca
      https://github.com/lxc/lxc/commit/adc1f9185f87d18dedfd322ecf9e6fde310b64ca
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-26 (Mon, 26 Jan 2015)

  Changed paths:
    M configure.ac

  Log Message:
  -----------
  change version to 1.1.0.rc3 in configure.ac

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>



From stgraber at ubuntu.com  Mon Jan 26 23:11:54 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Mon, 26 Jan 2015 18:11:54 -0500
Subject: [lxc-devel] [lxc/lxc] adc1f9: change version to 1.1.0.rc3 in
 configure.ac
In-Reply-To: <54c6c85f7c770_2b1f3ffbecf032a039733@hookshot-fe5-cp1-prd.iad.github.net.mail>
References: <54c6c85f7c770_2b1f3ffbecf032a039733@hookshot-fe5-cp1-prd.iad.github.net.mail>
Message-ID: <20150126231154.GA11343@castiana.ipv6.teksavvy.com>

On Mon, Jan 26, 2015 at 03:06:07PM -0800, GitHub wrote:
>   Branch: refs/heads/master
>   Home:   https://github.com/lxc/lxc
>   Commit: adc1f9185f87d18dedfd322ecf9e6fde310b64ca
>       https://github.com/lxc/lxc/commit/adc1f9185f87d18dedfd322ecf9e6fde310b64ca
>   Author: Stéphane Graber <stgraber at ubuntu.com>
>   Date:   2015-01-26 (Mon, 26 Jan 2015)
> 
>   Changed paths:
>     M configure.ac
> 
>   Log Message:
>   -----------
>   change version to 1.1.0.rc3 in configure.ac
> 
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Sorry about the mess, git push --all was a tad too efficient.

Anyway, rc3 has been tagged.


-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150126/2e3a1d19/attachment.sig>

From builds at travis-ci.org  Mon Jan 26 23:08:39 2015
From: builds at travis-ci.org (Travis CI)
Date: Mon, 26 Jan 2015 23:08:39 +0000
Subject: [lxc-devel] Errored: lxc/lxc#828 (lxc/stable-1.0 - 1c5ccb9)
In-Reply-To: <lxc/lxc+48413992+errored@travis-ci.org>
Message-ID: <54c6c8f696e10_31599b6c4541c8@41f98634-72da-4ce2-9421-cf8931d77e00.mail>

Build Update for lxc/lxc
-------------------------------------

Build: #828
Status: Errored

Duration: 36 seconds
Commit: 1c5ccb9 (lxc/stable-1.0)
Author: Stéphane Graber
Message: change version to 1.0.7 in configure.ac

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

View the changeset: https://github.com/lxc/lxc/compare/lxc/stable-1.0

View the full build log and details: https://travis-ci.org/lxc/lxc/builds/48413992

--

You can configure recipients for build notifications in your .travis.yml file. See http://docs.travis-ci.com/user/notifications



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150126/2e7fad45/attachment.html>

From builds at travis-ci.org  Mon Jan 26 23:08:53 2015
From: builds at travis-ci.org (Travis CI)
Date: Mon, 26 Jan 2015 23:08:53 +0000
Subject: [lxc-devel] Errored: lxc/lxc#828 (stgraber/master - 336a2ce)
In-Reply-To: <lxc/lxc+48413999+errored@travis-ci.org>
Message-ID: <54c6c905b798_3159b434454318@41f98634-72da-4ce2-9421-cf8931d77e00.mail>

Build Update for lxc/lxc
-------------------------------------

Build: #828
Status: Errored

Duration: 1 minute and 47 seconds
Commit: 336a2ce (stgraber/master)
Author: Stéphane Graber
Message: Set kmsg to 0 by default

It's now been proven over and over again that the symlink from /dev/kmsg
to /dev/console is harmful for everything but upstart systems. As Ubuntu
is now switching over to systemd too, lets switch the default.

Upstart users wishing to see boot messages can always set lxc.kmsg = 1
manually in their config (so long as they don't expect to then
dist-upgrade the container to systemd succesfuly).

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

View the changeset: https://github.com/lxc/lxc/compare/fd83dde5cb88^...336a2ce443f3

View the full build log and details: https://travis-ci.org/lxc/lxc/builds/48413999

--

You can configure recipients for build notifications in your .travis.yml file. See http://docs.travis-ci.com/user/notifications



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150126/136a62a3/attachment-0001.html>

From builds at travis-ci.org  Mon Jan 26 23:13:05 2015
From: builds at travis-ci.org (Travis CI)
Date: Mon, 26 Jan 2015 23:13:05 +0000
Subject: [lxc-devel] Passed: lxc/lxc#829 (lxc-1.1.0.rc3 - adc1f91)
In-Reply-To: <lxc/lxc+48414047+passed@travis-ci.org>
Message-ID: <54c6ca01470b8_31fb04d25779d5@ada50500-693b-469d-b875-c1dcdd76df79.mail>

Build Update for lxc/lxc
-------------------------------------

Build: #829
Status: Passed

Duration: 2 minutes and 57 seconds
Commit: adc1f91 (lxc-1.1.0.rc3)
Author: Stéphane Graber
Message: change version to 1.1.0.rc3 in configure.ac

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

View the changeset: https://github.com/lxc/lxc/compare/lxc-1.1.0.rc3

View the full build log and details: https://travis-ci.org/lxc/lxc/builds/48414047

--

You can configure recipients for build notifications in your .travis.yml file. See http://docs.travis-ci.com/user/notifications



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150126/27f7c8c4/attachment.html>

From builds at travis-ci.org  Mon Jan 26 23:12:52 2015
From: builds at travis-ci.org (Travis CI)
Date: Mon, 26 Jan 2015 23:12:52 +0000
Subject: [lxc-devel] Errored: lxc/lxc#828 (lxc/master - adc1f91)
In-Reply-To: <lxc/lxc+48413994+errored@travis-ci.org>
Message-ID: <54c6c9f2956a0_315b61b2456753@41f98634-72da-4ce2-9421-cf8931d77e00.mail>

Build Update for lxc/lxc
-------------------------------------

Build: #828
Status: Errored

Duration: 55 seconds
Commit: adc1f91 (lxc/master)
Author: Stéphane Graber
Message: change version to 1.1.0.rc3 in configure.ac

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

View the changeset: https://github.com/lxc/lxc/commit/adc1f9185f87

View the full build log and details: https://travis-ci.org/lxc/lxc/builds/48413994

--

You can configure recipients for build notifications in your .travis.yml file. See http://docs.travis-ci.com/user/notifications



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150126/aedd3210/attachment.html>

From builds at travis-ci.org  Mon Jan 26 23:12:55 2015
From: builds at travis-ci.org (Travis CI)
Date: Mon, 26 Jan 2015 23:12:55 +0000
Subject: [lxc-devel] Errored: lxc/lxc#828 (stgraber/new-cmd - fc524fe)
In-Reply-To: <lxc/lxc+48414000+errored@travis-ci.org>
Message-ID: <54c6c9f639210_31fad860576738@ada50500-693b-469d-b875-c1dcdd76df79.mail>

Build Update for lxc/lxc
-------------------------------------

Build: #828
Status: Errored

Duration: 57 seconds
Commit: fc524fe (stgraber/new-cmd)
Author: Serge Hallyn
Message: typo fix - s/args.passwd/args.password/

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

View the changeset: https://github.com/lxc/lxc/compare/57d3214ccbbc^...fc524fe8b5ac

View the full build log and details: https://travis-ci.org/lxc/lxc/builds/48414000

--

You can configure recipients for build notifications in your .travis.yml file. See http://docs.travis-ci.com/user/notifications


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150126/e6389306/attachment-0001.html>

From karma at jazz.email.ne.jp  Tue Jan 27 05:49:24 2015
From: karma at jazz.email.ne.jp (KATOH Yasufumi)
Date: Tue, 27 Jan 2015 14:49:24 +0900
Subject: [lxc-devel] [PATCH] Change the default value of kmsg and autodev in
	Japanese man
Message-ID: <1422337764-21054-1-git-send-email-karma@jazz.email.ne.jp>

Update Japanese lxc.container.conf(5) for commit 124fa0a and d89de23.

Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>
---
 doc/ja/lxc.container.conf.sgml.in | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/doc/ja/lxc.container.conf.sgml.in b/doc/ja/lxc.container.conf.sgml.in
index 4d38c8e..afdd31e 100644
--- a/doc/ja/lxc.container.conf.sgml.in
+++ b/doc/ja/lxc.container.conf.sgml.in
@@ -916,10 +916,10 @@ by KATOH Yasufumi <karma at jazz.email.ne.jp>
 	  <listitem>
 	    <para>
               <!--
-	      Set this to 1 to have LXC mount and populate a minimal
-	      <filename>/dev</filename> when starting the container.
+              Set this to 0 to stop LXC from mounting and populating a minimal
+              <filename>/dev</filename> when starting the container.
               -->
-              コンテナの起動時に LXC が /dev をマウントして、最小限の /dev を作成しているようにするには、これを 1 に設定してください。
+              コンテナの起動時に LXC が /dev をマウントして最小限の /dev を作成するのを止めるには、この値を 0 に設定してください。
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -930,9 +930,9 @@ by KATOH Yasufumi <karma at jazz.email.ne.jp>
       <title><!-- Enable kmsg symlink -->kmsg のシンボリックリンクの有効化</title>
       <para>
         <!--
-      Enable creating /dev/kmsg as symlink to /dev/console.  This defaults to 1.
-      -->
-        /dev/kmsg の /dev/console へのシンボリックリンクとしての作成を有効にします。デフォルトは 1 です。
+        Enable creating /dev/kmsg as symlink to /dev/console.  This defaults to 0.
+        -->
+        /dev/console へのシンボリックリンクとして /dev/kmsg を作成することを有効にします。デフォルトは 0 です。
       </para>
       <variablelist>
     <varlistentry>
@@ -942,9 +942,9 @@ by KATOH Yasufumi <karma at jazz.email.ne.jp>
       <listitem>
         <para>
           <!--
-          Set this to 0 to disable /dev/kmsg symlinking.
+          Set this to 1 to enable /dev/kmsg symlinking.
           -->
-          /dev/kmsg のシンボリックリンクを無効にするには 0 を設定してください。
+          /dev/kmsg へのシンボリックリンクを有効にするには 1 を設定してください。
         </para>
       </listitem>
     </varlistentry>
-- 
2.2.1


From noreply at github.com  Tue Jan 27 08:07:53 2015
From: noreply at github.com (GitHub)
Date: Tue, 27 Jan 2015 00:07:53 -0800
Subject: [lxc-devel] [lxc/lxc] a9516f: Change the default value of kmsg and
 autodev in Ja...
Message-ID: <54c747598f7f5_7f5b3fc24af412c024913@hookshot-fe2-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: a9516fe57f806adaf5111564c7084e4d8fca9a94
      https://github.com/lxc/lxc/commit/a9516fe57f806adaf5111564c7084e4d8fca9a94
  Author: KATOH Yasufumi <karma at jazz.email.ne.jp>
  Date:   2015-01-27 (Tue, 27 Jan 2015)

  Changed paths:
    M doc/ja/lxc.container.conf.sgml.in

  Log Message:
  -----------
  Change the default value of kmsg and autodev in Japanese man

Update Japanese lxc.container.conf(5) for commit 124fa0a and d89de23.

Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>



From stgraber at ubuntu.com  Tue Jan 27 08:08:15 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Tue, 27 Jan 2015 08:08:15 +0000
Subject: [lxc-devel] [PATCH] Change the default value of kmsg and
 autodev in Japanese man
In-Reply-To: <1422337764-21054-1-git-send-email-karma@jazz.email.ne.jp>
References: <1422337764-21054-1-git-send-email-karma@jazz.email.ne.jp>
Message-ID: <20150127080815.GB11343@castiana.ipv6.teksavvy.com>

On Tue, Jan 27, 2015 at 02:49:24PM +0900, KATOH Yasufumi wrote:
> Update Japanese lxc.container.conf(5) for commit 124fa0a and d89de23.
> 
> Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  doc/ja/lxc.container.conf.sgml.in | 16 ++++++++--------
>  1 file changed, 8 insertions(+), 8 deletions(-)
> 
> diff --git a/doc/ja/lxc.container.conf.sgml.in b/doc/ja/lxc.container.conf.sgml.in
> index 4d38c8e..afdd31e 100644
> --- a/doc/ja/lxc.container.conf.sgml.in
> +++ b/doc/ja/lxc.container.conf.sgml.in
> @@ -916,10 +916,10 @@ by KATOH Yasufumi <karma at jazz.email.ne.jp>
>  	  <listitem>
>  	    <para>
>                <!--
> -	      Set this to 1 to have LXC mount and populate a minimal
> -	      <filename>/dev</filename> when starting the container.
> +              Set this to 0 to stop LXC from mounting and populating a minimal
> +              <filename>/dev</filename> when starting the container.
>                -->
> -              コンテナの起動時に LXC が /dev をマウントして、最小限の /dev を作成しているようにするには、これを 1 に設定してください。
> +              コンテナの起動時に LXC が /dev をマウントして最小限の /dev を作成するのを止めるには、この値を 0 に設定してください。
>  	    </para>
>  	  </listitem>
>  	</varlistentry>
> @@ -930,9 +930,9 @@ by KATOH Yasufumi <karma at jazz.email.ne.jp>
>        <title><!-- Enable kmsg symlink -->kmsg のシンボリックリンクの有効化</title>
>        <para>
>          <!--
> -      Enable creating /dev/kmsg as symlink to /dev/console.  This defaults to 1.
> -      -->
> -        /dev/kmsg の /dev/console へのシンボリックリンクとしての作成を有効にします。デフォルトは 1 です。
> +        Enable creating /dev/kmsg as symlink to /dev/console.  This defaults to 0.
> +        -->
> +        /dev/console へのシンボリックリンクとして /dev/kmsg を作成することを有効にします。デフォルトは 0 です。
>        </para>
>        <variablelist>
>      <varlistentry>
> @@ -942,9 +942,9 @@ by KATOH Yasufumi <karma at jazz.email.ne.jp>
>        <listitem>
>          <para>
>            <!--
> -          Set this to 0 to disable /dev/kmsg symlinking.
> +          Set this to 1 to enable /dev/kmsg symlinking.
>            -->
> -          /dev/kmsg のシンボリックリンクを無効にするには 0 を設定してください。
> +          /dev/kmsg へのシンボリックリンクを有効にするには 1 を設定してください。
>          </para>
>        </listitem>
>      </varlistentry>
> -- 
> 2.2.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150127/04080120/attachment.sig>

From noreply at github.com  Tue Jan 27 09:33:28 2015
From: noreply at github.com (GitHub)
Date: Tue, 27 Jan 2015 01:33:28 -0800
Subject: [lxc-devel] [lxc/lxc] cfe615: fix busybox unpriv
Message-ID: <54c75b688f3c0_5ca43fe09a7ff2a0396f4@hookshot-fe4-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: cfe615f031f0ea48d6f725f72c8109573828d0f6
      https://github.com/lxc/lxc/commit/cfe615f031f0ea48d6f725f72c8109573828d0f6
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-27 (Tue, 27 Jan 2015)

  Changed paths:
    M templates/lxc-busybox.in

  Log Message:
  -----------
  fix busybox unpriv

1. tty5 is not needed
2. the devices should be optional in case they didn't exist in the
host / parent-container
3. switch from 'touch $rootfs/dev/$dev' to using create=file in the
mount entry.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: b04c281f10b12c74fb3ae161acc10b070602201c
      https://github.com/lxc/lxc/commit/b04c281f10b12c74fb3ae161acc10b070602201c
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-27 (Tue, 27 Jan 2015)

  Changed paths:
    M templates/lxc-busybox.in

  Log Message:
  -----------
  Merge pull request #420 from hallyn/fixbusybox.1

fix busybox unpriv


Compare: https://github.com/lxc/lxc/compare/a9516fe57f80...b04c281f10b1

From karma at jazz.email.ne.jp  Tue Jan 27 09:48:14 2015
From: karma at jazz.email.ne.jp (KATOH Yasufumi)
Date: Tue, 27 Jan 2015 18:48:14 +0900
Subject: [lxc-devel] [PATCH] lxc-plamo: Set lxc.autodev to 0
Message-ID: <1422352094-14514-1-git-send-email-karma@jazz.email.ne.jp>

At this time, a container that is created by lxc-plamo can't work with
lxc.autodev=1

Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>
---
 config/templates/plamo.common.conf.in | 3 +++
 config/templates/plamo.userns.conf.in | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/config/templates/plamo.common.conf.in b/config/templates/plamo.common.conf.in
index 22d9207..9b0d02b 100644
--- a/config/templates/plamo.common.conf.in
+++ b/config/templates/plamo.common.conf.in
@@ -8,6 +8,9 @@ lxc.mount.entry = none dev/shm tmpfs nosuid,nodev,noexec,mode=1777 0 0
 # Doesn't support consoles in /dev/lxc/
 lxc.devttydir =
 
+# /dev/* is created manually by template
+lxc.autodev = 0
+
 # Extra cgroup device access
 ## rtc
 lxc.cgroup.devices.allow = c 254:0 rm
diff --git a/config/templates/plamo.userns.conf.in b/config/templates/plamo.userns.conf.in
index 707bb30..bf50936 100644
--- a/config/templates/plamo.userns.conf.in
+++ b/config/templates/plamo.userns.conf.in
@@ -1,2 +1,5 @@
 # This derives from the global userns config
 lxc.include = @LXCTEMPLATECONFIG@/userns.conf
+
+# /dev/* is created manually by template
+lxc.autodev = 0
\ No newline at end of file
-- 
2.2.1


From stgraber at ubuntu.com  Tue Jan 27 09:59:17 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Tue, 27 Jan 2015 09:59:17 +0000
Subject: [lxc-devel] [PATCH] lxc-plamo: Set lxc.autodev to 0
In-Reply-To: <1422352094-14514-1-git-send-email-karma@jazz.email.ne.jp>
References: <1422352094-14514-1-git-send-email-karma@jazz.email.ne.jp>
Message-ID: <20150127095917.GC11343@castiana.ipv6.teksavvy.com>

On Tue, Jan 27, 2015 at 06:48:14PM +0900, KATOH Yasufumi wrote:
> At this time, a container that is created by lxc-plamo can't work with
> lxc.autodev=1
> 
> Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>

So the distro has no /dev population script at boot time?

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  config/templates/plamo.common.conf.in | 3 +++
>  config/templates/plamo.userns.conf.in | 3 +++
>  2 files changed, 6 insertions(+)
> 
> diff --git a/config/templates/plamo.common.conf.in b/config/templates/plamo.common.conf.in
> index 22d9207..9b0d02b 100644
> --- a/config/templates/plamo.common.conf.in
> +++ b/config/templates/plamo.common.conf.in
> @@ -8,6 +8,9 @@ lxc.mount.entry = none dev/shm tmpfs nosuid,nodev,noexec,mode=1777 0 0
>  # Doesn't support consoles in /dev/lxc/
>  lxc.devttydir =
>  
> +# /dev/* is created manually by template
> +lxc.autodev = 0
> +
>  # Extra cgroup device access
>  ## rtc
>  lxc.cgroup.devices.allow = c 254:0 rm
> diff --git a/config/templates/plamo.userns.conf.in b/config/templates/plamo.userns.conf.in
> index 707bb30..bf50936 100644
> --- a/config/templates/plamo.userns.conf.in
> +++ b/config/templates/plamo.userns.conf.in
> @@ -1,2 +1,5 @@
>  # This derives from the global userns config
>  lxc.include = @LXCTEMPLATECONFIG@/userns.conf
> +
> +# /dev/* is created manually by template
> +lxc.autodev = 0
> \ No newline at end of file
> -- 
> 2.2.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150127/4fd9a033/attachment.sig>

From noreply at github.com  Tue Jan 27 09:59:49 2015
From: noreply at github.com (GitHub)
Date: Tue, 27 Jan 2015 01:59:49 -0800
Subject: [lxc-devel] [lxc/lxc] 93f28e: lxc-plamo: Set lxc.autodev to 0
Message-ID: <54c76195c59f3_6143fa85cc3f2a0980ab@hookshot-fe2-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 93f28e2bcdf49f6309414e1167ea6f9e9d7ea8cc
      https://github.com/lxc/lxc/commit/93f28e2bcdf49f6309414e1167ea6f9e9d7ea8cc
  Author: KATOH Yasufumi <karma at jazz.email.ne.jp>
  Date:   2015-01-27 (Tue, 27 Jan 2015)

  Changed paths:
    M config/templates/plamo.common.conf.in
    M config/templates/plamo.userns.conf.in

  Log Message:
  -----------
  lxc-plamo: Set lxc.autodev to 0

At this time, a container that is created by lxc-plamo can't work with
lxc.autodev=1

Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>



From karma at jazz.email.ne.jp  Tue Jan 27 11:00:36 2015
From: karma at jazz.email.ne.jp (KATOH Yasufumi)
Date: Tue, 27 Jan 2015 20:00:36 +0900
Subject: [lxc-devel] [PATCH] lxc-plamo: Set lxc.autodev to 0
In-Reply-To: <20150127095917.GC11343@castiana.ipv6.teksavvy.com>
References: <1422352094-14514-1-git-send-email-karma@jazz.email.ne.jp>	<20150127095917.GC11343@castiana.ipv6.teksavvy.com>
Message-ID: <87egqg7ajv.wl%karma@jazz.email.ne.jp>

Hi,

Sorry. lxc.autodev=0 in plamo.userns.conf do not need (it is set in
plamo.common.conf). I send the patch later.

>>> On Tue, 27 Jan 2015 09:59:17 +0000
    in message   "Re: [lxc-devel] [PATCH] lxc-plamo: Set lxc.autodev to 0"
                  Stéphane Graber-san wrote:

> [1  <multipart/signed (7bit)>]
> [1.1  <text/plain; iso-8859-1 (quoted-printable)>]
> On Tue, Jan 27, 2015 at 06:48:14PM +0900, KATOH Yasufumi wrote:
> > At this time, a container that is created by lxc-plamo can't work with
> > lxc.autodev=1
> > 
> > Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>

> So the distro has no /dev population script at boot time?

When set lxc.autodev to 1, the container does not start with the
following error:

lxc-start 1422355446.738 ERROR    lxc_conf - conf.c:mount_entry:1672 - No such file or directory - failed to mount 'none' on '/usr/lib64/lxc/rootfs/dev/shm'


From karma at jazz.email.ne.jp  Tue Jan 27 11:54:17 2015
From: karma at jazz.email.ne.jp (KATOH Yasufumi)
Date: Tue, 27 Jan 2015 20:54:17 +0900
Subject: [lxc-devel] [PATCH] lxc-plamo: remove unnecessary lxc.autodev=0
Message-ID: <1422359657-22702-1-git-send-email-karma@jazz.email.ne.jp>

It is set in plamo.common.conf, so it do not need in plamo.userns.conf

Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>
---
 config/templates/plamo.userns.conf.in | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/config/templates/plamo.userns.conf.in b/config/templates/plamo.userns.conf.in
index bf50936..707bb30 100644
--- a/config/templates/plamo.userns.conf.in
+++ b/config/templates/plamo.userns.conf.in
@@ -1,5 +1,2 @@
 # This derives from the global userns config
 lxc.include = @LXCTEMPLATECONFIG@/userns.conf
-
-# /dev/* is created manually by template
-lxc.autodev = 0
\ No newline at end of file
-- 
2.2.1


From stgraber at ubuntu.com  Tue Jan 27 13:27:19 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Tue, 27 Jan 2015 13:27:19 +0000
Subject: [lxc-devel] [PATCH] lxc-plamo: remove unnecessary lxc.autodev=0
In-Reply-To: <1422359657-22702-1-git-send-email-karma@jazz.email.ne.jp>
References: <1422359657-22702-1-git-send-email-karma@jazz.email.ne.jp>
Message-ID: <20150127132719.GD11343@castiana.ipv6.teksavvy.com>

On Tue, Jan 27, 2015 at 08:54:17PM +0900, KATOH Yasufumi wrote:
> It is set in plamo.common.conf, so it do not need in plamo.userns.conf
> 
> Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  config/templates/plamo.userns.conf.in | 3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/config/templates/plamo.userns.conf.in b/config/templates/plamo.userns.conf.in
> index bf50936..707bb30 100644
> --- a/config/templates/plamo.userns.conf.in
> +++ b/config/templates/plamo.userns.conf.in
> @@ -1,5 +1,2 @@
>  # This derives from the global userns config
>  lxc.include = @LXCTEMPLATECONFIG@/userns.conf
> -
> -# /dev/* is created manually by template
> -lxc.autodev = 0
> \ No newline at end of file
> -- 
> 2.2.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150127/bd15b0bf/attachment.sig>

From noreply at github.com  Tue Jan 27 13:40:22 2015
From: noreply at github.com (GitHub)
Date: Tue, 27 Jan 2015 05:40:22 -0800
Subject: [lxc-devel] [lxc/lxc] b340ea: lxc-plamo: remove unnecessary
	lxc.autodev=0
Message-ID: <54c79546a2bd6_20df3fc06f2752bc243de@hookshot-fe6-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: b340eab85829bd58914ceb6d42e12e094d60fc57
      https://github.com/lxc/lxc/commit/b340eab85829bd58914ceb6d42e12e094d60fc57
  Author: KATOH Yasufumi <karma at jazz.email.ne.jp>
  Date:   2015-01-27 (Tue, 27 Jan 2015)

  Changed paths:
    M config/templates/plamo.userns.conf.in

  Log Message:
  -----------
  lxc-plamo: remove unnecessary lxc.autodev=0

It is set in plamo.common.conf, so it do not need in plamo.userns.conf

Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>



From stgraber at ubuntu.com  Tue Jan 27 17:05:57 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Tue, 27 Jan 2015 18:05:57 +0100
Subject: [lxc-devel] [PATCH] Only use clear_config_item for lists
Message-ID: <1422378357-11601-1-git-send-email-stgraber@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 src/python-lxc/lxc/__init__.py | 8 ++++++--
 src/tests/get_item.c           | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/python-lxc/lxc/__init__.py b/src/python-lxc/lxc/__init__.py
index 47b25b8..d7b0670 100644
--- a/src/python-lxc/lxc/__init__.py
+++ b/src/python-lxc/lxc/__init__.py
@@ -97,8 +97,12 @@ class ContainerNetwork(object):
         return self.__set_network_item(self.props[key], value)
 
     def __clear_network_item(self, key):
-        return self.container.clear_config_item("lxc.network.%s.%s" % (
-                                                self.index, key))
+        if key in ("ipv4", "ipv6"):
+            return self.container.clear_config_item("lxc.network.%s.%s" % (
+                                                    self.index, key))
+        else:
+            return self.container.set_config_item("lxc.network.%s.%s" % (
+                                                    self.index, key), "")
 
     def __get_network_item(self, key):
         return self.container.get_config_item("lxc.network.%s.%s" % (
diff --git a/src/tests/get_item.c b/src/tests/get_item.c
index abf50e8..943583c 100644
--- a/src/tests/get_item.c
+++ b/src/tests/get_item.c
@@ -249,7 +249,7 @@ int main(int argc, char *argv[])
 		ret = 1;
 		goto out;
 	}
-	if (!c->clear_config_item(c, "lxc.network.0.ipv4.gateway")) {
+	if (!c->set_config_item(c, "lxc.network.0.ipv4.gateway", "")) {
 		fprintf(stderr, "%d: failed clearing ipv4.gateway\n", __LINE__);
 		ret = 1;
 		goto out;
-- 
1.9.1


From serge.hallyn at ubuntu.com  Tue Jan 27 20:35:10 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Tue, 27 Jan 2015 20:35:10 +0000
Subject: [lxc-devel] [PATCH] Only use clear_config_item for lists
In-Reply-To: <1422378357-11601-1-git-send-email-stgraber@ubuntu.com>
References: <1422378357-11601-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150127203510.GH7540@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  src/python-lxc/lxc/__init__.py | 8 ++++++--
>  src/tests/get_item.c           | 2 +-
>  2 files changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/src/python-lxc/lxc/__init__.py b/src/python-lxc/lxc/__init__.py
> index 47b25b8..d7b0670 100644
> --- a/src/python-lxc/lxc/__init__.py
> +++ b/src/python-lxc/lxc/__init__.py
> @@ -97,8 +97,12 @@ class ContainerNetwork(object):
>          return self.__set_network_item(self.props[key], value)
>  
>      def __clear_network_item(self, key):
> -        return self.container.clear_config_item("lxc.network.%s.%s" % (
> -                                                self.index, key))
> +        if key in ("ipv4", "ipv6"):
> +            return self.container.clear_config_item("lxc.network.%s.%s" % (
> +                                                    self.index, key))
> +        else:
> +            return self.container.set_config_item("lxc.network.%s.%s" % (
> +                                                    self.index, key), "")
>  
>      def __get_network_item(self, key):
>          return self.container.get_config_item("lxc.network.%s.%s" % (
> diff --git a/src/tests/get_item.c b/src/tests/get_item.c
> index abf50e8..943583c 100644
> --- a/src/tests/get_item.c
> +++ b/src/tests/get_item.c
> @@ -249,7 +249,7 @@ int main(int argc, char *argv[])
>  		ret = 1;
>  		goto out;
>  	}
> -	if (!c->clear_config_item(c, "lxc.network.0.ipv4.gateway")) {
> +	if (!c->set_config_item(c, "lxc.network.0.ipv4.gateway", "")) {
>  		fprintf(stderr, "%d: failed clearing ipv4.gateway\n", __LINE__);
>  		ret = 1;
>  		goto out;
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Tue Jan 27 20:48:25 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Tue, 27 Jan 2015 20:48:25 +0000
Subject: [lxc-devel] [PATCH 1/1] systemd: specify container_ttys in
	environment
Message-ID: <20150127204825.GJ7540@ubuntumail>

The lxc.tty configuration item specifies a number of ttys to create.
Historically, for each of those, we create a /dev/pts/N entry and
symlink it to /dev/ttyN for older inits to use.  For systemd, we should
instead specify each tty name in a $container_ttys environment variable
passed to init.

See http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/ and
https://github.com/lxc/lxc/issues/419.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/conf.c  | 43 ++++++++++++++++++++++++++++++++++++++++---
 src/lxc/conf.h  |  1 +
 src/lxc/start.c |  8 +++++---
 3 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index c7db06f..da4a928 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -943,9 +943,34 @@ static int setup_dev_symlinks(const struct lxc_rootfs *rootfs)
 	return 0;
 }
 
-static int setup_tty(const struct lxc_rootfs *rootfs,
-		     const struct lxc_tty_info *tty_info, char *ttydir)
+/*
+ * Build a space-separate list of ptys to pass to systemd.
+ */
+static bool append_ptyname(char **pp, char *name)
 {
+	char *p;
+
+	if (!*pp) {
+		*pp = malloc(strlen(name) + strlen("container_ttys=") + 1);
+		if (!*pp)
+			return false;
+		sprintf(*pp, "container_ttys=%s", name);
+		return true;
+	}
+	p = realloc(*pp, strlen(*pp) + strlen(name) + 2);
+	if (!p)
+		return false;
+	*pp = p;
+	strcat(p, " ");
+	strcat(p, name);
+	return true;
+}
+
+static int setup_tty(struct lxc_conf *conf)
+{
+	const struct lxc_rootfs *rootfs = &conf->rootfs;
+	const struct lxc_tty_info *tty_info = &conf->tty_info;
+	char *ttydir = conf->ttydir;
 	char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
 	int i, ret;
 
@@ -999,6 +1024,8 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
 				SYSERROR("failed to create symlink for tty %d", i+1);
 				return -1;
 			}
+			/* Now save the relative path in @path for append_ptyname */
+			sprintf(path, "%s/tty%d", ttydir, i + 1);
 		} else {
 			/* If we populated /dev, then we need to create /dev/ttyN */
 			if (access(path, F_OK)) {
@@ -1015,6 +1042,12 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
 						pty_info->name, path);
 				continue;
 			}
+			/* Now save the relative path in @path for append_ptyname */
+			sprintf(path, "tty%d", i + 1);
+		}
+		if (!append_ptyname(&conf->pty_names, path)) {
+			ERROR("Error setting up container_ttys string");
+			return -1;
 		}
 	}
 
@@ -3794,11 +3827,14 @@ int lxc_setup(struct lxc_handler *handler)
 			ERROR("failed to setup kmsg for '%s'", name);
 	}
 
-	if (!lxc_conf->is_execute && setup_tty(&lxc_conf->rootfs, &lxc_conf->tty_info, lxc_conf->ttydir)) {
+	if (!lxc_conf->is_execute && setup_tty(lxc_conf)) {
 		ERROR("failed to setup the ttys for '%s'", name);
 		return -1;
 	}
 
+	if (lxc_conf->pty_names && setenv("container_ttys", lxc_conf->pty_names, 1))
+		SYSERROR("failed to set environment variable for container ptys");
+
 	if (!lxc_conf->is_execute && setup_dev_symlinks(&lxc_conf->rootfs)) {
 		ERROR("failed to setup /dev symlinks for '%s'", name);
 		return -1;
@@ -4172,6 +4208,7 @@ void lxc_conf_free(struct lxc_conf *conf)
 	free(conf->rcfile);
 	free(conf->init_cmd);
 	free(conf->unexpanded_config);
+	free(conf->pty_names);
 	lxc_clear_config_network(conf);
 	free(conf->lsm_aa_profile);
 	free(conf->lsm_se_context);
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 09065a1..8ec3e8e 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -304,6 +304,7 @@ struct lxc_conf {
 	struct lxc_list caps;
 	struct lxc_list keepcaps;
 	struct lxc_tty_info tty_info;
+	char *pty_names; // comma-separated list of lxc.tty pty names
 	struct lxc_console console;
 	struct lxc_rootfs rootfs;
 	char *ttydir;
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 161e4c0..b2c9424 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -745,9 +745,11 @@ static int do_start(void *data)
 		}
 	}
 
-	if (putenv("container=lxc")) {
-		SYSERROR("failed to set environment variable 'container=lxc'");
-		goto out_warn_father;
+	if (handler->conf->pty_names) {
+		if (putenv(handler->conf->pty_names)) {
+			SYSERROR("failed to set environment variable for container ptys");
+			goto out_warn_father;
+		}
 	}
 
 	close(handler->sigfd);
-- 
2.1.0


From stgraber at ubuntu.com  Tue Jan 27 20:53:52 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Tue, 27 Jan 2015 21:53:52 +0100
Subject: [lxc-devel] [PATCH 1/1] systemd: specify container_ttys in
 environment
In-Reply-To: <20150127204825.GJ7540@ubuntumail>
References: <20150127204825.GJ7540@ubuntumail>
Message-ID: <20150127205352.GA14174@castiana.ipv6.teksavvy.com>

On Tue, Jan 27, 2015 at 08:48:25PM +0000, Serge Hallyn wrote:
> The lxc.tty configuration item specifies a number of ttys to create.
> Historically, for each of those, we create a /dev/pts/N entry and
> symlink it to /dev/ttyN for older inits to use.  For systemd, we should
> instead specify each tty name in a $container_ttys environment variable
> passed to init.
> 
> See http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/ and
> https://github.com/lxc/lxc/issues/419.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> ---
>  src/lxc/conf.c  | 43 ++++++++++++++++++++++++++++++++++++++++---
>  src/lxc/conf.h  |  1 +
>  src/lxc/start.c |  8 +++++---
>  3 files changed, 46 insertions(+), 6 deletions(-)
> 
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index c7db06f..da4a928 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -943,9 +943,34 @@ static int setup_dev_symlinks(const struct lxc_rootfs *rootfs)
>  	return 0;
>  }
>  
> -static int setup_tty(const struct lxc_rootfs *rootfs,
> -		     const struct lxc_tty_info *tty_info, char *ttydir)
> +/*
> + * Build a space-separate list of ptys to pass to systemd.
> + */
> +static bool append_ptyname(char **pp, char *name)
>  {
> +	char *p;
> +
> +	if (!*pp) {
> +		*pp = malloc(strlen(name) + strlen("container_ttys=") + 1);
> +		if (!*pp)
> +			return false;
> +		sprintf(*pp, "container_ttys=%s", name);
> +		return true;
> +	}
> +	p = realloc(*pp, strlen(*pp) + strlen(name) + 2);
> +	if (!p)
> +		return false;
> +	*pp = p;
> +	strcat(p, " ");
> +	strcat(p, name);
> +	return true;
> +}
> +
> +static int setup_tty(struct lxc_conf *conf)
> +{
> +	const struct lxc_rootfs *rootfs = &conf->rootfs;
> +	const struct lxc_tty_info *tty_info = &conf->tty_info;
> +	char *ttydir = conf->ttydir;
>  	char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
>  	int i, ret;
>  
> @@ -999,6 +1024,8 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
>  				SYSERROR("failed to create symlink for tty %d", i+1);
>  				return -1;
>  			}
> +			/* Now save the relative path in @path for append_ptyname */
> +			sprintf(path, "%s/tty%d", ttydir, i + 1);
>  		} else {
>  			/* If we populated /dev, then we need to create /dev/ttyN */
>  			if (access(path, F_OK)) {
> @@ -1015,6 +1042,12 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
>  						pty_info->name, path);
>  				continue;
>  			}
> +			/* Now save the relative path in @path for append_ptyname */
> +			sprintf(path, "tty%d", i + 1);
> +		}
> +		if (!append_ptyname(&conf->pty_names, path)) {
> +			ERROR("Error setting up container_ttys string");
> +			return -1;
>  		}
>  	}
>  
> @@ -3794,11 +3827,14 @@ int lxc_setup(struct lxc_handler *handler)
>  			ERROR("failed to setup kmsg for '%s'", name);
>  	}
>  
> -	if (!lxc_conf->is_execute && setup_tty(&lxc_conf->rootfs, &lxc_conf->tty_info, lxc_conf->ttydir)) {
> +	if (!lxc_conf->is_execute && setup_tty(lxc_conf)) {
>  		ERROR("failed to setup the ttys for '%s'", name);
>  		return -1;
>  	}
>  
> +	if (lxc_conf->pty_names && setenv("container_ttys", lxc_conf->pty_names, 1))
> +		SYSERROR("failed to set environment variable for container ptys");
> +
>  	if (!lxc_conf->is_execute && setup_dev_symlinks(&lxc_conf->rootfs)) {
>  		ERROR("failed to setup /dev symlinks for '%s'", name);
>  		return -1;
> @@ -4172,6 +4208,7 @@ void lxc_conf_free(struct lxc_conf *conf)
>  	free(conf->rcfile);
>  	free(conf->init_cmd);
>  	free(conf->unexpanded_config);
> +	free(conf->pty_names);
>  	lxc_clear_config_network(conf);
>  	free(conf->lsm_aa_profile);
>  	free(conf->lsm_se_context);
> diff --git a/src/lxc/conf.h b/src/lxc/conf.h
> index 09065a1..8ec3e8e 100644
> --- a/src/lxc/conf.h
> +++ b/src/lxc/conf.h
> @@ -304,6 +304,7 @@ struct lxc_conf {
>  	struct lxc_list caps;
>  	struct lxc_list keepcaps;
>  	struct lxc_tty_info tty_info;
> +	char *pty_names; // comma-separated list of lxc.tty pty names
>  	struct lxc_console console;
>  	struct lxc_rootfs rootfs;
>  	char *ttydir;
> diff --git a/src/lxc/start.c b/src/lxc/start.c
> index 161e4c0..b2c9424 100644
> --- a/src/lxc/start.c
> +++ b/src/lxc/start.c
> @@ -745,9 +745,11 @@ static int do_start(void *data)
>  		}
>  	}
>  
> -	if (putenv("container=lxc")) {
> -		SYSERROR("failed to set environment variable 'container=lxc'");
> -		goto out_warn_father;

Why is that being removed?

> +	if (handler->conf->pty_names) {
> +		if (putenv(handler->conf->pty_names)) {
> +			SYSERROR("failed to set environment variable for container ptys");
> +			goto out_warn_father;
> +		}
>  	}
>  
>  	close(handler->sigfd);
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150127/de5d48ee/attachment.sig>

From serge.hallyn at ubuntu.com  Tue Jan 27 23:06:22 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Tue, 27 Jan 2015 23:06:22 +0000
Subject: [lxc-devel] [PATCH 1/1] systemd: specify container_ttys in
 environment
In-Reply-To: <20150127205352.GA14174@castiana.ipv6.teksavvy.com>
References: <20150127204825.GJ7540@ubuntumail>
 <20150127205352.GA14174@castiana.ipv6.teksavvy.com>
Message-ID: <20150127230622.GK7540@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> On Tue, Jan 27, 2015 at 08:48:25PM +0000, Serge Hallyn wrote:
> > The lxc.tty configuration item specifies a number of ttys to create.
> > Historically, for each of those, we create a /dev/pts/N entry and
> > symlink it to /dev/ttyN for older inits to use.  For systemd, we should
> > instead specify each tty name in a $container_ttys environment variable
> > passed to init.
> > 
> > See http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/ and
> > https://github.com/lxc/lxc/issues/419.
> > 
> > Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> > ---
> >  src/lxc/conf.c  | 43 ++++++++++++++++++++++++++++++++++++++++---
> >  src/lxc/conf.h  |  1 +
> >  src/lxc/start.c |  8 +++++---
> >  3 files changed, 46 insertions(+), 6 deletions(-)
> > 
> > diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> > index c7db06f..da4a928 100644
> > --- a/src/lxc/conf.c
> > +++ b/src/lxc/conf.c
> > @@ -943,9 +943,34 @@ static int setup_dev_symlinks(const struct lxc_rootfs *rootfs)
> >  	return 0;
> >  }
> >  
> > -static int setup_tty(const struct lxc_rootfs *rootfs,
> > -		     const struct lxc_tty_info *tty_info, char *ttydir)
> > +/*
> > + * Build a space-separate list of ptys to pass to systemd.
> > + */
> > +static bool append_ptyname(char **pp, char *name)
> >  {
> > +	char *p;
> > +
> > +	if (!*pp) {
> > +		*pp = malloc(strlen(name) + strlen("container_ttys=") + 1);
> > +		if (!*pp)
> > +			return false;
> > +		sprintf(*pp, "container_ttys=%s", name);
> > +		return true;
> > +	}
> > +	p = realloc(*pp, strlen(*pp) + strlen(name) + 2);
> > +	if (!p)
> > +		return false;
> > +	*pp = p;
> > +	strcat(p, " ");
> > +	strcat(p, name);
> > +	return true;
> > +}
> > +
> > +static int setup_tty(struct lxc_conf *conf)
> > +{
> > +	const struct lxc_rootfs *rootfs = &conf->rootfs;
> > +	const struct lxc_tty_info *tty_info = &conf->tty_info;
> > +	char *ttydir = conf->ttydir;
> >  	char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
> >  	int i, ret;
> >  
> > @@ -999,6 +1024,8 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
> >  				SYSERROR("failed to create symlink for tty %d", i+1);
> >  				return -1;
> >  			}
> > +			/* Now save the relative path in @path for append_ptyname */
> > +			sprintf(path, "%s/tty%d", ttydir, i + 1);
> >  		} else {
> >  			/* If we populated /dev, then we need to create /dev/ttyN */
> >  			if (access(path, F_OK)) {
> > @@ -1015,6 +1042,12 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
> >  						pty_info->name, path);
> >  				continue;
> >  			}
> > +			/* Now save the relative path in @path for append_ptyname */
> > +			sprintf(path, "tty%d", i + 1);
> > +		}
> > +		if (!append_ptyname(&conf->pty_names, path)) {
> > +			ERROR("Error setting up container_ttys string");
> > +			return -1;
> >  		}
> >  	}
> >  
> > @@ -3794,11 +3827,14 @@ int lxc_setup(struct lxc_handler *handler)
> >  			ERROR("failed to setup kmsg for '%s'", name);
> >  	}
> >  
> > -	if (!lxc_conf->is_execute && setup_tty(&lxc_conf->rootfs, &lxc_conf->tty_info, lxc_conf->ttydir)) {
> > +	if (!lxc_conf->is_execute && setup_tty(lxc_conf)) {
> >  		ERROR("failed to setup the ttys for '%s'", name);
> >  		return -1;
> >  	}
> >  
> > +	if (lxc_conf->pty_names && setenv("container_ttys", lxc_conf->pty_names, 1))
> > +		SYSERROR("failed to set environment variable for container ptys");
> > +
> >  	if (!lxc_conf->is_execute && setup_dev_symlinks(&lxc_conf->rootfs)) {
> >  		ERROR("failed to setup /dev symlinks for '%s'", name);
> >  		return -1;
> > @@ -4172,6 +4208,7 @@ void lxc_conf_free(struct lxc_conf *conf)
> >  	free(conf->rcfile);
> >  	free(conf->init_cmd);
> >  	free(conf->unexpanded_config);
> > +	free(conf->pty_names);
> >  	lxc_clear_config_network(conf);
> >  	free(conf->lsm_aa_profile);
> >  	free(conf->lsm_se_context);
> > diff --git a/src/lxc/conf.h b/src/lxc/conf.h
> > index 09065a1..8ec3e8e 100644
> > --- a/src/lxc/conf.h
> > +++ b/src/lxc/conf.h
> > @@ -304,6 +304,7 @@ struct lxc_conf {
> >  	struct lxc_list caps;
> >  	struct lxc_list keepcaps;
> >  	struct lxc_tty_info tty_info;
> > +	char *pty_names; // comma-separated list of lxc.tty pty names
> >  	struct lxc_console console;
> >  	struct lxc_rootfs rootfs;
> >  	char *ttydir;
> > diff --git a/src/lxc/start.c b/src/lxc/start.c
> > index 161e4c0..b2c9424 100644
> > --- a/src/lxc/start.c
> > +++ b/src/lxc/start.c
> > @@ -745,9 +745,11 @@ static int do_start(void *data)
> >  		}
> >  	}
> >  
> > -	if (putenv("container=lxc")) {
> > -		SYSERROR("failed to set environment variable 'container=lxc'");
> > -		goto out_warn_father;
> 
> Why is that being removed?

Oh I was just testing you.  yeah...

The "real" patch follows.  yeah.

Subject: [PATCH 1/1] systemd: specify container_ttys in environment

The lxc.tty configuration item specifies a number of ttys to create.
Historically, for each of those, we create a /dev/pts/N entry and
symlink it to /dev/ttyN for older inits to use.  For systemd, we should
instead specify each tty name in a $container_ttys environment variable
passed to init.

See http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/ and
https://github.com/lxc/lxc/issues/419.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/conf.c  | 43 ++++++++++++++++++++++++++++++++++++++++---
 src/lxc/conf.h  |  1 +
 src/lxc/start.c |  7 +++++++
 3 files changed, 48 insertions(+), 3 deletions(-)

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index c7db06f..da4a928 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -943,9 +943,34 @@ static int setup_dev_symlinks(const struct lxc_rootfs *rootfs)
 	return 0;
 }
 
-static int setup_tty(const struct lxc_rootfs *rootfs,
-		     const struct lxc_tty_info *tty_info, char *ttydir)
+/*
+ * Build a space-separate list of ptys to pass to systemd.
+ */
+static bool append_ptyname(char **pp, char *name)
 {
+	char *p;
+
+	if (!*pp) {
+		*pp = malloc(strlen(name) + strlen("container_ttys=") + 1);
+		if (!*pp)
+			return false;
+		sprintf(*pp, "container_ttys=%s", name);
+		return true;
+	}
+	p = realloc(*pp, strlen(*pp) + strlen(name) + 2);
+	if (!p)
+		return false;
+	*pp = p;
+	strcat(p, " ");
+	strcat(p, name);
+	return true;
+}
+
+static int setup_tty(struct lxc_conf *conf)
+{
+	const struct lxc_rootfs *rootfs = &conf->rootfs;
+	const struct lxc_tty_info *tty_info = &conf->tty_info;
+	char *ttydir = conf->ttydir;
 	char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
 	int i, ret;
 
@@ -999,6 +1024,8 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
 				SYSERROR("failed to create symlink for tty %d", i+1);
 				return -1;
 			}
+			/* Now save the relative path in @path for append_ptyname */
+			sprintf(path, "%s/tty%d", ttydir, i + 1);
 		} else {
 			/* If we populated /dev, then we need to create /dev/ttyN */
 			if (access(path, F_OK)) {
@@ -1015,6 +1042,12 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
 						pty_info->name, path);
 				continue;
 			}
+			/* Now save the relative path in @path for append_ptyname */
+			sprintf(path, "tty%d", i + 1);
+		}
+		if (!append_ptyname(&conf->pty_names, path)) {
+			ERROR("Error setting up container_ttys string");
+			return -1;
 		}
 	}
 
@@ -3794,11 +3827,14 @@ int lxc_setup(struct lxc_handler *handler)
 			ERROR("failed to setup kmsg for '%s'", name);
 	}
 
-	if (!lxc_conf->is_execute && setup_tty(&lxc_conf->rootfs, &lxc_conf->tty_info, lxc_conf->ttydir)) {
+	if (!lxc_conf->is_execute && setup_tty(lxc_conf)) {
 		ERROR("failed to setup the ttys for '%s'", name);
 		return -1;
 	}
 
+	if (lxc_conf->pty_names && setenv("container_ttys", lxc_conf->pty_names, 1))
+		SYSERROR("failed to set environment variable for container ptys");
+
 	if (!lxc_conf->is_execute && setup_dev_symlinks(&lxc_conf->rootfs)) {
 		ERROR("failed to setup /dev symlinks for '%s'", name);
 		return -1;
@@ -4172,6 +4208,7 @@ void lxc_conf_free(struct lxc_conf *conf)
 	free(conf->rcfile);
 	free(conf->init_cmd);
 	free(conf->unexpanded_config);
+	free(conf->pty_names);
 	lxc_clear_config_network(conf);
 	free(conf->lsm_aa_profile);
 	free(conf->lsm_se_context);
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 09065a1..8ec3e8e 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -304,6 +304,7 @@ struct lxc_conf {
 	struct lxc_list caps;
 	struct lxc_list keepcaps;
 	struct lxc_tty_info tty_info;
+	char *pty_names; // comma-separated list of lxc.tty pty names
 	struct lxc_console console;
 	struct lxc_rootfs rootfs;
 	char *ttydir;
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 161e4c0..1949886 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -750,6 +750,13 @@ static int do_start(void *data)
 		goto out_warn_father;
 	}
 
+	if (handler->conf->pty_names) {
+		if (putenv(handler->conf->pty_names)) {
+			SYSERROR("failed to set environment variable for container ptys");
+			goto out_warn_father;
+		}
+	}
+
 	close(handler->sigfd);
 
 	/* after this call, we are in error because this
-- 
2.1.0


From stgraber at ubuntu.com  Wed Jan 28 08:12:30 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Wed, 28 Jan 2015 09:12:30 +0100
Subject: [lxc-devel] [PATCH 1/1] systemd: specify container_ttys in
 environment
In-Reply-To: <20150127230622.GK7540@ubuntumail>
References: <20150127204825.GJ7540@ubuntumail>
 <20150127205352.GA14174@castiana.ipv6.teksavvy.com>
 <20150127230622.GK7540@ubuntumail>
Message-ID: <20150128081230.GB14174@castiana.ipv6.teksavvy.com>

On Tue, Jan 27, 2015 at 11:06:22PM +0000, Serge Hallyn wrote:
> Quoting Stéphane Graber (stgraber at ubuntu.com):
> > On Tue, Jan 27, 2015 at 08:48:25PM +0000, Serge Hallyn wrote:
> > > The lxc.tty configuration item specifies a number of ttys to create.
> > > Historically, for each of those, we create a /dev/pts/N entry and
> > > symlink it to /dev/ttyN for older inits to use.  For systemd, we should
> > > instead specify each tty name in a $container_ttys environment variable
> > > passed to init.
> > > 
> > > See http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/ and
> > > https://github.com/lxc/lxc/issues/419.
> > > 
> > > Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> > > ---
> > >  src/lxc/conf.c  | 43 ++++++++++++++++++++++++++++++++++++++++---
> > >  src/lxc/conf.h  |  1 +
> > >  src/lxc/start.c |  8 +++++---
> > >  3 files changed, 46 insertions(+), 6 deletions(-)
> > > 
> > > diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> > > index c7db06f..da4a928 100644
> > > --- a/src/lxc/conf.c
> > > +++ b/src/lxc/conf.c
> > > @@ -943,9 +943,34 @@ static int setup_dev_symlinks(const struct lxc_rootfs *rootfs)
> > >  	return 0;
> > >  }
> > >  
> > > -static int setup_tty(const struct lxc_rootfs *rootfs,
> > > -		     const struct lxc_tty_info *tty_info, char *ttydir)
> > > +/*
> > > + * Build a space-separate list of ptys to pass to systemd.
> > > + */
> > > +static bool append_ptyname(char **pp, char *name)
> > >  {
> > > +	char *p;
> > > +
> > > +	if (!*pp) {
> > > +		*pp = malloc(strlen(name) + strlen("container_ttys=") + 1);
> > > +		if (!*pp)
> > > +			return false;
> > > +		sprintf(*pp, "container_ttys=%s", name);
> > > +		return true;
> > > +	}
> > > +	p = realloc(*pp, strlen(*pp) + strlen(name) + 2);
> > > +	if (!p)
> > > +		return false;
> > > +	*pp = p;
> > > +	strcat(p, " ");
> > > +	strcat(p, name);
> > > +	return true;
> > > +}
> > > +
> > > +static int setup_tty(struct lxc_conf *conf)
> > > +{
> > > +	const struct lxc_rootfs *rootfs = &conf->rootfs;
> > > +	const struct lxc_tty_info *tty_info = &conf->tty_info;
> > > +	char *ttydir = conf->ttydir;
> > >  	char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
> > >  	int i, ret;
> > >  
> > > @@ -999,6 +1024,8 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
> > >  				SYSERROR("failed to create symlink for tty %d", i+1);
> > >  				return -1;
> > >  			}
> > > +			/* Now save the relative path in @path for append_ptyname */
> > > +			sprintf(path, "%s/tty%d", ttydir, i + 1);
> > >  		} else {
> > >  			/* If we populated /dev, then we need to create /dev/ttyN */
> > >  			if (access(path, F_OK)) {
> > > @@ -1015,6 +1042,12 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
> > >  						pty_info->name, path);
> > >  				continue;
> > >  			}
> > > +			/* Now save the relative path in @path for append_ptyname */
> > > +			sprintf(path, "tty%d", i + 1);
> > > +		}
> > > +		if (!append_ptyname(&conf->pty_names, path)) {
> > > +			ERROR("Error setting up container_ttys string");
> > > +			return -1;
> > >  		}
> > >  	}
> > >  
> > > @@ -3794,11 +3827,14 @@ int lxc_setup(struct lxc_handler *handler)
> > >  			ERROR("failed to setup kmsg for '%s'", name);
> > >  	}
> > >  
> > > -	if (!lxc_conf->is_execute && setup_tty(&lxc_conf->rootfs, &lxc_conf->tty_info, lxc_conf->ttydir)) {
> > > +	if (!lxc_conf->is_execute && setup_tty(lxc_conf)) {
> > >  		ERROR("failed to setup the ttys for '%s'", name);
> > >  		return -1;
> > >  	}
> > >  
> > > +	if (lxc_conf->pty_names && setenv("container_ttys", lxc_conf->pty_names, 1))
> > > +		SYSERROR("failed to set environment variable for container ptys");
> > > +
> > >  	if (!lxc_conf->is_execute && setup_dev_symlinks(&lxc_conf->rootfs)) {
> > >  		ERROR("failed to setup /dev symlinks for '%s'", name);
> > >  		return -1;
> > > @@ -4172,6 +4208,7 @@ void lxc_conf_free(struct lxc_conf *conf)
> > >  	free(conf->rcfile);
> > >  	free(conf->init_cmd);
> > >  	free(conf->unexpanded_config);
> > > +	free(conf->pty_names);
> > >  	lxc_clear_config_network(conf);
> > >  	free(conf->lsm_aa_profile);
> > >  	free(conf->lsm_se_context);
> > > diff --git a/src/lxc/conf.h b/src/lxc/conf.h
> > > index 09065a1..8ec3e8e 100644
> > > --- a/src/lxc/conf.h
> > > +++ b/src/lxc/conf.h
> > > @@ -304,6 +304,7 @@ struct lxc_conf {
> > >  	struct lxc_list caps;
> > >  	struct lxc_list keepcaps;
> > >  	struct lxc_tty_info tty_info;
> > > +	char *pty_names; // comma-separated list of lxc.tty pty names
> > >  	struct lxc_console console;
> > >  	struct lxc_rootfs rootfs;
> > >  	char *ttydir;
> > > diff --git a/src/lxc/start.c b/src/lxc/start.c
> > > index 161e4c0..b2c9424 100644
> > > --- a/src/lxc/start.c
> > > +++ b/src/lxc/start.c
> > > @@ -745,9 +745,11 @@ static int do_start(void *data)
> > >  		}
> > >  	}
> > >  
> > > -	if (putenv("container=lxc")) {
> > > -		SYSERROR("failed to set environment variable 'container=lxc'");
> > > -		goto out_warn_father;
> > 
> > Why is that being removed?
> 
> Oh I was just testing you.  yeah...
> 
> The "real" patch follows.  yeah.
> 
> Subject: [PATCH 1/1] systemd: specify container_ttys in environment
> 
> The lxc.tty configuration item specifies a number of ttys to create.
> Historically, for each of those, we create a /dev/pts/N entry and
> symlink it to /dev/ttyN for older inits to use.  For systemd, we should
> instead specify each tty name in a $container_ttys environment variable
> passed to init.
> 
> See http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/ and
> https://github.com/lxc/lxc/issues/419.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/conf.c  | 43 ++++++++++++++++++++++++++++++++++++++++---
>  src/lxc/conf.h  |  1 +
>  src/lxc/start.c |  7 +++++++
>  3 files changed, 48 insertions(+), 3 deletions(-)
> 
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index c7db06f..da4a928 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -943,9 +943,34 @@ static int setup_dev_symlinks(const struct lxc_rootfs *rootfs)
>  	return 0;
>  }
>  
> -static int setup_tty(const struct lxc_rootfs *rootfs,
> -		     const struct lxc_tty_info *tty_info, char *ttydir)
> +/*
> + * Build a space-separate list of ptys to pass to systemd.
> + */
> +static bool append_ptyname(char **pp, char *name)
>  {
> +	char *p;
> +
> +	if (!*pp) {
> +		*pp = malloc(strlen(name) + strlen("container_ttys=") + 1);
> +		if (!*pp)
> +			return false;
> +		sprintf(*pp, "container_ttys=%s", name);
> +		return true;
> +	}
> +	p = realloc(*pp, strlen(*pp) + strlen(name) + 2);
> +	if (!p)
> +		return false;
> +	*pp = p;
> +	strcat(p, " ");
> +	strcat(p, name);
> +	return true;
> +}
> +
> +static int setup_tty(struct lxc_conf *conf)
> +{
> +	const struct lxc_rootfs *rootfs = &conf->rootfs;
> +	const struct lxc_tty_info *tty_info = &conf->tty_info;
> +	char *ttydir = conf->ttydir;
>  	char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
>  	int i, ret;
>  
> @@ -999,6 +1024,8 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
>  				SYSERROR("failed to create symlink for tty %d", i+1);
>  				return -1;
>  			}
> +			/* Now save the relative path in @path for append_ptyname */
> +			sprintf(path, "%s/tty%d", ttydir, i + 1);
>  		} else {
>  			/* If we populated /dev, then we need to create /dev/ttyN */
>  			if (access(path, F_OK)) {
> @@ -1015,6 +1042,12 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
>  						pty_info->name, path);
>  				continue;
>  			}
> +			/* Now save the relative path in @path for append_ptyname */
> +			sprintf(path, "tty%d", i + 1);
> +		}
> +		if (!append_ptyname(&conf->pty_names, path)) {
> +			ERROR("Error setting up container_ttys string");
> +			return -1;
>  		}
>  	}
>  
> @@ -3794,11 +3827,14 @@ int lxc_setup(struct lxc_handler *handler)
>  			ERROR("failed to setup kmsg for '%s'", name);
>  	}
>  
> -	if (!lxc_conf->is_execute && setup_tty(&lxc_conf->rootfs, &lxc_conf->tty_info, lxc_conf->ttydir)) {
> +	if (!lxc_conf->is_execute && setup_tty(lxc_conf)) {
>  		ERROR("failed to setup the ttys for '%s'", name);
>  		return -1;
>  	}
>  
> +	if (lxc_conf->pty_names && setenv("container_ttys", lxc_conf->pty_names, 1))
> +		SYSERROR("failed to set environment variable for container ptys");
> +
>  	if (!lxc_conf->is_execute && setup_dev_symlinks(&lxc_conf->rootfs)) {
>  		ERROR("failed to setup /dev symlinks for '%s'", name);
>  		return -1;
> @@ -4172,6 +4208,7 @@ void lxc_conf_free(struct lxc_conf *conf)
>  	free(conf->rcfile);
>  	free(conf->init_cmd);
>  	free(conf->unexpanded_config);
> +	free(conf->pty_names);
>  	lxc_clear_config_network(conf);
>  	free(conf->lsm_aa_profile);
>  	free(conf->lsm_se_context);
> diff --git a/src/lxc/conf.h b/src/lxc/conf.h
> index 09065a1..8ec3e8e 100644
> --- a/src/lxc/conf.h
> +++ b/src/lxc/conf.h
> @@ -304,6 +304,7 @@ struct lxc_conf {
>  	struct lxc_list caps;
>  	struct lxc_list keepcaps;
>  	struct lxc_tty_info tty_info;
> +	char *pty_names; // comma-separated list of lxc.tty pty names
>  	struct lxc_console console;
>  	struct lxc_rootfs rootfs;
>  	char *ttydir;
> diff --git a/src/lxc/start.c b/src/lxc/start.c
> index 161e4c0..1949886 100644
> --- a/src/lxc/start.c
> +++ b/src/lxc/start.c
> @@ -750,6 +750,13 @@ static int do_start(void *data)
>  		goto out_warn_father;
>  	}
>  
> +	if (handler->conf->pty_names) {
> +		if (putenv(handler->conf->pty_names)) {
> +			SYSERROR("failed to set environment variable for container ptys");
> +			goto out_warn_father;
> +		}
> +	}
> +
>  	close(handler->sigfd);
>  
>  	/* after this call, we are in error because this
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150128/52a5f078/attachment-0001.sig>

From noreply at github.com  Wed Jan 28 08:15:55 2015
From: noreply at github.com (GitHub)
Date: Wed, 28 Jan 2015 00:15:55 -0800
Subject: [lxc-devel] [lxc/lxc] fcdc3e: clear_config_item should only work
	for lists
Message-ID: <54c89abbb4264_31e3fd8a280f2b82749@hookshot-fe2-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: fcdc3e50ea28069bb56b080abf2ae82b437d7e21
      https://github.com/lxc/lxc/commit/fcdc3e50ea28069bb56b080abf2ae82b437d7e21
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-28 (Wed, 28 Jan 2015)

  Changed paths:
    M src/lxc/conf.c
    M src/lxc/confile.c

  Log Message:
  -----------
  clear_config_item should only work for lists

Close #394

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 8d19ce7b9f8b294f054b719da5dc8e1c1d57860e
      https://github.com/lxc/lxc/commit/8d19ce7b9f8b294f054b719da5dc8e1c1d57860e
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-28 (Wed, 28 Jan 2015)

  Changed paths:
    M src/python-lxc/lxc/__init__.py
    M src/tests/get_item.c

  Log Message:
  -----------
  Only use clear_config_item for lists

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 393903d108f860bff092bb41b21f44fd20ea7045
      https://github.com/lxc/lxc/commit/393903d108f860bff092bb41b21f44fd20ea7045
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-28 (Wed, 28 Jan 2015)

  Changed paths:
    M src/lxc/conf.c
    M src/lxc/conf.h
    M src/lxc/start.c

  Log Message:
  -----------
  systemd: specify container_ttys in environment

The lxc.tty configuration item specifies a number of ttys to create.
Historically, for each of those, we create a /dev/pts/N entry and
symlink it to /dev/ttyN for older inits to use.  For systemd, we should
instead specify each tty name in a $container_ttys environment variable
passed to init.

See http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/ and
https://github.com/lxc/lxc/issues/419.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/b340eab85829...393903d108f8

From stgraber at ubuntu.com  Wed Jan 28 08:38:52 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Wed, 28 Jan 2015 09:38:52 +0100
Subject: [lxc-devel] [PATCH] Fix lxc-create -h with absolute template path
Message-ID: <1422434332-3591-1-git-send-email-stgraber@ubuntu.com>

Close #421

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 src/lxc/lxc_create.c   |  8 +-------
 src/lxc/lxccontainer.c | 34 ----------------------------------
 src/lxc/utils.c        | 34 ++++++++++++++++++++++++++++++++++
 src/lxc/utils.h        |  1 +
 4 files changed, 36 insertions(+), 41 deletions(-)

diff --git a/src/lxc/lxc_create.c b/src/lxc/lxc_create.c
index 2cc866a..8f46db9 100644
--- a/src/lxc/lxc_create.c
+++ b/src/lxc/lxc_create.c
@@ -101,8 +101,6 @@ static const struct option my_longopts[] = {
 
 static void create_helpfn(const struct lxc_arguments *args) {
 	char *argv[3], *path;
-	size_t len;
-	int ret;
 	pid_t pid;
 
 	if (!args->template)
@@ -114,11 +112,7 @@ static void create_helpfn(const struct lxc_arguments *args) {
 		return;
 	}
 
-	len = strlen(LXCTEMPLATEDIR) + strlen(args->template) + strlen("/lxc-") + 1;
-	path = alloca(len);
-	ret = snprintf(path, len,  "%s/lxc-%s", LXCTEMPLATEDIR, args->template);
-	if (ret < 0 || ret >= len)
-		return;
+	path = get_template_path(args->template);
 
 	argv[0] = path;
 	argv[1] = "-h";
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 2b3e28c..4da1627 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -841,40 +841,6 @@ static struct bdev *do_bdev_create(struct lxc_container *c, const char *type,
 	return bdev;
 }
 
-/*
- * Given the '-t' template option to lxc-create, figure out what to
- * do.  If the template is a full executable path, use that.  If it
- * is something like 'sshd', then return $templatepath/lxc-sshd.
- * On success return the template, on error return NULL.
- */
-static char *get_template_path(const char *t)
-{
-	int ret, len;
-	char *tpath;
-
-	if (t[0] == '/' && access(t, X_OK) == 0) {
-		tpath = strdup(t);
-		return tpath;
-	}
-
-	len = strlen(LXCTEMPLATEDIR) + strlen(t) + strlen("/lxc-") + 1;
-	tpath = malloc(len);
-	if (!tpath)
-		return NULL;
-	ret = snprintf(tpath, len, "%s/lxc-%s", LXCTEMPLATEDIR, t);
-	if (ret < 0 || ret >= len) {
-		free(tpath);
-		return NULL;
-	}
-	if (access(tpath, X_OK) < 0) {
-		SYSERROR("bad template: %s", t);
-		free(tpath);
-		return NULL;
-	}
-
-	return tpath;
-}
-
 static char *lxcbasename(char *path)
 {
 	char *p = path + strlen(path) - 1;
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index 23b1b11..93de1c3 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -1506,3 +1506,37 @@ int is_dir(const char *path)
 		return 1;
 	return 0;
 }
+
+/*
+ * Given the '-t' template option to lxc-create, figure out what to
+ * do.  If the template is a full executable path, use that.  If it
+ * is something like 'sshd', then return $templatepath/lxc-sshd.
+ * On success return the template, on error return NULL.
+ */
+char *get_template_path(const char *t)
+{
+	int ret, len;
+	char *tpath;
+
+	if (t[0] == '/' && access(t, X_OK) == 0) {
+		tpath = strdup(t);
+		return tpath;
+	}
+
+	len = strlen(LXCTEMPLATEDIR) + strlen(t) + strlen("/lxc-") + 1;
+	tpath = malloc(len);
+	if (!tpath)
+		return NULL;
+	ret = snprintf(tpath, len, "%s/lxc-%s", LXCTEMPLATEDIR, t);
+	if (ret < 0 || ret >= len) {
+		free(tpath);
+		return NULL;
+	}
+	if (access(tpath, X_OK) < 0) {
+		SYSERROR("bad template: %s", t);
+		free(tpath);
+		return NULL;
+	}
+
+	return tpath;
+}
diff --git a/src/lxc/utils.h b/src/lxc/utils.h
index ae2c851..b23cd8e 100644
--- a/src/lxc/utils.h
+++ b/src/lxc/utils.h
@@ -285,3 +285,4 @@ char *choose_init(const char *rootfs);
 int print_to_file(const char *file, const char *content);
 bool switch_to_ns(pid_t pid, const char *ns);
 int is_dir(const char *path);
+char *get_template_path(const char *t);
-- 
1.9.1


From stgraber at ubuntu.com  Wed Jan 28 09:07:58 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Wed, 28 Jan 2015 10:07:58 +0100
Subject: [lxc-devel] [PATCH] lxc-{centos|fedora}: Respect --rootfs
Message-ID: <1422436078-16514-1-git-send-email-stgraber@ubuntu.com>

Close #406

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 templates/lxc-centos.in | 3 +--
 templates/lxc-fedora.in | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
index fdc307a..4696ce3 100644
--- a/templates/lxc-centos.in
+++ b/templates/lxc-centos.in
@@ -693,7 +693,7 @@ do
     case "$1" in
         -h|--help)      usage $0 && exit 0;;
         -p|--path)      path=$2; shift 2;;
-        --rootfs)       rootfs=$2; shift 2;;
+        --rootfs)       rootfs_path=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
         -c|--clean)     clean=1; shift 1;;
         -R|--release)   release=$2; shift 2;;
@@ -827,7 +827,6 @@ if [ "$(id -u)" != "0" ]; then
     exit 1
 fi
 
-
 if [ -z "$rootfs_path" ]; then
     rootfs_path=$path/rootfs
     # check for 'lxc.rootfs' passed in through default config by lxc-create
diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index a1d1e7b..499685f 100644
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -1215,7 +1215,7 @@ do
     case "$1" in
         -h|--help)      usage $0 && exit 0;;
         -p|--path)      path=$2; shift 2;;
-        --rootfs)       rootfs=$2; shift 2;;
+        --rootfs)       rootfs_path=$2; shift 2;;
         -n|--name)      name=$2; shift 2;;
         -c|--clean)     clean=1; shift 1;;
         -R|--release)   release=$2; shift 2;;
@@ -1354,7 +1354,6 @@ if [ "$(id -u)" != "0" ]; then
     exit 1
 fi
 
-
 if [ -z "$rootfs_path" ]; then
     rootfs_path=$path/rootfs
     # check for 'lxc.rootfs' passed in through default config by lxc-create
-- 
1.9.1


From stgraber at ubuntu.com  Wed Jan 28 09:34:18 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Wed, 28 Jan 2015 10:34:18 +0100
Subject: [lxc-devel] [PATCH] Fix clearing IPv4/IPv6 addresses
Message-ID: <1422437658-29199-1-git-send-email-stgraber@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 src/lxc/confile.c | 35 ++++++++++++++---------------------
 1 file changed, 14 insertions(+), 21 deletions(-)

diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index be81f5d..e9cc474 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -787,29 +787,25 @@ static int config_network_ipv4_gateway(const char *key, const char *value,
 			               struct lxc_conf *lxc_conf)
 {
 	struct lxc_netdev *netdev;
-	struct in_addr *gw;
 
 	netdev = network_netdev(key, value, &lxc_conf->network);
 	if (!netdev)
 		return -1;
 
-	gw = malloc(sizeof(*gw));
-	if (!gw) {
-		SYSERROR("failed to allocate ipv4 gateway address");
-		return -1;
-	}
-
-	if (!value) {
-		ERROR("no ipv4 gateway address specified");
-		free(gw);
-		return -1;
-	}
-
-	if (!strcmp(value, "auto")) {
-		free(gw);
+	if (!value || strlen(value) == 0) {
+		netdev->ipv4_gateway = NULL;
+	} else if (!strcmp(value, "auto")) {
 		netdev->ipv4_gateway = NULL;
 		netdev->ipv4_gateway_auto = true;
 	} else {
+		struct in_addr *gw;
+
+		gw = malloc(sizeof(*gw));
+		if (!gw) {
+			SYSERROR("failed to allocate ipv4 gateway address");
+			return -1;
+		}
+
 		if (!inet_pton(AF_INET, value, gw)) {
 			SYSERROR("invalid ipv4 gateway address: %s", value);
 			free(gw);
@@ -892,12 +888,9 @@ static int config_network_ipv6_gateway(const char *key, const char *value,
 	if (!netdev)
 		return -1;
 
-	if (!value) {
-		ERROR("no ipv6 gateway address specified");
-		return -1;
-	}
-
-	if (!strcmp(value, "auto")) {
+	if (!value || strlen(value) == 0) {
+		netdev->ipv4_gateway = NULL;
+	} else if (!strcmp(value, "auto")) {
 		netdev->ipv6_gateway = NULL;
 		netdev->ipv6_gateway_auto = true;
 	} else {
-- 
1.9.1


From serge.hallyn at ubuntu.com  Wed Jan 28 10:56:37 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Wed, 28 Jan 2015 10:56:37 +0000
Subject: [lxc-devel] [PATCH] Fix lxc-create -h with absolute template
	path
In-Reply-To: <1422434332-3591-1-git-send-email-stgraber@ubuntu.com>
References: <1422434332-3591-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150128105637.GM7540@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Close #421
> 
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  src/lxc/lxc_create.c   |  8 +-------
>  src/lxc/lxccontainer.c | 34 ----------------------------------
>  src/lxc/utils.c        | 34 ++++++++++++++++++++++++++++++++++
>  src/lxc/utils.h        |  1 +
>  4 files changed, 36 insertions(+), 41 deletions(-)
> 
> diff --git a/src/lxc/lxc_create.c b/src/lxc/lxc_create.c
> index 2cc866a..8f46db9 100644
> --- a/src/lxc/lxc_create.c
> +++ b/src/lxc/lxc_create.c
> @@ -101,8 +101,6 @@ static const struct option my_longopts[] = {
>  
>  static void create_helpfn(const struct lxc_arguments *args) {
>  	char *argv[3], *path;
> -	size_t len;
> -	int ret;
>  	pid_t pid;
>  
>  	if (!args->template)
> @@ -114,11 +112,7 @@ static void create_helpfn(const struct lxc_arguments *args) {
>  		return;
>  	}
>  
> -	len = strlen(LXCTEMPLATEDIR) + strlen(args->template) + strlen("/lxc-") + 1;
> -	path = alloca(len);
> -	ret = snprintf(path, len,  "%s/lxc-%s", LXCTEMPLATEDIR, args->template);
> -	if (ret < 0 || ret >= len)
> -		return;
> +	path = get_template_path(args->template);
>  
>  	argv[0] = path;
>  	argv[1] = "-h";
> diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
> index 2b3e28c..4da1627 100644
> --- a/src/lxc/lxccontainer.c
> +++ b/src/lxc/lxccontainer.c
> @@ -841,40 +841,6 @@ static struct bdev *do_bdev_create(struct lxc_container *c, const char *type,
>  	return bdev;
>  }
>  
> -/*
> - * Given the '-t' template option to lxc-create, figure out what to
> - * do.  If the template is a full executable path, use that.  If it
> - * is something like 'sshd', then return $templatepath/lxc-sshd.
> - * On success return the template, on error return NULL.
> - */
> -static char *get_template_path(const char *t)
> -{
> -	int ret, len;
> -	char *tpath;
> -
> -	if (t[0] == '/' && access(t, X_OK) == 0) {
> -		tpath = strdup(t);
> -		return tpath;
> -	}
> -
> -	len = strlen(LXCTEMPLATEDIR) + strlen(t) + strlen("/lxc-") + 1;
> -	tpath = malloc(len);
> -	if (!tpath)
> -		return NULL;
> -	ret = snprintf(tpath, len, "%s/lxc-%s", LXCTEMPLATEDIR, t);
> -	if (ret < 0 || ret >= len) {
> -		free(tpath);
> -		return NULL;
> -	}
> -	if (access(tpath, X_OK) < 0) {
> -		SYSERROR("bad template: %s", t);
> -		free(tpath);
> -		return NULL;
> -	}
> -
> -	return tpath;
> -}
> -
>  static char *lxcbasename(char *path)
>  {
>  	char *p = path + strlen(path) - 1;
> diff --git a/src/lxc/utils.c b/src/lxc/utils.c
> index 23b1b11..93de1c3 100644
> --- a/src/lxc/utils.c
> +++ b/src/lxc/utils.c
> @@ -1506,3 +1506,37 @@ int is_dir(const char *path)
>  		return 1;
>  	return 0;
>  }
> +
> +/*
> + * Given the '-t' template option to lxc-create, figure out what to
> + * do.  If the template is a full executable path, use that.  If it
> + * is something like 'sshd', then return $templatepath/lxc-sshd.
> + * On success return the template, on error return NULL.
> + */
> +char *get_template_path(const char *t)
> +{
> +	int ret, len;
> +	char *tpath;
> +
> +	if (t[0] == '/' && access(t, X_OK) == 0) {
> +		tpath = strdup(t);
> +		return tpath;
> +	}
> +
> +	len = strlen(LXCTEMPLATEDIR) + strlen(t) + strlen("/lxc-") + 1;
> +	tpath = malloc(len);
> +	if (!tpath)
> +		return NULL;
> +	ret = snprintf(tpath, len, "%s/lxc-%s", LXCTEMPLATEDIR, t);
> +	if (ret < 0 || ret >= len) {
> +		free(tpath);
> +		return NULL;
> +	}
> +	if (access(tpath, X_OK) < 0) {
> +		SYSERROR("bad template: %s", t);
> +		free(tpath);
> +		return NULL;
> +	}
> +
> +	return tpath;
> +}
> diff --git a/src/lxc/utils.h b/src/lxc/utils.h
> index ae2c851..b23cd8e 100644
> --- a/src/lxc/utils.h
> +++ b/src/lxc/utils.h
> @@ -285,3 +285,4 @@ char *choose_init(const char *rootfs);
>  int print_to_file(const char *file, const char *content);
>  bool switch_to_ns(pid_t pid, const char *ns);
>  int is_dir(const char *path);
> +char *get_template_path(const char *t);
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Wed Jan 28 11:00:46 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Wed, 28 Jan 2015 11:00:46 +0000
Subject: [lxc-devel] [PATCH] lxc-{centos|fedora}: Respect --rootfs
In-Reply-To: <1422436078-16514-1-git-send-email-stgraber@ubuntu.com>
References: <1422436078-16514-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150128110046.GN7540@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Close #406
> 
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Thank you!

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  templates/lxc-centos.in | 3 +--
>  templates/lxc-fedora.in | 3 +--
>  2 files changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
> index fdc307a..4696ce3 100644
> --- a/templates/lxc-centos.in
> +++ b/templates/lxc-centos.in
> @@ -693,7 +693,7 @@ do
>      case "$1" in
>          -h|--help)      usage $0 && exit 0;;
>          -p|--path)      path=$2; shift 2;;
> -        --rootfs)       rootfs=$2; shift 2;;
> +        --rootfs)       rootfs_path=$2; shift 2;;
>          -n|--name)      name=$2; shift 2;;
>          -c|--clean)     clean=1; shift 1;;
>          -R|--release)   release=$2; shift 2;;
> @@ -827,7 +827,6 @@ if [ "$(id -u)" != "0" ]; then
>      exit 1
>  fi
>  
> -
>  if [ -z "$rootfs_path" ]; then
>      rootfs_path=$path/rootfs
>      # check for 'lxc.rootfs' passed in through default config by lxc-create
> diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
> index a1d1e7b..499685f 100644
> --- a/templates/lxc-fedora.in
> +++ b/templates/lxc-fedora.in
> @@ -1215,7 +1215,7 @@ do
>      case "$1" in
>          -h|--help)      usage $0 && exit 0;;
>          -p|--path)      path=$2; shift 2;;
> -        --rootfs)       rootfs=$2; shift 2;;
> +        --rootfs)       rootfs_path=$2; shift 2;;
>          -n|--name)      name=$2; shift 2;;
>          -c|--clean)     clean=1; shift 1;;
>          -R|--release)   release=$2; shift 2;;
> @@ -1354,7 +1354,6 @@ if [ "$(id -u)" != "0" ]; then
>      exit 1
>  fi
>  
> -
>  if [ -z "$rootfs_path" ]; then
>      rootfs_path=$path/rootfs
>      # check for 'lxc.rootfs' passed in through default config by lxc-create
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Wed Jan 28 11:17:18 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Wed, 28 Jan 2015 11:17:18 +0000
Subject: [lxc-devel] [PATCH] Fix clearing IPv4/IPv6 addresses
In-Reply-To: <1422437658-29199-1-git-send-email-stgraber@ubuntu.com>
References: <1422437658-29199-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150128111718.GO7540@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Looks good, except that in both functions in the case where
the value is being cleared you may leak the previously allocated
gw.

> ---
>  src/lxc/confile.c | 35 ++++++++++++++---------------------
>  1 file changed, 14 insertions(+), 21 deletions(-)
> 
> diff --git a/src/lxc/confile.c b/src/lxc/confile.c
> index be81f5d..e9cc474 100644
> --- a/src/lxc/confile.c
> +++ b/src/lxc/confile.c
> @@ -787,29 +787,25 @@ static int config_network_ipv4_gateway(const char *key, const char *value,
>  			               struct lxc_conf *lxc_conf)
>  {
>  	struct lxc_netdev *netdev;
> -	struct in_addr *gw;
>  
>  	netdev = network_netdev(key, value, &lxc_conf->network);
>  	if (!netdev)
>  		return -1;
>  
> -	gw = malloc(sizeof(*gw));
> -	if (!gw) {
> -		SYSERROR("failed to allocate ipv4 gateway address");
> -		return -1;
> -	}
> -
> -	if (!value) {
> -		ERROR("no ipv4 gateway address specified");
> -		free(gw);
> -		return -1;
> -	}
> -
> -	if (!strcmp(value, "auto")) {
> -		free(gw);
> +	if (!value || strlen(value) == 0) {
> +		netdev->ipv4_gateway = NULL;
> +	} else if (!strcmp(value, "auto")) {
>  		netdev->ipv4_gateway = NULL;
>  		netdev->ipv4_gateway_auto = true;
>  	} else {
> +		struct in_addr *gw;
> +
> +		gw = malloc(sizeof(*gw));
> +		if (!gw) {
> +			SYSERROR("failed to allocate ipv4 gateway address");
> +			return -1;
> +		}
> +
>  		if (!inet_pton(AF_INET, value, gw)) {
>  			SYSERROR("invalid ipv4 gateway address: %s", value);
>  			free(gw);
> @@ -892,12 +888,9 @@ static int config_network_ipv6_gateway(const char *key, const char *value,
>  	if (!netdev)
>  		return -1;
>  
> -	if (!value) {
> -		ERROR("no ipv6 gateway address specified");
> -		return -1;
> -	}
> -
> -	if (!strcmp(value, "auto")) {
> +	if (!value || strlen(value) == 0) {
> +		netdev->ipv4_gateway = NULL;
> +	} else if (!strcmp(value, "auto")) {
>  		netdev->ipv6_gateway = NULL;
>  		netdev->ipv6_gateway_auto = true;
>  	} else {
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From noreply at github.com  Wed Jan 28 11:47:25 2015
From: noreply at github.com (GitHub)
Date: Wed, 28 Jan 2015 03:47:25 -0800
Subject: [lxc-devel] [lxc/lxc] 6010a4: Fix lxc-create -h with absolute
	template path
Message-ID: <54c8cc4d4519a_13d23faa682ed2c0671c@hookshot-fe5-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 6010a416227149adabc5aa8e018e2333adb2a922
      https://github.com/lxc/lxc/commit/6010a416227149adabc5aa8e018e2333adb2a922
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-28 (Wed, 28 Jan 2015)

  Changed paths:
    M src/lxc/lxc_create.c
    M src/lxc/lxccontainer.c
    M src/lxc/utils.c
    M src/lxc/utils.h

  Log Message:
  -----------
  Fix lxc-create -h with absolute template path

Close #421

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 9f177a00130a70e9c7f64432a8dea3b64e533fe5
      https://github.com/lxc/lxc/commit/9f177a00130a70e9c7f64432a8dea3b64e533fe5
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-28 (Wed, 28 Jan 2015)

  Changed paths:
    M templates/lxc-centos.in
    M templates/lxc-fedora.in

  Log Message:
  -----------
  lxc-{centos|fedora}: Respect --rootfs

Close #406

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: e088e9267c8fdd9078e65bcb156b3b9c8869bb6c
      https://github.com/lxc/lxc/commit/e088e9267c8fdd9078e65bcb156b3b9c8869bb6c
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-28 (Wed, 28 Jan 2015)

  Changed paths:
    M src/lxc/confile.c

  Log Message:
  -----------
  Fix clearing IPv4/IPv6 addresses

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/393903d108f8...e088e9267c8f

From berrange at redhat.com  Wed Jan 28 14:35:28 2015
From: berrange at redhat.com (Daniel P. Berrange)
Date: Wed, 28 Jan 2015 14:35:28 +0000
Subject: [lxc-devel] [PATCH 1/1] systemd: specify container_ttys in
 environment
In-Reply-To: <20150127204825.GJ7540@ubuntumail>
References: <20150127204825.GJ7540@ubuntumail>
Message-ID: <20150128143528.GC3352@redhat.com>

On Tue, Jan 27, 2015 at 08:48:25PM +0000, Serge Hallyn wrote:
> The lxc.tty configuration item specifies a number of ttys to create.
> Historically, for each of those, we create a /dev/pts/N entry and
> symlink it to /dev/ttyN for older inits to use.  For systemd, we should
> instead specify each tty name in a $container_ttys environment variable
> passed to init.
> 
> See http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/ and
> https://github.com/lxc/lxc/issues/419.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> ---
>  src/lxc/conf.c  | 43 ++++++++++++++++++++++++++++++++++++++++---
>  src/lxc/conf.h  |  1 +
>  src/lxc/start.c |  8 +++++---
>  3 files changed, 46 insertions(+), 6 deletions(-)
> 

> +static int setup_tty(struct lxc_conf *conf)
> +{
> +	const struct lxc_rootfs *rootfs = &conf->rootfs;
> +	const struct lxc_tty_info *tty_info = &conf->tty_info;
> +	char *ttydir = conf->ttydir;
>  	char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
>  	int i, ret;
>  
> @@ -999,6 +1024,8 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
>  				SYSERROR("failed to create symlink for tty %d", i+1);
>  				return -1;
>  			}
> +			/* Now save the relative path in @path for append_ptyname */
> +			sprintf(path, "%s/tty%d", ttydir, i + 1);
>  		} else {
>  			/* If we populated /dev, then we need to create /dev/ttyN */
>  			if (access(path, F_OK)) {
> @@ -1015,6 +1042,12 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
>  						pty_info->name, path);
>  				continue;
>  			}
> +			/* Now save the relative path in @path for append_ptyname */
> +			sprintf(path, "tty%d", i + 1);
> +		}
> +		if (!append_ptyname(&conf->pty_names, path)) {
> +			ERROR("Error setting up container_ttys string");
> +			return -1;
>  		}
>  	}

I'm unclear if this is relevant for LXC tools or not, but if one of those
ptys is symlinked to /dev/console, then it should be excluded from the
set in "container_ttys" env variable.

In libvirt /dev/pts/0 is always symlinked to /dev/console, so we only
include pts/1, pts/2, etc in "container_ttys".  Not doing this will
result in systemd trying to launch login process on both /dev/console
and /dev/pts/0 with obvious hilarity / fail :-)

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|

From serge.hallyn at ubuntu.com  Wed Jan 28 16:23:43 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Wed, 28 Jan 2015 16:23:43 +0000
Subject: [lxc-devel] [PATCH 1/1] systemd: specify container_ttys in
 environment
In-Reply-To: <20150128143528.GC3352@redhat.com>
References: <20150127204825.GJ7540@ubuntumail>
 <20150128143528.GC3352@redhat.com>
Message-ID: <20150128162343.GA16770@ubuntumail>

Quoting Daniel P. Berrange (berrange at redhat.com):
> On Tue, Jan 27, 2015 at 08:48:25PM +0000, Serge Hallyn wrote:
> > The lxc.tty configuration item specifies a number of ttys to create.
> > Historically, for each of those, we create a /dev/pts/N entry and
> > symlink it to /dev/ttyN for older inits to use.  For systemd, we should
> > instead specify each tty name in a $container_ttys environment variable
> > passed to init.
> > 
> > See http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/ and
> > https://github.com/lxc/lxc/issues/419.
> > 
> > Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> > ---
> >  src/lxc/conf.c  | 43 ++++++++++++++++++++++++++++++++++++++++---
> >  src/lxc/conf.h  |  1 +
> >  src/lxc/start.c |  8 +++++---
> >  3 files changed, 46 insertions(+), 6 deletions(-)
> > 
> 
> > +static int setup_tty(struct lxc_conf *conf)
> > +{
> > +	const struct lxc_rootfs *rootfs = &conf->rootfs;
> > +	const struct lxc_tty_info *tty_info = &conf->tty_info;
> > +	char *ttydir = conf->ttydir;
> >  	char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
> >  	int i, ret;
> >  
> > @@ -999,6 +1024,8 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
> >  				SYSERROR("failed to create symlink for tty %d", i+1);
> >  				return -1;
> >  			}
> > +			/* Now save the relative path in @path for append_ptyname */
> > +			sprintf(path, "%s/tty%d", ttydir, i + 1);
> >  		} else {
> >  			/* If we populated /dev, then we need to create /dev/ttyN */
> >  			if (access(path, F_OK)) {
> > @@ -1015,6 +1042,12 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
> >  						pty_info->name, path);
> >  				continue;
> >  			}
> > +			/* Now save the relative path in @path for append_ptyname */
> > +			sprintf(path, "tty%d", i + 1);
> > +		}
> > +		if (!append_ptyname(&conf->pty_names, path)) {
> > +			ERROR("Error setting up container_ttys string");
> > +			return -1;
> >  		}
> >  	}
> 
> I'm unclear if this is relevant for LXC tools or not, but if one of those
> ptys is symlinked to /dev/console, then it should be excluded from the
> set in "container_ttys" env variable.
> 
> In libvirt /dev/pts/0 is always symlinked to /dev/console, so we only
> include pts/1, pts/2, etc in "container_ttys".  Not doing this will
> result in systemd trying to launch login process on both /dev/console
> and /dev/pts/0 with obvious hilarity / fail :-)

:)  Yup, the setup_tty() function which adds to the pty_names list is
only called for the ptys other than /dev/console, so this bit is ok.

(Something else seems to be wrong with it, but not sure yet what)

thanks,
-serge

From stgraber at ubuntu.com  Wed Jan 28 16:29:11 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Wed, 28 Jan 2015 17:29:11 +0100
Subject: [lxc-devel] [PATCH 1/1] systemd: specify container_ttys in
 environment
In-Reply-To: <20150128162343.GA16770@ubuntumail>
References: <20150127204825.GJ7540@ubuntumail>
 <20150128143528.GC3352@redhat.com>
 <20150128162343.GA16770@ubuntumail>
Message-ID: <20150128162911.GE14174@castiana.ipv6.teksavvy.com>

On Wed, Jan 28, 2015 at 04:23:43PM +0000, Serge Hallyn wrote:
> Quoting Daniel P. Berrange (berrange at redhat.com):
> > On Tue, Jan 27, 2015 at 08:48:25PM +0000, Serge Hallyn wrote:
> > > The lxc.tty configuration item specifies a number of ttys to create.
> > > Historically, for each of those, we create a /dev/pts/N entry and
> > > symlink it to /dev/ttyN for older inits to use.  For systemd, we should
> > > instead specify each tty name in a $container_ttys environment variable
> > > passed to init.
> > > 
> > > See http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/ and
> > > https://github.com/lxc/lxc/issues/419.
> > > 
> > > Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> > > ---
> > >  src/lxc/conf.c  | 43 ++++++++++++++++++++++++++++++++++++++++---
> > >  src/lxc/conf.h  |  1 +
> > >  src/lxc/start.c |  8 +++++---
> > >  3 files changed, 46 insertions(+), 6 deletions(-)
> > > 
> > 
> > > +static int setup_tty(struct lxc_conf *conf)
> > > +{
> > > +	const struct lxc_rootfs *rootfs = &conf->rootfs;
> > > +	const struct lxc_tty_info *tty_info = &conf->tty_info;
> > > +	char *ttydir = conf->ttydir;
> > >  	char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
> > >  	int i, ret;
> > >  
> > > @@ -999,6 +1024,8 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
> > >  				SYSERROR("failed to create symlink for tty %d", i+1);
> > >  				return -1;
> > >  			}
> > > +			/* Now save the relative path in @path for append_ptyname */
> > > +			sprintf(path, "%s/tty%d", ttydir, i + 1);
> > >  		} else {
> > >  			/* If we populated /dev, then we need to create /dev/ttyN */
> > >  			if (access(path, F_OK)) {
> > > @@ -1015,6 +1042,12 @@ static int setup_tty(const struct lxc_rootfs *rootfs,
> > >  						pty_info->name, path);
> > >  				continue;
> > >  			}
> > > +			/* Now save the relative path in @path for append_ptyname */
> > > +			sprintf(path, "tty%d", i + 1);
> > > +		}
> > > +		if (!append_ptyname(&conf->pty_names, path)) {
> > > +			ERROR("Error setting up container_ttys string");
> > > +			return -1;
> > >  		}
> > >  	}
> > 
> > I'm unclear if this is relevant for LXC tools or not, but if one of those
> > ptys is symlinked to /dev/console, then it should be excluded from the
> > set in "container_ttys" env variable.
> > 
> > In libvirt /dev/pts/0 is always symlinked to /dev/console, so we only
> > include pts/1, pts/2, etc in "container_ttys".  Not doing this will
> > result in systemd trying to launch login process on both /dev/console
> > and /dev/pts/0 with obvious hilarity / fail :-)
> 
> :)  Yup, the setup_tty() function which adds to the pty_names list is
> only called for the ptys other than /dev/console, so this bit is ok.
> 
> (Something else seems to be wrong with it, but not sure yet what)
> 
> thanks,
> -serge

Just a quick note that this patch doesn't actually work because systemd
checks that those are pts/* and ours aren't (they belong to the host's
devpts, not the container's).

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150128/26c801b7/attachment.sig>

From dwight.engen at oracle.com  Wed Jan 28 20:19:49 2015
From: dwight.engen at oracle.com (Dwight Engen)
Date: Wed, 28 Jan 2015 15:19:49 -0500
Subject: [lxc-devel] [PATCH cgmanager] bump required version of libnih to
	1.0.3
Message-ID: <20150128151949.35305ffb@Delphi.home>

Attempting to build with 1.0.2 gives the following error:

nih-dbus-tool:org.linuxcontainers.cgmanager.xml:41:51:
Invalid D-Bus type in <arg> type attribute: Unknown typecode

since 1.0.2 does not support the type 'h' for passing the
sockfd.

Signed-off-by: Dwight Engen <dwight.engen at oracle.com>
---
 configure.ac |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/configure.ac b/configure.ac
index 904c4f3..4d1298a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -25,7 +25,7 @@ AC_PROG_CC_C99
 
 AC_PATH_PROG([NIH_DBUS_TOOL], [nih-dbus-tool])
 
-PKG_CHECK_MODULES([NIH], [libnih >= 1.0.2])
+PKG_CHECK_MODULES([NIH], [libnih >= 1.0.3])
 PKG_CHECK_MODULES([NIH_DBUS], [libnih-dbus >= 1.0.0])
 PKG_CHECK_MODULES([DBUS], [dbus-1 >= 1.2.16])
 
-- 
1.7.1


From stgraber at ubuntu.com  Wed Jan 28 21:55:55 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Wed, 28 Jan 2015 22:55:55 +0100
Subject: [lxc-devel] [PATCH cgmanager] bump required version of libnih
 to 1.0.3
In-Reply-To: <20150128151949.35305ffb@Delphi.home>
References: <20150128151949.35305ffb@Delphi.home>
Message-ID: <20150128215555.GF14174@castiana.ipv6.teksavvy.com>

On Wed, Jan 28, 2015 at 03:19:49PM -0500, Dwight Engen wrote:
> Attempting to build with 1.0.2 gives the following error:
> 
> nih-dbus-tool:org.linuxcontainers.cgmanager.xml:41:51:
> Invalid D-Bus type in <arg> type attribute: Unknown typecode
> 
> since 1.0.2 does not support the type 'h' for passing the
> sockfd.
> 
> Signed-off-by: Dwight Engen <dwight.engen at oracle.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  configure.ac |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/configure.ac b/configure.ac
> index 904c4f3..4d1298a 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -25,7 +25,7 @@ AC_PROG_CC_C99
>  
>  AC_PATH_PROG([NIH_DBUS_TOOL], [nih-dbus-tool])
>  
> -PKG_CHECK_MODULES([NIH], [libnih >= 1.0.2])
> +PKG_CHECK_MODULES([NIH], [libnih >= 1.0.3])
>  PKG_CHECK_MODULES([NIH_DBUS], [libnih-dbus >= 1.0.0])
>  PKG_CHECK_MODULES([DBUS], [dbus-1 >= 1.2.16])
>  
> -- 
> 1.7.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150128/54a04aed/attachment.sig>

From stgraber at ubuntu.com  Wed Jan 28 21:57:14 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Wed, 28 Jan 2015 22:57:14 +0100
Subject: [lxc-devel] [PATCH] Use consistent /proc, /sys and /sys/fs/cgroup
Message-ID: <1422482234-730-1-git-send-email-stgraber@ubuntu.com>

 - Implements mixed mode for /sys where it's mounted read-only but with
   /sys/devices/virtual/net/ writable.

 - Sets lxc.mount.auto to "cgroup:mixed proc:mixed sys:mixed" for all
   templates.

 - Drop any template-specific mount for /proc, /sys or /sys/fs/cgroup.

 - Get rid of the fstab file by default, using lxc.mount.entry instead.

The read-only bind mount of /sys on top of itself is there so that
mountall and other init systems don't attempt to remount /sys
read-write.

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 config/templates/archlinux.common.conf.in  |  3 ---
 config/templates/centos.common.conf.in     |  3 ---
 config/templates/common.conf.in            |  3 +++
 config/templates/debian.common.conf.in     |  5 +----
 config/templates/gentoo.common.conf.in     |  3 ---
 config/templates/gentoo.moresecure.conf.in |  2 --
 config/templates/openwrt.common.conf.in    |  4 ----
 config/templates/oracle.common.conf.in     |  3 ---
 config/templates/plamo.common.conf.in      |  1 -
 config/templates/ubuntu.common.conf.in     |  5 +----
 src/lxc/conf.c                             | 25 ++++++++++++++++---------
 src/lxc/conf.h                             |  1 +
 src/lxc/confile.c                          |  3 ++-
 templates/lxc-alpine.in                    |  3 +--
 templates/lxc-altlinux.in                  |  6 +-----
 templates/lxc-busybox.in                   | 22 ++++++----------------
 templates/lxc-cirros.in                    |  4 +---
 templates/lxc-debian.in                    |  5 -----
 templates/lxc-openmandriva.in              |  7 +------
 templates/lxc-opensuse.in                  |  8 +-------
 templates/lxc-plamo.in                     |  5 +----
 templates/lxc-sshd.in                      |  4 ++--
 templates/lxc-ubuntu-cloud.in              |  4 ----
 templates/lxc-ubuntu.in                    |  6 +-----
 24 files changed, 39 insertions(+), 96 deletions(-)

diff --git a/config/templates/archlinux.common.conf.in b/config/templates/archlinux.common.conf.in
index 693f2f4..f869491 100644
--- a/config/templates/archlinux.common.conf.in
+++ b/config/templates/archlinux.common.conf.in
@@ -8,9 +8,6 @@ lxc.tty = 6
 lxc.haltsignal=SIGRTMIN+4
 lxc.stopsignal=SIGRTMIN+14
 
-# Mount entries
-lxc.mount.auto = proc:mixed sys:ro
-
 # Uncomment to disable creating tty devices subdirectory in /dev
 # lxc.devttydir =
 
diff --git a/config/templates/centos.common.conf.in b/config/templates/centos.common.conf.in
index 4ce2fda..ee2e9e1 100644
--- a/config/templates/centos.common.conf.in
+++ b/config/templates/centos.common.conf.in
@@ -1,9 +1,6 @@
 # This derives from the global common config
 lxc.include = @LXCTEMPLATECONFIG@/common.conf
 
-# Mount entries
-lxc.mount.auto = proc:mixed sys:ro
-
 # Capabilities
 # Uncomment these if you don't run anything that needs the capability, and
 # would like the container to run with less privilege.
diff --git a/config/templates/common.conf.in b/config/templates/common.conf.in
index f22ef0c..26b3229 100644
--- a/config/templates/common.conf.in
+++ b/config/templates/common.conf.in
@@ -43,6 +43,9 @@ lxc.cgroup.devices.allow = c 1:9 rwm
 ### /dev/pts/*
 lxc.cgroup.devices.allow = c 136:* rwm
 
+# Setup the default mounts
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
+
 # Blacklist some syscalls which are not safe in privileged
 # containers
 lxc.seccomp = @LXCTEMPLATECONFIG@/common.seccomp
diff --git a/config/templates/debian.common.conf.in b/config/templates/debian.common.conf.in
index e1d421f..493feee 100644
--- a/config/templates/debian.common.conf.in
+++ b/config/templates/debian.common.conf.in
@@ -5,8 +5,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
 lxc.devttydir =
 
 # Default mount entries
-lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
-lxc.mount.entry = sysfs sys sysfs defaults 0 0
 lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
 
 # When using LXC with apparmor, the container will be confined by default.
@@ -15,9 +13,8 @@ lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,opt
 #lxc.aa_profile = unconfined
 
 # To support container nesting on an Ubuntu host while retaining most of
-# apparmor's added security, use the following two lines instead.
+# apparmor's added security, use the following line instead.
 #lxc.aa_profile = lxc-container-default-with-nesting
-#lxc.mount.auto = cgroup:mixed
 
 # If you wish to allow mounting block filesystems, then use the following
 # line instead, and make sure to grant access to the block device and/or loop
diff --git a/config/templates/gentoo.common.conf.in b/config/templates/gentoo.common.conf.in
index 7b96672..01c8f48 100644
--- a/config/templates/gentoo.common.conf.in
+++ b/config/templates/gentoo.common.conf.in
@@ -6,9 +6,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
 # But security is not the goal.
 # Looking for more security, see gentoo.moresecure.conf
 
-# Default mount entries
-lxc.mount.entry=sys sys sysfs defaults 0 0
-
 # Doesn't support consoles in /dev/lxc/
 lxc.devttydir =
 
diff --git a/config/templates/gentoo.moresecure.conf.in b/config/templates/gentoo.moresecure.conf.in
index 238303d..270e9df 100644
--- a/config/templates/gentoo.moresecure.conf.in
+++ b/config/templates/gentoo.moresecure.conf.in
@@ -8,8 +8,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
 # Container user ? see gentoo.common.conf
 
 # do not mount sysfs, see http://blog.bofh.it/debian/id_413
-# lxc.mount.entry=sys sys sysfs rw 0 0
-lxc.mount.entry=proc proc proc ro,nodev,noexec,nosuid 0 0
 lxc.mount.entry=mqueue dev/mqueue mqueue rw,nodev,noexec,nosuid 0 0
 lxc.mount.entry=shm dev/shm tmpfs rw,nosuid,nodev,noexec,relatime 0 0
 lxc.mount.entry=run run tmpfs rw,nosuid,nodev,relatime,mode=755 0 0
diff --git a/config/templates/openwrt.common.conf.in b/config/templates/openwrt.common.conf.in
index 05918f0..6609333 100644
--- a/config/templates/openwrt.common.conf.in
+++ b/config/templates/openwrt.common.conf.in
@@ -1,7 +1,3 @@
-# Default mount entries
-lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
-lxc.mount.entry = sysfs sys sysfs defaults 0 0
-
 # Default console settings
 lxc.devttydir = lxc
 lxc.tty = 4
diff --git a/config/templates/oracle.common.conf.in b/config/templates/oracle.common.conf.in
index 10522b2..8a72ad0 100644
--- a/config/templates/oracle.common.conf.in
+++ b/config/templates/oracle.common.conf.in
@@ -1,9 +1,6 @@
 # This derives from the global common config
 lxc.include = @LXCTEMPLATECONFIG@/common.conf
 
-# Mount entries
-lxc.mount.auto = cgroup:mixed proc:mixed sys:ro
-
 # Capabilities
 # Uncomment these if you don't run anything that needs the capability, and
 # would like the container to run with less privilege.
diff --git a/config/templates/plamo.common.conf.in b/config/templates/plamo.common.conf.in
index 9b0d02b..e7809e1 100644
--- a/config/templates/plamo.common.conf.in
+++ b/config/templates/plamo.common.conf.in
@@ -2,7 +2,6 @@
 lxc.include = @LXCTEMPLATECONFIG@/common.conf
 
 # Default mount
-lxc.mount.auto = proc sys cgroup
 lxc.mount.entry = none dev/shm tmpfs nosuid,nodev,noexec,mode=1777 0 0
 
 # Doesn't support consoles in /dev/lxc/
diff --git a/config/templates/ubuntu.common.conf.in b/config/templates/ubuntu.common.conf.in
index 19a6a67..d1ce8e9 100644
--- a/config/templates/ubuntu.common.conf.in
+++ b/config/templates/ubuntu.common.conf.in
@@ -2,8 +2,6 @@
 lxc.include = @LXCTEMPLATECONFIG@/common.conf
 
 # Default mount entries
-lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
-lxc.mount.entry = sysfs sys sysfs defaults 0 0
 lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
 lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0
 lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0
@@ -15,9 +13,8 @@ lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0
 #lxc.aa_profile = unconfined
 
 # To support container nesting on an Ubuntu host while retaining most of
-# apparmor's added security, use the following two lines instead.
+# apparmor's added security, use the following line instead.
 #lxc.aa_profile = lxc-container-default-with-nesting
-#lxc.mount.auto = cgroup:mixed
 
 # Uncomment the following line to autodetect squid-deb-proxy configuration on the
 # host and forward it to the guest at start time.
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index e7def3e..5f98aa3 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -750,15 +750,21 @@ static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_ha
 		 * MS_REMOUNT|MS_BIND|MS_RDONLY seems to work for kernels as low as
 		 * 2.6.32...
 		 */
-		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc",                  "%r/proc",               "proc",  MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
-		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys",           "%r/proc/sys",           NULL,    MS_BIND,                      NULL },
-		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                    "%r/proc/sys",           NULL,    MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
-		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger", "%r/proc/sysrq-trigger", NULL,    MS_BIND,                      NULL },
-		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                    "%r/proc/sysrq-trigger", NULL,    MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
-		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW,    "proc",                  "%r/proc",               "proc",  MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
-		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RW,     "sysfs",                 "%r/sys",                "sysfs", 0,                            NULL },
-		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RO,     "sysfs",                 "%r/sys",                "sysfs", MS_RDONLY,                    NULL },
-		{ 0,                  0,                   NULL,                    NULL,                    NULL,    0,                            NULL }
+		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc",                                              "%r/proc",                      "proc",     MS_NODEV|MS_NOEXEC|MS_NOSUID,   NULL },
+		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys",                                       "%r/proc/sys",                  NULL,       MS_BIND,                        NULL },
+		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                                                "%r/proc/sys",                  NULL,       MS_REMOUNT|MS_BIND|MS_RDONLY,   NULL },
+		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger",                             "%r/proc/sysrq-trigger",        NULL,       MS_BIND,                        NULL },
+		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                                                "%r/proc/sysrq-trigger",        NULL,       MS_REMOUNT|MS_BIND|MS_RDONLY,   NULL },
+		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW,    "proc",                                              "%r/proc",                      "proc",     MS_NODEV|MS_NOEXEC|MS_NOSUID,   NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RW,     "sysfs",                                             "%r/sys",                       "sysfs",    0,                              NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RO,     "sysfs",                                             "%r/sys",                       "sysfs",    MS_RDONLY,                      NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "sysfs",                                             "%r/sys",                       "sysfs",    MS_NODEV|MS_NOEXEC|MS_NOSUID,   NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "%r/sys",                                            "%r/sys",                       NULL,       MS_BIND,                        NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  NULL,                                                "%r/sys",                       NULL,       MS_REMOUNT|MS_BIND|MS_RDONLY,   NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "sysfs",                                             "%r/sys/devices/virtual/net",   "sysfs",    0,                              NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "%r/sys/devices/virtual/net/devices/virtual/net",    "%r/sys/devices/virtual/net",   NULL,       MS_BIND,                        NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "%r/sys/devices/virtual/net/devices/virtual/net",    "%r/sys/devices/virtual/net",   NULL,       MS_REMOUNT|MS_BIND|MS_NOSUID|MS_NODEV|MS_NOEXEC,   NULL },
+		{ 0,                  0,                   NULL,                                                NULL,                           NULL,       0,                              NULL }
 	};
 
 	for (i = 0; default_mounts[i].match_mask; i++) {
@@ -793,6 +799,7 @@ static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_ha
 			saved_errno = errno;
 			if (r < 0)
 				SYSERROR("error mounting %s on %s flags %lu", source, destination, mflags);
+
 			free(source);
 			free(destination);
 			if (r < 0) {
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 8ec3e8e..afa5517 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -236,6 +236,7 @@ enum {
 
 	LXC_AUTO_SYS_RW               = 0x004,   /* /sys */
 	LXC_AUTO_SYS_RO               = 0x008,   /* /sys read-only */
+	LXC_AUTO_SYS_MIXED            = 0x00C,   /* /sys read-only and /sys/class/net read-write */
 	LXC_AUTO_SYS_MASK             = 0x00C,
 
 	LXC_AUTO_CGROUP_RO            = 0x010,   /* /sys/fs/cgroup (partial mount, read-only) */
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index ccdf26c..8544ac9 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -1416,8 +1416,9 @@ static int config_mount_auto(const char *key, const char *value,
 		{ "proc",               LXC_AUTO_PROC_MASK,      LXC_AUTO_PROC_MIXED         },
 		{ "proc:mixed",         LXC_AUTO_PROC_MASK,      LXC_AUTO_PROC_MIXED         },
 		{ "proc:rw",            LXC_AUTO_PROC_MASK,      LXC_AUTO_PROC_RW            },
-		{ "sys",                LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_RO             },
+		{ "sys",                LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_MIXED          },
 		{ "sys:ro",             LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_RO             },
+		{ "sys:mixed",          LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_MIXED          },
 		{ "sys:rw",             LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_RW             },
 		{ "cgroup",             LXC_AUTO_CGROUP_MASK,    LXC_AUTO_CGROUP_NOSPEC      },
 		{ "cgroup:mixed",       LXC_AUTO_CGROUP_MASK,    LXC_AUTO_CGROUP_MIXED       },
diff --git a/templates/lxc-alpine.in b/templates/lxc-alpine.in
index 187a032..886a838 100644
--- a/templates/lxc-alpine.in
+++ b/templates/lxc-alpine.in
@@ -249,9 +249,8 @@ lxc.cgroup.devices.allow = c 5:2 rwm
 lxc.cgroup.devices.allow = c 254:0 rm
 
 # mounts point
-lxc.mount.entry=proc proc proc nodev,noexec,nosuid 0 0
+lxc.mount.auto=cgroup:mixed proc:mixed sys:mixed
 lxc.mount.entry=run run tmpfs nodev,noexec,nosuid,relatime,size=1m,mode=0755 0 0
-lxc.mount.entry=none dev/pts devpts gid=5,mode=620 0 0
 lxc.mount.entry=shm dev/shm tmpfs nodev,nosuid,noexec,mode=1777 0 0
 
 EOF
diff --git a/templates/lxc-altlinux.in b/templates/lxc-altlinux.in
index ac4527b..8b4168c 100644
--- a/templates/lxc-altlinux.in
+++ b/templates/lxc-altlinux.in
@@ -266,7 +266,6 @@ copy_configuration()
 lxc.utsname = $name
 lxc.tty = 4
 lxc.pts = 1024
-lxc.mount = $config_path/fstab
 lxc.cap.drop = sys_module mac_admin mac_override sys_time
 
 # When using LXC with apparmor, uncomment the next line to run unconfined:
@@ -317,11 +316,8 @@ lxc.cgroup.devices.allow = c 136:* rwm
 lxc.cgroup.devices.allow = c 5:2 rwm
 # rtc
 lxc.cgroup.devices.allow = c 10:135 rwm
-EOF
 
-    cat <<EOF > $config_path/fstab
-proc            proc         proc    nodev,noexec,nosuid 0 0
-sysfs           sys          sysfs   defaults  0 0
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 EOF
 
     if [ $? -ne 0 ]; then
diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in
index 3cfa958..72531d6 100644
--- a/templates/lxc-busybox.in
+++ b/templates/lxc-busybox.in
@@ -74,7 +74,7 @@ $rootfs/usr/lib64"
     # minimal devices needed for busybox
     if [ $in_userns -eq 1 ]; then
         for dev in tty console tty0 tty1 ram0 null urandom; do
-            echo "/dev/$dev dev/$dev    none bind,optional,create=file 0 0" >> $path/fstab
+            echo "lxc.mount.entry = /dev/$dev dev/$dev    none bind,optional,create=file 0 0" >> $path/config
         done
     else
         mknod -m 666 tty c 5 0       || res=1
@@ -110,14 +110,6 @@ EOF
     # executable
     chmod 744 $rootfs/etc/init.d/rcS || return 1
 
-    # mount points
-    cat <<EOF >> $rootfs/etc/fstab
-shm   /dev/shm   tmpfs   defaults     0      0
-EOF
-
-    # writable and readable for other
-    chmod 644 $rootfs/etc/fstab || return 1
-
     # launch rcS first then make a console available
     # and propose a shell on the tty, the last one is
     # not needed
@@ -285,6 +277,9 @@ lxc.cap.drop = sys_module mac_admin mac_override sys_time
 
 # When using LXC with apparmor, uncomment the next line to run unconfined:
 #lxc.aa_profile = unconfined
+
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
+lxc.mount.entry = shm /dev/shm tmpfs defaults 0 0
 EOF
 
     libdirs="\
@@ -299,11 +294,6 @@ EOF
         fi
     done
     echo "lxc.mount.entry = /sys/kernel/security sys/kernel/security none ro,bind,optional 0 0" >>$path/config
-    echo "lxc.mount.auto = proc:mixed sys" >>$path/config
-
-    if [ -f "$path/fstab" ]; then
-        echo "lxc.mount = $path/fstab" >>$path/config
-    fi
 }
 
 remap_userns()
@@ -311,12 +301,12 @@ remap_userns()
     path=$1
 
     if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
-        chown $LXC_MAPPED_UID $path/config $path/fstab >/dev/null 2>&1
+        chown $LXC_MAPPED_UID $path/config >/dev/null 2>&1
         chown -R root $path/rootfs >/dev/null 2>&1
     fi
 
     if [ -n "$LXC_MAPPED_GID" ] && [ "$LXC_MAPPED_GID" != "-1" ]; then
-        chgrp $LXC_MAPPED_GID $path/config $path/fstab >/dev/null 2>&1
+        chgrp $LXC_MAPPED_GID $path/config >/dev/null 2>&1
         chgrp -R root $path/rootfs >/dev/null 2>&1
     fi
 }
diff --git a/templates/lxc-cirros.in b/templates/lxc-cirros.in
index c8a8b36..349cdbf 100644
--- a/templates/lxc-cirros.in
+++ b/templates/lxc-cirros.in
@@ -118,7 +118,6 @@ cat >> "$path/config" <<EOF
 # Template used to create this container: cirros
 
 lxc.rootfs = $rootfs
-#lxc.mount = $path/fstab
 lxc.pivotdir = lxc_putold
 
 lxc.tty = 4
@@ -132,7 +131,7 @@ lxc.cap.drop = sys_module mac_admin mac_override sys_time
 #lxc.aa_profile = unconfined
 # To support container nesting on an Ubuntu host, uncomment next two lines:
 #lxc.aa_profile = lxc-container-default-with-nesting
-#lxc.mount.auto = cgroup
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 
 lxc.cgroup.devices.deny = a
 # Allow any mknod (but not using the node)
@@ -165,7 +164,6 @@ EOF
 
     if [ $in_userns -eq 1 ] && [ -e "${LXC_TEMPLATE_CONFIG}/ubuntu-cloud.userns.conf" ]; then
         echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/ubuntu.userns.conf" >> $path/config
-        echo "lxc.mount.auto = cgroup:mixed proc:mixed sys:ro" >> $path/config
     fi
 
 }
diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index 05eee06..938f0db 100644
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
@@ -202,7 +202,6 @@ configure_debian_systemd()
 
     # This function has been copied and adapted from lxc-fedora
     rm -f ${rootfs}/etc/systemd/system/default.target
-    touch ${rootfs}/etc/fstab
     chroot ${rootfs} ln -s /dev/null /etc/systemd/system/udev.service
     chroot ${rootfs} ln -s /dev/null /etc/systemd/system/systemd-udevd.service
     chroot ${rootfs} ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
@@ -325,9 +324,6 @@ copy_configuration()
     arch=$4
 
     # Generate the configuration file
-    ## Create the fstab (empty by default)
-    touch $path/fstab
-
     # if there is exactly one veth network entry, make sure it has an
     # associated hwaddr.
     nics=`grep -e '^lxc\.network\.type[ \t]*=[ \t]*veth' $path/config | wc -l`
@@ -351,7 +347,6 @@ copy_configuration()
     grep -q "^lxc.rootfs" $path/config 2> /dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
 
     cat <<EOF >> $path/config
-lxc.mount = $path/fstab
 lxc.utsname = $hostname
 lxc.arch = $arch
 EOF
diff --git a/templates/lxc-openmandriva.in b/templates/lxc-openmandriva.in
index 46c829d..6123c5e 100644
--- a/templates/lxc-openmandriva.in
+++ b/templates/lxc-openmandriva.in
@@ -231,8 +231,8 @@ copy_configuration()
 lxc.utsname = $name
 lxc.tty = 4
 lxc.pts = 1024
-lxc.mount = $config_path/fstab
 lxc.cap.drop = sys_module mac_admin mac_override sys_time
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 
 # When using LXC with apparmor, uncomment the next line to run unconfined:
 #lxc.aa_profile = unconfined
@@ -284,11 +284,6 @@ lxc.cgroup.devices.allow = c 5:2 rwm
 lxc.cgroup.devices.allow = c 10:135 rwm
 EOF
 
-    cat <<EOF > $config_path/fstab
-proc            $rootfs_path/proc         proc    nodev,noexec,nosuid 0 0
-sysfs           $rootfs_path/sys          sysfs defaults  0 0
-EOF
-
     if [ $? -ne 0 ]; then
         echo "Failed to add configuration"
         return 1
diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
index bb015c8..4ff1dcf 100644
--- a/templates/lxc-opensuse.in
+++ b/templates/lxc-opensuse.in
@@ -321,7 +321,7 @@ lxc.include = @LXCTEMPLATECONFIG@/opensuse.common.conf
 lxc.arch = $arch
 lxc.utsname = $name
 
-lxc.mount = $path/fstab
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 
 # When using LXC with apparmor, uncomment the next line to run unconfined:
 #lxc.aa_profile = unconfined
@@ -340,12 +340,6 @@ lxc.mount = $path/fstab
 
 EOF
 
-    cat <<EOF > $path/fstab
-proc            proc         proc	nodev,noexec,nosuid 0 0
-sysfs           sys          sysfs	defaults  0 0
-tmpfs           run          tmpfs	mode=0755,nodev,nosuid 0 0
-EOF
-
     if [ $? -ne 0 ]; then
         echo "Failed to add configuration"
         return 1
diff --git a/templates/lxc-plamo.in b/templates/lxc-plamo.in
index 5061056..c588ddb 100644
--- a/templates/lxc-plamo.in
+++ b/templates/lxc-plamo.in
@@ -247,7 +247,6 @@ copy_configuration() {
   ret=0
   cat <<- EOF >> $path/config || let ret++
 	lxc.utsname = $name
-	lxc.mount = $path/fstab
 	lxc.arch = $arch
 	EOF
   if [ -f "@LXCTEMPLATECONFIG@/plamo.common.conf" ] ; then
@@ -256,8 +255,6 @@ copy_configuration() {
 	lxc.include = @LXCTEMPLATECONFIG@/plamo.common.conf
 	EOF
   fi
-  # create the fstab (empty by default)
-  touch $path/fstab || let ret++
   if [ $ret -ne 0 ] ; then
     echo "Failed to add configuration."
     return 1
@@ -274,7 +271,7 @@ do_bindhome() {
   # bind-mount the user's path into the container's /home
   h=`getent passwd $bindhome | cut -d: -f6`
   mkdir -p $rootfs/$h
-  echo "$h $rootfs/$h none bind 0 0" >> $path/fstab
+  echo "lxc.mount.entry = $h $rootfs/$h none bind 0 0" >> $path/config
   # copy /etc/passwd, /etc/shadow, and /etc/group entries into container
   if ! pwd=`getent passwd $bindhome` ; then
     echo "Warning: failed to copy password entry for $bindhome."
diff --git a/templates/lxc-sshd.in b/templates/lxc-sshd.in
index aa45c1d..d34b3b4 100644
--- a/templates/lxc-sshd.in
+++ b/templates/lxc-sshd.in
@@ -141,9 +141,9 @@ lxc.mount.entry = /usr usr none ro,bind 0 0
 lxc.mount.entry = /sbin sbin none ro,bind 0 0
 lxc.mount.entry = tmpfs var/run/sshd tmpfs mode=0644 0 0
 lxc.mount.entry = @LXCTEMPLATEDIR@/lxc-sshd sbin/init none ro,bind 0 0
-lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
-lxc.mount.entry = sysfs sys sysfs ro 0 0
 lxc.mount.entry = /etc/init.d etc/init.d none ro,bind 0 0
+
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 EOF
 
     # Oracle Linux and Fedora need the following two bind mounted
diff --git a/templates/lxc-ubuntu-cloud.in b/templates/lxc-ubuntu-cloud.in
index c4eb5ca..81abf2a 100644
--- a/templates/lxc-ubuntu-cloud.in
+++ b/templates/lxc-ubuntu-cloud.in
@@ -66,9 +66,6 @@ copy_configuration()
     fi
 
     # Generate the configuration file
-    ## Create the fstab (empty by default)
-    touch $path/fstab
-
     ## Relocate all the network config entries
     sed -i -e "/lxc.network/{w ${path}/config-network" -e "d}" $path/config
 
@@ -94,7 +91,6 @@ copy_configuration()
     [ -e "$path/config-auto" ] && cat $path/config-auto >> $path/config && rm $path/config-auto
     grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
     cat <<EOF >> $path/config
-lxc.mount = $path/fstab
 lxc.utsname = $name
 lxc.arch = $arch
 EOF
diff --git a/templates/lxc-ubuntu.in b/templates/lxc-ubuntu.in
index bbe7f7d..073724b 100644
--- a/templates/lxc-ubuntu.in
+++ b/templates/lxc-ubuntu.in
@@ -483,9 +483,6 @@ copy_configuration()
     fi
 
     # Generate the configuration file
-    ## Create the fstab (empty by default)
-    touch $path/fstab
-
     ## Relocate all the network config entries
     sed -i -e "/lxc.network/{w ${path}/config-network" -e "d}" $path/config
 
@@ -508,7 +505,6 @@ copy_configuration()
     [ -e "$path/config-auto" ] && cat $path/config-auto >> $path/config && rm $path/config-auto
     grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
     cat <<EOF >> $path/config
-lxc.mount = $path/fstab
 lxc.utsname = $name
 lxc.arch = $arch
 EOF
@@ -659,7 +655,7 @@ do_bindhome()
     while [ ${h2:0:1} = "/" ]; do
         h2=${h2#/}
     done
-    echo "$h $h2 none bind 0 0" >> $path/fstab
+    echo "lxc.mount.entry = $h $h2 none bind 0 0" >> $path/config
 
     # Make sure the group exists in container
     grp=`echo $pwd | cut -d: -f 4`  # group number for $user
-- 
1.9.1


From serge.hallyn at ubuntu.com  Thu Jan 29 01:53:12 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Thu, 29 Jan 2015 01:53:12 +0000
Subject: [lxc-devel] [PATCH] Use consistent /proc,
	/sys and /sys/fs/cgroup
In-Reply-To: <1422482234-730-1-git-send-email-stgraber@ubuntu.com>
References: <1422482234-730-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150129015312.GC16770@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
>  - Implements mixed mode for /sys where it's mounted read-only but with
>    /sys/devices/virtual/net/ writable.
> 
>  - Sets lxc.mount.auto to "cgroup:mixed proc:mixed sys:mixed" for all
>    templates.
> 
>  - Drop any template-specific mount for /proc, /sys or /sys/fs/cgroup.
> 
>  - Get rid of the fstab file by default, using lxc.mount.entry instead.
> 
> The read-only bind mount of /sys on top of itself is there so that
> mountall and other init systems don't attempt to remount /sys
> read-write.
> 
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
> ---
>  config/templates/archlinux.common.conf.in  |  3 ---
>  config/templates/centos.common.conf.in     |  3 ---
>  config/templates/common.conf.in            |  3 +++
>  config/templates/debian.common.conf.in     |  5 +----
>  config/templates/gentoo.common.conf.in     |  3 ---
>  config/templates/gentoo.moresecure.conf.in |  2 --
>  config/templates/openwrt.common.conf.in    |  4 ----
>  config/templates/oracle.common.conf.in     |  3 ---
>  config/templates/plamo.common.conf.in      |  1 -
>  config/templates/ubuntu.common.conf.in     |  5 +----
>  src/lxc/conf.c                             | 25 ++++++++++++++++---------
>  src/lxc/conf.h                             |  1 +
>  src/lxc/confile.c                          |  3 ++-
>  templates/lxc-alpine.in                    |  3 +--
>  templates/lxc-altlinux.in                  |  6 +-----
>  templates/lxc-busybox.in                   | 22 ++++++----------------
>  templates/lxc-cirros.in                    |  4 +---
>  templates/lxc-debian.in                    |  5 -----
>  templates/lxc-openmandriva.in              |  7 +------
>  templates/lxc-opensuse.in                  |  8 +-------
>  templates/lxc-plamo.in                     |  5 +----
>  templates/lxc-sshd.in                      |  4 ++--
>  templates/lxc-ubuntu-cloud.in              |  4 ----
>  templates/lxc-ubuntu.in                    |  6 +-----
>  24 files changed, 39 insertions(+), 96 deletions(-)
> 
> diff --git a/config/templates/archlinux.common.conf.in b/config/templates/archlinux.common.conf.in
> index 693f2f4..f869491 100644
> --- a/config/templates/archlinux.common.conf.in
> +++ b/config/templates/archlinux.common.conf.in
> @@ -8,9 +8,6 @@ lxc.tty = 6
>  lxc.haltsignal=SIGRTMIN+4
>  lxc.stopsignal=SIGRTMIN+14
>  
> -# Mount entries
> -lxc.mount.auto = proc:mixed sys:ro
> -
>  # Uncomment to disable creating tty devices subdirectory in /dev
>  # lxc.devttydir =
>  
> diff --git a/config/templates/centos.common.conf.in b/config/templates/centos.common.conf.in
> index 4ce2fda..ee2e9e1 100644
> --- a/config/templates/centos.common.conf.in
> +++ b/config/templates/centos.common.conf.in
> @@ -1,9 +1,6 @@
>  # This derives from the global common config
>  lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  
> -# Mount entries
> -lxc.mount.auto = proc:mixed sys:ro
> -
>  # Capabilities
>  # Uncomment these if you don't run anything that needs the capability, and
>  # would like the container to run with less privilege.
> diff --git a/config/templates/common.conf.in b/config/templates/common.conf.in
> index f22ef0c..26b3229 100644
> --- a/config/templates/common.conf.in
> +++ b/config/templates/common.conf.in
> @@ -43,6 +43,9 @@ lxc.cgroup.devices.allow = c 1:9 rwm
>  ### /dev/pts/*
>  lxc.cgroup.devices.allow = c 136:* rwm
>  
> +# Setup the default mounts
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
> +
>  # Blacklist some syscalls which are not safe in privileged
>  # containers
>  lxc.seccomp = @LXCTEMPLATECONFIG@/common.seccomp
> diff --git a/config/templates/debian.common.conf.in b/config/templates/debian.common.conf.in
> index e1d421f..493feee 100644
> --- a/config/templates/debian.common.conf.in
> +++ b/config/templates/debian.common.conf.in
> @@ -5,8 +5,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  lxc.devttydir =
>  
>  # Default mount entries
> -lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
> -lxc.mount.entry = sysfs sys sysfs defaults 0 0
>  lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
>  
>  # When using LXC with apparmor, the container will be confined by default.
> @@ -15,9 +13,8 @@ lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,opt
>  #lxc.aa_profile = unconfined
>  
>  # To support container nesting on an Ubuntu host while retaining most of
> -# apparmor's added security, use the following two lines instead.
> +# apparmor's added security, use the following line instead.
>  #lxc.aa_profile = lxc-container-default-with-nesting
> -#lxc.mount.auto = cgroup:mixed
>  
>  # If you wish to allow mounting block filesystems, then use the following
>  # line instead, and make sure to grant access to the block device and/or loop
> diff --git a/config/templates/gentoo.common.conf.in b/config/templates/gentoo.common.conf.in
> index 7b96672..01c8f48 100644
> --- a/config/templates/gentoo.common.conf.in
> +++ b/config/templates/gentoo.common.conf.in
> @@ -6,9 +6,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  # But security is not the goal.
>  # Looking for more security, see gentoo.moresecure.conf
>  
> -# Default mount entries
> -lxc.mount.entry=sys sys sysfs defaults 0 0
> -
>  # Doesn't support consoles in /dev/lxc/
>  lxc.devttydir =
>  
> diff --git a/config/templates/gentoo.moresecure.conf.in b/config/templates/gentoo.moresecure.conf.in
> index 238303d..270e9df 100644
> --- a/config/templates/gentoo.moresecure.conf.in
> +++ b/config/templates/gentoo.moresecure.conf.in
> @@ -8,8 +8,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  # Container user ? see gentoo.common.conf
>  
>  # do not mount sysfs, see http://blog.bofh.it/debian/id_413
> -# lxc.mount.entry=sys sys sysfs rw 0 0
> -lxc.mount.entry=proc proc proc ro,nodev,noexec,nosuid 0 0
>  lxc.mount.entry=mqueue dev/mqueue mqueue rw,nodev,noexec,nosuid 0 0
>  lxc.mount.entry=shm dev/shm tmpfs rw,nosuid,nodev,noexec,relatime 0 0
>  lxc.mount.entry=run run tmpfs rw,nosuid,nodev,relatime,mode=755 0 0
> diff --git a/config/templates/openwrt.common.conf.in b/config/templates/openwrt.common.conf.in
> index 05918f0..6609333 100644
> --- a/config/templates/openwrt.common.conf.in
> +++ b/config/templates/openwrt.common.conf.in
> @@ -1,7 +1,3 @@
> -# Default mount entries
> -lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
> -lxc.mount.entry = sysfs sys sysfs defaults 0 0
> -
>  # Default console settings
>  lxc.devttydir = lxc
>  lxc.tty = 4
> diff --git a/config/templates/oracle.common.conf.in b/config/templates/oracle.common.conf.in
> index 10522b2..8a72ad0 100644
> --- a/config/templates/oracle.common.conf.in
> +++ b/config/templates/oracle.common.conf.in
> @@ -1,9 +1,6 @@
>  # This derives from the global common config
>  lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  
> -# Mount entries
> -lxc.mount.auto = cgroup:mixed proc:mixed sys:ro
> -
>  # Capabilities
>  # Uncomment these if you don't run anything that needs the capability, and
>  # would like the container to run with less privilege.
> diff --git a/config/templates/plamo.common.conf.in b/config/templates/plamo.common.conf.in
> index 9b0d02b..e7809e1 100644
> --- a/config/templates/plamo.common.conf.in
> +++ b/config/templates/plamo.common.conf.in
> @@ -2,7 +2,6 @@
>  lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  
>  # Default mount
> -lxc.mount.auto = proc sys cgroup
>  lxc.mount.entry = none dev/shm tmpfs nosuid,nodev,noexec,mode=1777 0 0
>  
>  # Doesn't support consoles in /dev/lxc/
> diff --git a/config/templates/ubuntu.common.conf.in b/config/templates/ubuntu.common.conf.in
> index 19a6a67..d1ce8e9 100644
> --- a/config/templates/ubuntu.common.conf.in
> +++ b/config/templates/ubuntu.common.conf.in
> @@ -2,8 +2,6 @@
>  lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  
>  # Default mount entries
> -lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
> -lxc.mount.entry = sysfs sys sysfs defaults 0 0
>  lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
>  lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0
>  lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0
> @@ -15,9 +13,8 @@ lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0
>  #lxc.aa_profile = unconfined
>  
>  # To support container nesting on an Ubuntu host while retaining most of
> -# apparmor's added security, use the following two lines instead.
> +# apparmor's added security, use the following line instead.
>  #lxc.aa_profile = lxc-container-default-with-nesting
> -#lxc.mount.auto = cgroup:mixed
>  
>  # Uncomment the following line to autodetect squid-deb-proxy configuration on the
>  # host and forward it to the guest at start time.
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index e7def3e..5f98aa3 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -750,15 +750,21 @@ static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_ha
>  		 * MS_REMOUNT|MS_BIND|MS_RDONLY seems to work for kernels as low as
>  		 * 2.6.32...
>  		 */
> -		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc",                  "%r/proc",               "proc",  MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
> -		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys",           "%r/proc/sys",           NULL,    MS_BIND,                      NULL },
> -		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                    "%r/proc/sys",           NULL,    MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
> -		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger", "%r/proc/sysrq-trigger", NULL,    MS_BIND,                      NULL },
> -		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                    "%r/proc/sysrq-trigger", NULL,    MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
> -		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW,    "proc",                  "%r/proc",               "proc",  MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
> -		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RW,     "sysfs",                 "%r/sys",                "sysfs", 0,                            NULL },
> -		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RO,     "sysfs",                 "%r/sys",                "sysfs", MS_RDONLY,                    NULL },
> -		{ 0,                  0,                   NULL,                    NULL,                    NULL,    0,                            NULL }
> +		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc",                                              "%r/proc",                      "proc",     MS_NODEV|MS_NOEXEC|MS_NOSUID,   NULL },
> +		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys",                                       "%r/proc/sys",                  NULL,       MS_BIND,                        NULL },
> +		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                                                "%r/proc/sys",                  NULL,       MS_REMOUNT|MS_BIND|MS_RDONLY,   NULL },
> +		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger",                             "%r/proc/sysrq-trigger",        NULL,       MS_BIND,                        NULL },
> +		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                                                "%r/proc/sysrq-trigger",        NULL,       MS_REMOUNT|MS_BIND|MS_RDONLY,   NULL },
> +		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW,    "proc",                                              "%r/proc",                      "proc",     MS_NODEV|MS_NOEXEC|MS_NOSUID,   NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RW,     "sysfs",                                             "%r/sys",                       "sysfs",    0,                              NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RO,     "sysfs",                                             "%r/sys",                       "sysfs",    MS_RDONLY,                      NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "sysfs",                                             "%r/sys",                       "sysfs",    MS_NODEV|MS_NOEXEC|MS_NOSUID,   NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "%r/sys",                                            "%r/sys",                       NULL,       MS_BIND,                        NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  NULL,                                                "%r/sys",                       NULL,       MS_REMOUNT|MS_BIND|MS_RDONLY,   NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "sysfs",                                             "%r/sys/devices/virtual/net",   "sysfs",    0,                              NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "%r/sys/devices/virtual/net/devices/virtual/net",    "%r/sys/devices/virtual/net",   NULL,       MS_BIND,                        NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "%r/sys/devices/virtual/net/devices/virtual/net",    "%r/sys/devices/virtual/net",   NULL,       MS_REMOUNT|MS_BIND|MS_NOSUID|MS_NODEV|MS_NOEXEC,   NULL },

(without testing) it seems odd that here you're again doing
sys/devices/virtual/net/devices/virtual/net as the source, when you've
already bind-mounted that to /sys/devices/virtual/net.  Is this
doing what you'd expect?

Also, you are changing the semantics so that lxc.mount.auto = sys
becomes aliased to sys:mixed rather than sys:ro.  It does seem a
better default, but I'm worried about changing something people
may be depending on.

> +		{ 0,                  0,                   NULL,                                                NULL,                           NULL,       0,                              NULL }
>  	};
>  
>  	for (i = 0; default_mounts[i].match_mask; i++) {
> @@ -793,6 +799,7 @@ static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_ha
>  			saved_errno = errno;
>  			if (r < 0)
>  				SYSERROR("error mounting %s on %s flags %lu", source, destination, mflags);
> +
>  			free(source);
>  			free(destination);
>  			if (r < 0) {
> diff --git a/src/lxc/conf.h b/src/lxc/conf.h
> index 8ec3e8e..afa5517 100644
> --- a/src/lxc/conf.h
> +++ b/src/lxc/conf.h
> @@ -236,6 +236,7 @@ enum {
>  
>  	LXC_AUTO_SYS_RW               = 0x004,   /* /sys */
>  	LXC_AUTO_SYS_RO               = 0x008,   /* /sys read-only */
> +	LXC_AUTO_SYS_MIXED            = 0x00C,   /* /sys read-only and /sys/class/net read-write */
>  	LXC_AUTO_SYS_MASK             = 0x00C,
>  
>  	LXC_AUTO_CGROUP_RO            = 0x010,   /* /sys/fs/cgroup (partial mount, read-only) */
> diff --git a/src/lxc/confile.c b/src/lxc/confile.c
> index ccdf26c..8544ac9 100644
> --- a/src/lxc/confile.c
> +++ b/src/lxc/confile.c
> @@ -1416,8 +1416,9 @@ static int config_mount_auto(const char *key, const char *value,
>  		{ "proc",               LXC_AUTO_PROC_MASK,      LXC_AUTO_PROC_MIXED         },
>  		{ "proc:mixed",         LXC_AUTO_PROC_MASK,      LXC_AUTO_PROC_MIXED         },
>  		{ "proc:rw",            LXC_AUTO_PROC_MASK,      LXC_AUTO_PROC_RW            },
> -		{ "sys",                LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_RO             },
> +		{ "sys",                LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_MIXED          },
>  		{ "sys:ro",             LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_RO             },
> +		{ "sys:mixed",          LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_MIXED          },
>  		{ "sys:rw",             LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_RW             },
>  		{ "cgroup",             LXC_AUTO_CGROUP_MASK,    LXC_AUTO_CGROUP_NOSPEC      },
>  		{ "cgroup:mixed",       LXC_AUTO_CGROUP_MASK,    LXC_AUTO_CGROUP_MIXED       },
> diff --git a/templates/lxc-alpine.in b/templates/lxc-alpine.in
> index 187a032..886a838 100644
> --- a/templates/lxc-alpine.in
> +++ b/templates/lxc-alpine.in
> @@ -249,9 +249,8 @@ lxc.cgroup.devices.allow = c 5:2 rwm
>  lxc.cgroup.devices.allow = c 254:0 rm
>  
>  # mounts point
> -lxc.mount.entry=proc proc proc nodev,noexec,nosuid 0 0
> +lxc.mount.auto=cgroup:mixed proc:mixed sys:mixed
>  lxc.mount.entry=run run tmpfs nodev,noexec,nosuid,relatime,size=1m,mode=0755 0 0
> -lxc.mount.entry=none dev/pts devpts gid=5,mode=620 0 0
>  lxc.mount.entry=shm dev/shm tmpfs nodev,nosuid,noexec,mode=1777 0 0
>  
>  EOF
> diff --git a/templates/lxc-altlinux.in b/templates/lxc-altlinux.in
> index ac4527b..8b4168c 100644
> --- a/templates/lxc-altlinux.in
> +++ b/templates/lxc-altlinux.in
> @@ -266,7 +266,6 @@ copy_configuration()
>  lxc.utsname = $name
>  lxc.tty = 4
>  lxc.pts = 1024
> -lxc.mount = $config_path/fstab
>  lxc.cap.drop = sys_module mac_admin mac_override sys_time
>  
>  # When using LXC with apparmor, uncomment the next line to run unconfined:
> @@ -317,11 +316,8 @@ lxc.cgroup.devices.allow = c 136:* rwm
>  lxc.cgroup.devices.allow = c 5:2 rwm
>  # rtc
>  lxc.cgroup.devices.allow = c 10:135 rwm
> -EOF
>  
> -    cat <<EOF > $config_path/fstab
> -proc            proc         proc    nodev,noexec,nosuid 0 0
> -sysfs           sys          sysfs   defaults  0 0
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
>  EOF
>  
>      if [ $? -ne 0 ]; then
> diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in
> index 3cfa958..72531d6 100644
> --- a/templates/lxc-busybox.in
> +++ b/templates/lxc-busybox.in
> @@ -74,7 +74,7 @@ $rootfs/usr/lib64"
>      # minimal devices needed for busybox
>      if [ $in_userns -eq 1 ]; then
>          for dev in tty console tty0 tty1 ram0 null urandom; do
> -            echo "/dev/$dev dev/$dev    none bind,optional,create=file 0 0" >> $path/fstab
> +            echo "lxc.mount.entry = /dev/$dev dev/$dev    none bind,optional,create=file 0 0" >> $path/config
>          done
>      else
>          mknod -m 666 tty c 5 0       || res=1
> @@ -110,14 +110,6 @@ EOF
>      # executable
>      chmod 744 $rootfs/etc/init.d/rcS || return 1
>  
> -    # mount points
> -    cat <<EOF >> $rootfs/etc/fstab
> -shm   /dev/shm   tmpfs   defaults     0      0
> -EOF
> -
> -    # writable and readable for other
> -    chmod 644 $rootfs/etc/fstab || return 1
> -
>      # launch rcS first then make a console available
>      # and propose a shell on the tty, the last one is
>      # not needed
> @@ -285,6 +277,9 @@ lxc.cap.drop = sys_module mac_admin mac_override sys_time
>  
>  # When using LXC with apparmor, uncomment the next line to run unconfined:
>  #lxc.aa_profile = unconfined
> +
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
> +lxc.mount.entry = shm /dev/shm tmpfs defaults 0 0
>  EOF
>  
>      libdirs="\
> @@ -299,11 +294,6 @@ EOF
>          fi
>      done
>      echo "lxc.mount.entry = /sys/kernel/security sys/kernel/security none ro,bind,optional 0 0" >>$path/config
> -    echo "lxc.mount.auto = proc:mixed sys" >>$path/config
> -
> -    if [ -f "$path/fstab" ]; then
> -        echo "lxc.mount = $path/fstab" >>$path/config
> -    fi
>  }
>  
>  remap_userns()
> @@ -311,12 +301,12 @@ remap_userns()
>      path=$1
>  
>      if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
> -        chown $LXC_MAPPED_UID $path/config $path/fstab >/dev/null 2>&1
> +        chown $LXC_MAPPED_UID $path/config >/dev/null 2>&1
>          chown -R root $path/rootfs >/dev/null 2>&1
>      fi
>  
>      if [ -n "$LXC_MAPPED_GID" ] && [ "$LXC_MAPPED_GID" != "-1" ]; then
> -        chgrp $LXC_MAPPED_GID $path/config $path/fstab >/dev/null 2>&1
> +        chgrp $LXC_MAPPED_GID $path/config >/dev/null 2>&1
>          chgrp -R root $path/rootfs >/dev/null 2>&1
>      fi
>  }
> diff --git a/templates/lxc-cirros.in b/templates/lxc-cirros.in
> index c8a8b36..349cdbf 100644
> --- a/templates/lxc-cirros.in
> +++ b/templates/lxc-cirros.in
> @@ -118,7 +118,6 @@ cat >> "$path/config" <<EOF
>  # Template used to create this container: cirros
>  
>  lxc.rootfs = $rootfs
> -#lxc.mount = $path/fstab
>  lxc.pivotdir = lxc_putold
>  
>  lxc.tty = 4
> @@ -132,7 +131,7 @@ lxc.cap.drop = sys_module mac_admin mac_override sys_time
>  #lxc.aa_profile = unconfined
>  # To support container nesting on an Ubuntu host, uncomment next two lines:
>  #lxc.aa_profile = lxc-container-default-with-nesting
> -#lxc.mount.auto = cgroup
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
>  
>  lxc.cgroup.devices.deny = a
>  # Allow any mknod (but not using the node)
> @@ -165,7 +164,6 @@ EOF
>  
>      if [ $in_userns -eq 1 ] && [ -e "${LXC_TEMPLATE_CONFIG}/ubuntu-cloud.userns.conf" ]; then
>          echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/ubuntu.userns.conf" >> $path/config
> -        echo "lxc.mount.auto = cgroup:mixed proc:mixed sys:ro" >> $path/config
>      fi
>  
>  }
> diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
> index 05eee06..938f0db 100644
> --- a/templates/lxc-debian.in
> +++ b/templates/lxc-debian.in
> @@ -202,7 +202,6 @@ configure_debian_systemd()
>  
>      # This function has been copied and adapted from lxc-fedora
>      rm -f ${rootfs}/etc/systemd/system/default.target
> -    touch ${rootfs}/etc/fstab
>      chroot ${rootfs} ln -s /dev/null /etc/systemd/system/udev.service
>      chroot ${rootfs} ln -s /dev/null /etc/systemd/system/systemd-udevd.service
>      chroot ${rootfs} ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
> @@ -325,9 +324,6 @@ copy_configuration()
>      arch=$4
>  
>      # Generate the configuration file
> -    ## Create the fstab (empty by default)
> -    touch $path/fstab
> -
>      # if there is exactly one veth network entry, make sure it has an
>      # associated hwaddr.
>      nics=`grep -e '^lxc\.network\.type[ \t]*=[ \t]*veth' $path/config | wc -l`
> @@ -351,7 +347,6 @@ copy_configuration()
>      grep -q "^lxc.rootfs" $path/config 2> /dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
>  
>      cat <<EOF >> $path/config
> -lxc.mount = $path/fstab
>  lxc.utsname = $hostname
>  lxc.arch = $arch
>  EOF
> diff --git a/templates/lxc-openmandriva.in b/templates/lxc-openmandriva.in
> index 46c829d..6123c5e 100644
> --- a/templates/lxc-openmandriva.in
> +++ b/templates/lxc-openmandriva.in
> @@ -231,8 +231,8 @@ copy_configuration()
>  lxc.utsname = $name
>  lxc.tty = 4
>  lxc.pts = 1024
> -lxc.mount = $config_path/fstab
>  lxc.cap.drop = sys_module mac_admin mac_override sys_time
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
>  
>  # When using LXC with apparmor, uncomment the next line to run unconfined:
>  #lxc.aa_profile = unconfined
> @@ -284,11 +284,6 @@ lxc.cgroup.devices.allow = c 5:2 rwm
>  lxc.cgroup.devices.allow = c 10:135 rwm
>  EOF
>  
> -    cat <<EOF > $config_path/fstab
> -proc            $rootfs_path/proc         proc    nodev,noexec,nosuid 0 0
> -sysfs           $rootfs_path/sys          sysfs defaults  0 0
> -EOF
> -
>      if [ $? -ne 0 ]; then
>          echo "Failed to add configuration"
>          return 1
> diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
> index bb015c8..4ff1dcf 100644
> --- a/templates/lxc-opensuse.in
> +++ b/templates/lxc-opensuse.in
> @@ -321,7 +321,7 @@ lxc.include = @LXCTEMPLATECONFIG@/opensuse.common.conf
>  lxc.arch = $arch
>  lxc.utsname = $name
>  
> -lxc.mount = $path/fstab
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
>  
>  # When using LXC with apparmor, uncomment the next line to run unconfined:
>  #lxc.aa_profile = unconfined
> @@ -340,12 +340,6 @@ lxc.mount = $path/fstab
>  
>  EOF
>  
> -    cat <<EOF > $path/fstab
> -proc            proc         proc	nodev,noexec,nosuid 0 0
> -sysfs           sys          sysfs	defaults  0 0
> -tmpfs           run          tmpfs	mode=0755,nodev,nosuid 0 0
> -EOF
> -
>      if [ $? -ne 0 ]; then
>          echo "Failed to add configuration"
>          return 1
> diff --git a/templates/lxc-plamo.in b/templates/lxc-plamo.in
> index 5061056..c588ddb 100644
> --- a/templates/lxc-plamo.in
> +++ b/templates/lxc-plamo.in
> @@ -247,7 +247,6 @@ copy_configuration() {
>    ret=0
>    cat <<- EOF >> $path/config || let ret++
>  	lxc.utsname = $name
> -	lxc.mount = $path/fstab
>  	lxc.arch = $arch
>  	EOF
>    if [ -f "@LXCTEMPLATECONFIG@/plamo.common.conf" ] ; then
> @@ -256,8 +255,6 @@ copy_configuration() {
>  	lxc.include = @LXCTEMPLATECONFIG@/plamo.common.conf
>  	EOF
>    fi
> -  # create the fstab (empty by default)
> -  touch $path/fstab || let ret++
>    if [ $ret -ne 0 ] ; then
>      echo "Failed to add configuration."
>      return 1
> @@ -274,7 +271,7 @@ do_bindhome() {
>    # bind-mount the user's path into the container's /home
>    h=`getent passwd $bindhome | cut -d: -f6`
>    mkdir -p $rootfs/$h
> -  echo "$h $rootfs/$h none bind 0 0" >> $path/fstab
> +  echo "lxc.mount.entry = $h $rootfs/$h none bind 0 0" >> $path/config
>    # copy /etc/passwd, /etc/shadow, and /etc/group entries into container
>    if ! pwd=`getent passwd $bindhome` ; then
>      echo "Warning: failed to copy password entry for $bindhome."
> diff --git a/templates/lxc-sshd.in b/templates/lxc-sshd.in
> index aa45c1d..d34b3b4 100644
> --- a/templates/lxc-sshd.in
> +++ b/templates/lxc-sshd.in
> @@ -141,9 +141,9 @@ lxc.mount.entry = /usr usr none ro,bind 0 0
>  lxc.mount.entry = /sbin sbin none ro,bind 0 0
>  lxc.mount.entry = tmpfs var/run/sshd tmpfs mode=0644 0 0
>  lxc.mount.entry = @LXCTEMPLATEDIR@/lxc-sshd sbin/init none ro,bind 0 0
> -lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
> -lxc.mount.entry = sysfs sys sysfs ro 0 0
>  lxc.mount.entry = /etc/init.d etc/init.d none ro,bind 0 0
> +
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
>  EOF
>  
>      # Oracle Linux and Fedora need the following two bind mounted
> diff --git a/templates/lxc-ubuntu-cloud.in b/templates/lxc-ubuntu-cloud.in
> index c4eb5ca..81abf2a 100644
> --- a/templates/lxc-ubuntu-cloud.in
> +++ b/templates/lxc-ubuntu-cloud.in
> @@ -66,9 +66,6 @@ copy_configuration()
>      fi
>  
>      # Generate the configuration file
> -    ## Create the fstab (empty by default)
> -    touch $path/fstab
> -
>      ## Relocate all the network config entries
>      sed -i -e "/lxc.network/{w ${path}/config-network" -e "d}" $path/config
>  
> @@ -94,7 +91,6 @@ copy_configuration()
>      [ -e "$path/config-auto" ] && cat $path/config-auto >> $path/config && rm $path/config-auto
>      grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
>      cat <<EOF >> $path/config
> -lxc.mount = $path/fstab
>  lxc.utsname = $name
>  lxc.arch = $arch
>  EOF
> diff --git a/templates/lxc-ubuntu.in b/templates/lxc-ubuntu.in
> index bbe7f7d..073724b 100644
> --- a/templates/lxc-ubuntu.in
> +++ b/templates/lxc-ubuntu.in
> @@ -483,9 +483,6 @@ copy_configuration()
>      fi
>  
>      # Generate the configuration file
> -    ## Create the fstab (empty by default)
> -    touch $path/fstab
> -
>      ## Relocate all the network config entries
>      sed -i -e "/lxc.network/{w ${path}/config-network" -e "d}" $path/config
>  
> @@ -508,7 +505,6 @@ copy_configuration()
>      [ -e "$path/config-auto" ] && cat $path/config-auto >> $path/config && rm $path/config-auto
>      grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
>      cat <<EOF >> $path/config
> -lxc.mount = $path/fstab
>  lxc.utsname = $name
>  lxc.arch = $arch
>  EOF
> @@ -659,7 +655,7 @@ do_bindhome()
>      while [ ${h2:0:1} = "/" ]; do
>          h2=${h2#/}
>      done
> -    echo "$h $h2 none bind 0 0" >> $path/fstab
> +    echo "lxc.mount.entry = $h $h2 none bind 0 0" >> $path/config
>  
>      # Make sure the group exists in container
>      grp=`echo $pwd | cut -d: -f 4`  # group number for $user
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From stgraber at ubuntu.com  Thu Jan 29 09:16:51 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Thu, 29 Jan 2015 10:16:51 +0100
Subject: [lxc-devel] [PATCH] Use consistent /proc,
	/sys and /sys/fs/cgroup (v2)
Message-ID: <1422523011-16656-1-git-send-email-stgraber@ubuntu.com>

 - Implements mixed mode for /sys where it's mounted read-only but with
   /sys/devices/virtual/net/ writable.

 - Sets lxc.mount.auto to "cgroup:mixed proc:mixed sys:mixed" for all
   templates.

 - Drop any template-specific mount for /proc, /sys or /sys/fs/cgroup.

 - Get rid of the fstab file by default, using lxc.mount.entry instead.

 - Set sys:mixed as the default for "sys". sys:mixed is slightly more
   permissive than sys:ro so this shouldn't be a problem.

The read-only bind mount of /sys on top of itself is there so that
mountall and other init systems don't attempt to remount /sys
read-write.

v2 changes:
 - Fix the mount list, don't specify a source for the remount.
 - Update the documentation.

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 config/templates/archlinux.common.conf.in  |  3 ---
 config/templates/centos.common.conf.in     |  3 ---
 config/templates/common.conf.in            |  3 +++
 config/templates/debian.common.conf.in     |  5 +----
 config/templates/gentoo.common.conf.in     |  3 ---
 config/templates/gentoo.moresecure.conf.in |  2 --
 config/templates/openwrt.common.conf.in    |  4 ----
 config/templates/oracle.common.conf.in     |  3 ---
 config/templates/plamo.common.conf.in      |  1 -
 config/templates/ubuntu.common.conf.in     |  5 +----
 doc/lxc.container.conf.sgml.in             |  9 ++++++++-
 src/lxc/conf.c                             | 25 ++++++++++++++++---------
 src/lxc/conf.h                             |  1 +
 src/lxc/confile.c                          |  3 ++-
 templates/lxc-alpine.in                    |  3 +--
 templates/lxc-altlinux.in                  |  6 +-----
 templates/lxc-busybox.in                   | 22 ++++++----------------
 templates/lxc-cirros.in                    |  4 +---
 templates/lxc-debian.in                    |  5 -----
 templates/lxc-openmandriva.in              |  7 +------
 templates/lxc-opensuse.in                  |  8 +-------
 templates/lxc-plamo.in                     |  5 +----
 templates/lxc-sshd.in                      |  4 ++--
 templates/lxc-ubuntu-cloud.in              |  4 ----
 templates/lxc-ubuntu.in                    |  6 +-----
 25 files changed, 47 insertions(+), 97 deletions(-)

diff --git a/config/templates/archlinux.common.conf.in b/config/templates/archlinux.common.conf.in
index 693f2f4..f869491 100644
--- a/config/templates/archlinux.common.conf.in
+++ b/config/templates/archlinux.common.conf.in
@@ -8,9 +8,6 @@ lxc.tty = 6
 lxc.haltsignal=SIGRTMIN+4
 lxc.stopsignal=SIGRTMIN+14
 
-# Mount entries
-lxc.mount.auto = proc:mixed sys:ro
-
 # Uncomment to disable creating tty devices subdirectory in /dev
 # lxc.devttydir =
 
diff --git a/config/templates/centos.common.conf.in b/config/templates/centos.common.conf.in
index 4ce2fda..ee2e9e1 100644
--- a/config/templates/centos.common.conf.in
+++ b/config/templates/centos.common.conf.in
@@ -1,9 +1,6 @@
 # This derives from the global common config
 lxc.include = @LXCTEMPLATECONFIG@/common.conf
 
-# Mount entries
-lxc.mount.auto = proc:mixed sys:ro
-
 # Capabilities
 # Uncomment these if you don't run anything that needs the capability, and
 # would like the container to run with less privilege.
diff --git a/config/templates/common.conf.in b/config/templates/common.conf.in
index f22ef0c..26b3229 100644
--- a/config/templates/common.conf.in
+++ b/config/templates/common.conf.in
@@ -43,6 +43,9 @@ lxc.cgroup.devices.allow = c 1:9 rwm
 ### /dev/pts/*
 lxc.cgroup.devices.allow = c 136:* rwm
 
+# Setup the default mounts
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
+
 # Blacklist some syscalls which are not safe in privileged
 # containers
 lxc.seccomp = @LXCTEMPLATECONFIG@/common.seccomp
diff --git a/config/templates/debian.common.conf.in b/config/templates/debian.common.conf.in
index e1d421f..493feee 100644
--- a/config/templates/debian.common.conf.in
+++ b/config/templates/debian.common.conf.in
@@ -5,8 +5,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
 lxc.devttydir =
 
 # Default mount entries
-lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
-lxc.mount.entry = sysfs sys sysfs defaults 0 0
 lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
 
 # When using LXC with apparmor, the container will be confined by default.
@@ -15,9 +13,8 @@ lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,opt
 #lxc.aa_profile = unconfined
 
 # To support container nesting on an Ubuntu host while retaining most of
-# apparmor's added security, use the following two lines instead.
+# apparmor's added security, use the following line instead.
 #lxc.aa_profile = lxc-container-default-with-nesting
-#lxc.mount.auto = cgroup:mixed
 
 # If you wish to allow mounting block filesystems, then use the following
 # line instead, and make sure to grant access to the block device and/or loop
diff --git a/config/templates/gentoo.common.conf.in b/config/templates/gentoo.common.conf.in
index 7b96672..01c8f48 100644
--- a/config/templates/gentoo.common.conf.in
+++ b/config/templates/gentoo.common.conf.in
@@ -6,9 +6,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
 # But security is not the goal.
 # Looking for more security, see gentoo.moresecure.conf
 
-# Default mount entries
-lxc.mount.entry=sys sys sysfs defaults 0 0
-
 # Doesn't support consoles in /dev/lxc/
 lxc.devttydir =
 
diff --git a/config/templates/gentoo.moresecure.conf.in b/config/templates/gentoo.moresecure.conf.in
index 238303d..270e9df 100644
--- a/config/templates/gentoo.moresecure.conf.in
+++ b/config/templates/gentoo.moresecure.conf.in
@@ -8,8 +8,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
 # Container user ? see gentoo.common.conf
 
 # do not mount sysfs, see http://blog.bofh.it/debian/id_413
-# lxc.mount.entry=sys sys sysfs rw 0 0
-lxc.mount.entry=proc proc proc ro,nodev,noexec,nosuid 0 0
 lxc.mount.entry=mqueue dev/mqueue mqueue rw,nodev,noexec,nosuid 0 0
 lxc.mount.entry=shm dev/shm tmpfs rw,nosuid,nodev,noexec,relatime 0 0
 lxc.mount.entry=run run tmpfs rw,nosuid,nodev,relatime,mode=755 0 0
diff --git a/config/templates/openwrt.common.conf.in b/config/templates/openwrt.common.conf.in
index 05918f0..6609333 100644
--- a/config/templates/openwrt.common.conf.in
+++ b/config/templates/openwrt.common.conf.in
@@ -1,7 +1,3 @@
-# Default mount entries
-lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
-lxc.mount.entry = sysfs sys sysfs defaults 0 0
-
 # Default console settings
 lxc.devttydir = lxc
 lxc.tty = 4
diff --git a/config/templates/oracle.common.conf.in b/config/templates/oracle.common.conf.in
index 10522b2..8a72ad0 100644
--- a/config/templates/oracle.common.conf.in
+++ b/config/templates/oracle.common.conf.in
@@ -1,9 +1,6 @@
 # This derives from the global common config
 lxc.include = @LXCTEMPLATECONFIG@/common.conf
 
-# Mount entries
-lxc.mount.auto = cgroup:mixed proc:mixed sys:ro
-
 # Capabilities
 # Uncomment these if you don't run anything that needs the capability, and
 # would like the container to run with less privilege.
diff --git a/config/templates/plamo.common.conf.in b/config/templates/plamo.common.conf.in
index 9b0d02b..e7809e1 100644
--- a/config/templates/plamo.common.conf.in
+++ b/config/templates/plamo.common.conf.in
@@ -2,7 +2,6 @@
 lxc.include = @LXCTEMPLATECONFIG@/common.conf
 
 # Default mount
-lxc.mount.auto = proc sys cgroup
 lxc.mount.entry = none dev/shm tmpfs nosuid,nodev,noexec,mode=1777 0 0
 
 # Doesn't support consoles in /dev/lxc/
diff --git a/config/templates/ubuntu.common.conf.in b/config/templates/ubuntu.common.conf.in
index 19a6a67..d1ce8e9 100644
--- a/config/templates/ubuntu.common.conf.in
+++ b/config/templates/ubuntu.common.conf.in
@@ -2,8 +2,6 @@
 lxc.include = @LXCTEMPLATECONFIG@/common.conf
 
 # Default mount entries
-lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
-lxc.mount.entry = sysfs sys sysfs defaults 0 0
 lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
 lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0
 lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0
@@ -15,9 +13,8 @@ lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0
 #lxc.aa_profile = unconfined
 
 # To support container nesting on an Ubuntu host while retaining most of
-# apparmor's added security, use the following two lines instead.
+# apparmor's added security, use the following line instead.
 #lxc.aa_profile = lxc-container-default-with-nesting
-#lxc.mount.auto = cgroup:mixed
 
 # Uncomment the following line to autodetect squid-deb-proxy configuration on the
 # host and forward it to the guest at start time.
diff --git a/doc/lxc.container.conf.sgml.in b/doc/lxc.container.conf.sgml.in
index a86b1e5..50c6a2a 100644
--- a/doc/lxc.container.conf.sgml.in
+++ b/doc/lxc.container.conf.sgml.in
@@ -774,7 +774,14 @@ proc proc proc nodev,noexec,nosuid 0 0
               </listitem>
               <listitem>
                 <para>
-                  <option>sys:ro</option> (or <option>sys</option>):
+                  <option>sys:mixed</option> (or <option>sys</option>):
+                  mount <filename>/sys</filename> as read-only but with
+                  /sys/devices/virtual/net writable.
+                </para>
+              </listitem>
+              <listitem>
+                <para>
+                  <option>sys:ro</option>:
                   mount <filename>/sys</filename> as read-only
                   for security / container isolation purposes.
                 </para>
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index e7def3e..d2cfbe8 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -750,15 +750,21 @@ static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_ha
 		 * MS_REMOUNT|MS_BIND|MS_RDONLY seems to work for kernels as low as
 		 * 2.6.32...
 		 */
-		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc",                  "%r/proc",               "proc",  MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
-		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys",           "%r/proc/sys",           NULL,    MS_BIND,                      NULL },
-		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                    "%r/proc/sys",           NULL,    MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
-		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger", "%r/proc/sysrq-trigger", NULL,    MS_BIND,                      NULL },
-		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                    "%r/proc/sysrq-trigger", NULL,    MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
-		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW,    "proc",                  "%r/proc",               "proc",  MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
-		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RW,     "sysfs",                 "%r/sys",                "sysfs", 0,                            NULL },
-		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RO,     "sysfs",                 "%r/sys",                "sysfs", MS_RDONLY,                    NULL },
-		{ 0,                  0,                   NULL,                    NULL,                    NULL,    0,                            NULL }
+		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc",                                              "%r/proc",                      "proc",     MS_NODEV|MS_NOEXEC|MS_NOSUID,   NULL },
+		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys",                                       "%r/proc/sys",                  NULL,       MS_BIND,                        NULL },
+		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                                                "%r/proc/sys",                  NULL,       MS_REMOUNT|MS_BIND|MS_RDONLY,   NULL },
+		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger",                             "%r/proc/sysrq-trigger",        NULL,       MS_BIND,                        NULL },
+		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                                                "%r/proc/sysrq-trigger",        NULL,       MS_REMOUNT|MS_BIND|MS_RDONLY,   NULL },
+		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW,    "proc",                                              "%r/proc",                      "proc",     MS_NODEV|MS_NOEXEC|MS_NOSUID,   NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RW,     "sysfs",                                             "%r/sys",                       "sysfs",    0,                              NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RO,     "sysfs",                                             "%r/sys",                       "sysfs",    MS_RDONLY,                      NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "sysfs",                                             "%r/sys",                       "sysfs",    MS_NODEV|MS_NOEXEC|MS_NOSUID,   NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "%r/sys",                                            "%r/sys",                       NULL,       MS_BIND,                        NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  NULL,                                                "%r/sys",                       NULL,       MS_REMOUNT|MS_BIND|MS_RDONLY,   NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "sysfs",                                             "%r/sys/devices/virtual/net",   "sysfs",    0,                              NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "%r/sys/devices/virtual/net/devices/virtual/net",    "%r/sys/devices/virtual/net",   NULL,       MS_BIND,                        NULL },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  NULL,                                                "%r/sys/devices/virtual/net",   NULL,       MS_REMOUNT|MS_BIND|MS_NOSUID|MS_NODEV|MS_NOEXEC,   NULL },
+		{ 0,                  0,                   NULL,                                                NULL,                           NULL,       0,                              NULL }
 	};
 
 	for (i = 0; default_mounts[i].match_mask; i++) {
@@ -793,6 +799,7 @@ static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_ha
 			saved_errno = errno;
 			if (r < 0)
 				SYSERROR("error mounting %s on %s flags %lu", source, destination, mflags);
+
 			free(source);
 			free(destination);
 			if (r < 0) {
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 8ec3e8e..afa5517 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -236,6 +236,7 @@ enum {
 
 	LXC_AUTO_SYS_RW               = 0x004,   /* /sys */
 	LXC_AUTO_SYS_RO               = 0x008,   /* /sys read-only */
+	LXC_AUTO_SYS_MIXED            = 0x00C,   /* /sys read-only and /sys/class/net read-write */
 	LXC_AUTO_SYS_MASK             = 0x00C,
 
 	LXC_AUTO_CGROUP_RO            = 0x010,   /* /sys/fs/cgroup (partial mount, read-only) */
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index ccdf26c..8544ac9 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -1416,8 +1416,9 @@ static int config_mount_auto(const char *key, const char *value,
 		{ "proc",               LXC_AUTO_PROC_MASK,      LXC_AUTO_PROC_MIXED         },
 		{ "proc:mixed",         LXC_AUTO_PROC_MASK,      LXC_AUTO_PROC_MIXED         },
 		{ "proc:rw",            LXC_AUTO_PROC_MASK,      LXC_AUTO_PROC_RW            },
-		{ "sys",                LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_RO             },
+		{ "sys",                LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_MIXED          },
 		{ "sys:ro",             LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_RO             },
+		{ "sys:mixed",          LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_MIXED          },
 		{ "sys:rw",             LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_RW             },
 		{ "cgroup",             LXC_AUTO_CGROUP_MASK,    LXC_AUTO_CGROUP_NOSPEC      },
 		{ "cgroup:mixed",       LXC_AUTO_CGROUP_MASK,    LXC_AUTO_CGROUP_MIXED       },
diff --git a/templates/lxc-alpine.in b/templates/lxc-alpine.in
index 187a032..886a838 100644
--- a/templates/lxc-alpine.in
+++ b/templates/lxc-alpine.in
@@ -249,9 +249,8 @@ lxc.cgroup.devices.allow = c 5:2 rwm
 lxc.cgroup.devices.allow = c 254:0 rm
 
 # mounts point
-lxc.mount.entry=proc proc proc nodev,noexec,nosuid 0 0
+lxc.mount.auto=cgroup:mixed proc:mixed sys:mixed
 lxc.mount.entry=run run tmpfs nodev,noexec,nosuid,relatime,size=1m,mode=0755 0 0
-lxc.mount.entry=none dev/pts devpts gid=5,mode=620 0 0
 lxc.mount.entry=shm dev/shm tmpfs nodev,nosuid,noexec,mode=1777 0 0
 
 EOF
diff --git a/templates/lxc-altlinux.in b/templates/lxc-altlinux.in
index ac4527b..8b4168c 100644
--- a/templates/lxc-altlinux.in
+++ b/templates/lxc-altlinux.in
@@ -266,7 +266,6 @@ copy_configuration()
 lxc.utsname = $name
 lxc.tty = 4
 lxc.pts = 1024
-lxc.mount = $config_path/fstab
 lxc.cap.drop = sys_module mac_admin mac_override sys_time
 
 # When using LXC with apparmor, uncomment the next line to run unconfined:
@@ -317,11 +316,8 @@ lxc.cgroup.devices.allow = c 136:* rwm
 lxc.cgroup.devices.allow = c 5:2 rwm
 # rtc
 lxc.cgroup.devices.allow = c 10:135 rwm
-EOF
 
-    cat <<EOF > $config_path/fstab
-proc            proc         proc    nodev,noexec,nosuid 0 0
-sysfs           sys          sysfs   defaults  0 0
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 EOF
 
     if [ $? -ne 0 ]; then
diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in
index 3cfa958..72531d6 100644
--- a/templates/lxc-busybox.in
+++ b/templates/lxc-busybox.in
@@ -74,7 +74,7 @@ $rootfs/usr/lib64"
     # minimal devices needed for busybox
     if [ $in_userns -eq 1 ]; then
         for dev in tty console tty0 tty1 ram0 null urandom; do
-            echo "/dev/$dev dev/$dev    none bind,optional,create=file 0 0" >> $path/fstab
+            echo "lxc.mount.entry = /dev/$dev dev/$dev    none bind,optional,create=file 0 0" >> $path/config
         done
     else
         mknod -m 666 tty c 5 0       || res=1
@@ -110,14 +110,6 @@ EOF
     # executable
     chmod 744 $rootfs/etc/init.d/rcS || return 1
 
-    # mount points
-    cat <<EOF >> $rootfs/etc/fstab
-shm   /dev/shm   tmpfs   defaults     0      0
-EOF
-
-    # writable and readable for other
-    chmod 644 $rootfs/etc/fstab || return 1
-
     # launch rcS first then make a console available
     # and propose a shell on the tty, the last one is
     # not needed
@@ -285,6 +277,9 @@ lxc.cap.drop = sys_module mac_admin mac_override sys_time
 
 # When using LXC with apparmor, uncomment the next line to run unconfined:
 #lxc.aa_profile = unconfined
+
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
+lxc.mount.entry = shm /dev/shm tmpfs defaults 0 0
 EOF
 
     libdirs="\
@@ -299,11 +294,6 @@ EOF
         fi
     done
     echo "lxc.mount.entry = /sys/kernel/security sys/kernel/security none ro,bind,optional 0 0" >>$path/config
-    echo "lxc.mount.auto = proc:mixed sys" >>$path/config
-
-    if [ -f "$path/fstab" ]; then
-        echo "lxc.mount = $path/fstab" >>$path/config
-    fi
 }
 
 remap_userns()
@@ -311,12 +301,12 @@ remap_userns()
     path=$1
 
     if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
-        chown $LXC_MAPPED_UID $path/config $path/fstab >/dev/null 2>&1
+        chown $LXC_MAPPED_UID $path/config >/dev/null 2>&1
         chown -R root $path/rootfs >/dev/null 2>&1
     fi
 
     if [ -n "$LXC_MAPPED_GID" ] && [ "$LXC_MAPPED_GID" != "-1" ]; then
-        chgrp $LXC_MAPPED_GID $path/config $path/fstab >/dev/null 2>&1
+        chgrp $LXC_MAPPED_GID $path/config >/dev/null 2>&1
         chgrp -R root $path/rootfs >/dev/null 2>&1
     fi
 }
diff --git a/templates/lxc-cirros.in b/templates/lxc-cirros.in
index c8a8b36..349cdbf 100644
--- a/templates/lxc-cirros.in
+++ b/templates/lxc-cirros.in
@@ -118,7 +118,6 @@ cat >> "$path/config" <<EOF
 # Template used to create this container: cirros
 
 lxc.rootfs = $rootfs
-#lxc.mount = $path/fstab
 lxc.pivotdir = lxc_putold
 
 lxc.tty = 4
@@ -132,7 +131,7 @@ lxc.cap.drop = sys_module mac_admin mac_override sys_time
 #lxc.aa_profile = unconfined
 # To support container nesting on an Ubuntu host, uncomment next two lines:
 #lxc.aa_profile = lxc-container-default-with-nesting
-#lxc.mount.auto = cgroup
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 
 lxc.cgroup.devices.deny = a
 # Allow any mknod (but not using the node)
@@ -165,7 +164,6 @@ EOF
 
     if [ $in_userns -eq 1 ] && [ -e "${LXC_TEMPLATE_CONFIG}/ubuntu-cloud.userns.conf" ]; then
         echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/ubuntu.userns.conf" >> $path/config
-        echo "lxc.mount.auto = cgroup:mixed proc:mixed sys:ro" >> $path/config
     fi
 
 }
diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index 05eee06..938f0db 100644
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
@@ -202,7 +202,6 @@ configure_debian_systemd()
 
     # This function has been copied and adapted from lxc-fedora
     rm -f ${rootfs}/etc/systemd/system/default.target
-    touch ${rootfs}/etc/fstab
     chroot ${rootfs} ln -s /dev/null /etc/systemd/system/udev.service
     chroot ${rootfs} ln -s /dev/null /etc/systemd/system/systemd-udevd.service
     chroot ${rootfs} ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
@@ -325,9 +324,6 @@ copy_configuration()
     arch=$4
 
     # Generate the configuration file
-    ## Create the fstab (empty by default)
-    touch $path/fstab
-
     # if there is exactly one veth network entry, make sure it has an
     # associated hwaddr.
     nics=`grep -e '^lxc\.network\.type[ \t]*=[ \t]*veth' $path/config | wc -l`
@@ -351,7 +347,6 @@ copy_configuration()
     grep -q "^lxc.rootfs" $path/config 2> /dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
 
     cat <<EOF >> $path/config
-lxc.mount = $path/fstab
 lxc.utsname = $hostname
 lxc.arch = $arch
 EOF
diff --git a/templates/lxc-openmandriva.in b/templates/lxc-openmandriva.in
index 46c829d..6123c5e 100644
--- a/templates/lxc-openmandriva.in
+++ b/templates/lxc-openmandriva.in
@@ -231,8 +231,8 @@ copy_configuration()
 lxc.utsname = $name
 lxc.tty = 4
 lxc.pts = 1024
-lxc.mount = $config_path/fstab
 lxc.cap.drop = sys_module mac_admin mac_override sys_time
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 
 # When using LXC with apparmor, uncomment the next line to run unconfined:
 #lxc.aa_profile = unconfined
@@ -284,11 +284,6 @@ lxc.cgroup.devices.allow = c 5:2 rwm
 lxc.cgroup.devices.allow = c 10:135 rwm
 EOF
 
-    cat <<EOF > $config_path/fstab
-proc            $rootfs_path/proc         proc    nodev,noexec,nosuid 0 0
-sysfs           $rootfs_path/sys          sysfs defaults  0 0
-EOF
-
     if [ $? -ne 0 ]; then
         echo "Failed to add configuration"
         return 1
diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
index bb015c8..4ff1dcf 100644
--- a/templates/lxc-opensuse.in
+++ b/templates/lxc-opensuse.in
@@ -321,7 +321,7 @@ lxc.include = @LXCTEMPLATECONFIG@/opensuse.common.conf
 lxc.arch = $arch
 lxc.utsname = $name
 
-lxc.mount = $path/fstab
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 
 # When using LXC with apparmor, uncomment the next line to run unconfined:
 #lxc.aa_profile = unconfined
@@ -340,12 +340,6 @@ lxc.mount = $path/fstab
 
 EOF
 
-    cat <<EOF > $path/fstab
-proc            proc         proc	nodev,noexec,nosuid 0 0
-sysfs           sys          sysfs	defaults  0 0
-tmpfs           run          tmpfs	mode=0755,nodev,nosuid 0 0
-EOF
-
     if [ $? -ne 0 ]; then
         echo "Failed to add configuration"
         return 1
diff --git a/templates/lxc-plamo.in b/templates/lxc-plamo.in
index 5061056..c588ddb 100644
--- a/templates/lxc-plamo.in
+++ b/templates/lxc-plamo.in
@@ -247,7 +247,6 @@ copy_configuration() {
   ret=0
   cat <<- EOF >> $path/config || let ret++
 	lxc.utsname = $name
-	lxc.mount = $path/fstab
 	lxc.arch = $arch
 	EOF
   if [ -f "@LXCTEMPLATECONFIG@/plamo.common.conf" ] ; then
@@ -256,8 +255,6 @@ copy_configuration() {
 	lxc.include = @LXCTEMPLATECONFIG@/plamo.common.conf
 	EOF
   fi
-  # create the fstab (empty by default)
-  touch $path/fstab || let ret++
   if [ $ret -ne 0 ] ; then
     echo "Failed to add configuration."
     return 1
@@ -274,7 +271,7 @@ do_bindhome() {
   # bind-mount the user's path into the container's /home
   h=`getent passwd $bindhome | cut -d: -f6`
   mkdir -p $rootfs/$h
-  echo "$h $rootfs/$h none bind 0 0" >> $path/fstab
+  echo "lxc.mount.entry = $h $rootfs/$h none bind 0 0" >> $path/config
   # copy /etc/passwd, /etc/shadow, and /etc/group entries into container
   if ! pwd=`getent passwd $bindhome` ; then
     echo "Warning: failed to copy password entry for $bindhome."
diff --git a/templates/lxc-sshd.in b/templates/lxc-sshd.in
index aa45c1d..d34b3b4 100644
--- a/templates/lxc-sshd.in
+++ b/templates/lxc-sshd.in
@@ -141,9 +141,9 @@ lxc.mount.entry = /usr usr none ro,bind 0 0
 lxc.mount.entry = /sbin sbin none ro,bind 0 0
 lxc.mount.entry = tmpfs var/run/sshd tmpfs mode=0644 0 0
 lxc.mount.entry = @LXCTEMPLATEDIR@/lxc-sshd sbin/init none ro,bind 0 0
-lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
-lxc.mount.entry = sysfs sys sysfs ro 0 0
 lxc.mount.entry = /etc/init.d etc/init.d none ro,bind 0 0
+
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 EOF
 
     # Oracle Linux and Fedora need the following two bind mounted
diff --git a/templates/lxc-ubuntu-cloud.in b/templates/lxc-ubuntu-cloud.in
index c4eb5ca..81abf2a 100644
--- a/templates/lxc-ubuntu-cloud.in
+++ b/templates/lxc-ubuntu-cloud.in
@@ -66,9 +66,6 @@ copy_configuration()
     fi
 
     # Generate the configuration file
-    ## Create the fstab (empty by default)
-    touch $path/fstab
-
     ## Relocate all the network config entries
     sed -i -e "/lxc.network/{w ${path}/config-network" -e "d}" $path/config
 
@@ -94,7 +91,6 @@ copy_configuration()
     [ -e "$path/config-auto" ] && cat $path/config-auto >> $path/config && rm $path/config-auto
     grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
     cat <<EOF >> $path/config
-lxc.mount = $path/fstab
 lxc.utsname = $name
 lxc.arch = $arch
 EOF
diff --git a/templates/lxc-ubuntu.in b/templates/lxc-ubuntu.in
index bbe7f7d..073724b 100644
--- a/templates/lxc-ubuntu.in
+++ b/templates/lxc-ubuntu.in
@@ -483,9 +483,6 @@ copy_configuration()
     fi
 
     # Generate the configuration file
-    ## Create the fstab (empty by default)
-    touch $path/fstab
-
     ## Relocate all the network config entries
     sed -i -e "/lxc.network/{w ${path}/config-network" -e "d}" $path/config
 
@@ -508,7 +505,6 @@ copy_configuration()
     [ -e "$path/config-auto" ] && cat $path/config-auto >> $path/config && rm $path/config-auto
     grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
     cat <<EOF >> $path/config
-lxc.mount = $path/fstab
 lxc.utsname = $name
 lxc.arch = $arch
 EOF
@@ -659,7 +655,7 @@ do_bindhome()
     while [ ${h2:0:1} = "/" ]; do
         h2=${h2#/}
     done
-    echo "$h $h2 none bind 0 0" >> $path/fstab
+    echo "lxc.mount.entry = $h $h2 none bind 0 0" >> $path/config
 
     # Make sure the group exists in container
     grp=`echo $pwd | cut -d: -f 4`  # group number for $user
-- 
1.9.1


From serge.hallyn at ubuntu.com  Thu Jan 29 10:13:36 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Thu, 29 Jan 2015 10:13:36 +0000
Subject: [lxc-devel] [PATCH] create lxc.tty ptys from container process
Message-ID: <20150129101336.GD16770@ubuntumail>

Lxc has always created the ptys for use by console and ttys early
on from the monitor process.  This has some advantages, but also
has disadvantages, namely (1) container ptys counting against the
max ptys for the host, and (2) not having a /dev/pts/N in the
container to pass to getty.  (2) was not a problem for us historically
because we bind-mounted the host's /dev/pts/N onto a /dev/ttyN in
the container.  However, systemd hardocdes a check for container_ttys
that the path have 'pts/' in it.  If it were only for (2) I'd have
opted for a systemd patch to check the device major number, but (1)
made it worth moving the openpty to the container namespace.

So this patch moves the tty creation into the task which becomes
the container init.  It then passes the fds for the opened ptys
back to the monitor over a unix socketpair (for use by lxc-console).
The /dev/console is still created in the monitor process, so that
it can for instance be used by lxc.logfd.

So now if you have a foreground container with lxc.tty = 4, you
should end up with one host /dev/pts entry per container rather than 5.

And lxc-console now works with systemd containers.

Note that if the container init mounts its own devpts over the
one mounted by lxc, the tty /dev/pts/n will be hidden.  This is ok
since it's only systemd that needs it, and systemd won't do that.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 config/apparmor/abstractions/start-container      |   1 +
 config/apparmor/profiles/lxc-default-with-nesting |   2 +-
 src/lxc/conf.c                                    | 100 +++++++++++++++-------
 src/lxc/start.c                                   |  61 +++++++++++--
 src/lxc/start.h                                   |   1 +
 5 files changed, 127 insertions(+), 38 deletions(-)

diff --git a/config/apparmor/abstractions/start-container b/config/apparmor/abstractions/start-container
index e361968..0d02379 100644
--- a/config/apparmor/abstractions/start-container
+++ b/config/apparmor/abstractions/start-container
@@ -13,6 +13,7 @@
   mount -> /usr/lib/lxc/{**,},
   mount fstype=devpts -> /dev/pts/,
   mount options=bind /dev/pts/ptmx/ -> /dev/ptmx/,
+  mount options=bind /dev/pts/** -> /dev/tty*/,
   mount options=(rw, make-slave) -> **,
   mount fstype=debugfs,
   # allow pre-mount hooks to stage mounts under /var/lib/lxc/<container>/
diff --git a/config/apparmor/profiles/lxc-default-with-nesting b/config/apparmor/profiles/lxc-default-with-nesting
index 03325aa..91ad6de 100644
--- a/config/apparmor/profiles/lxc-default-with-nesting
+++ b/config/apparmor/profiles/lxc-default-with-nesting
@@ -10,5 +10,5 @@ profile lxc-container-default-with-nesting flags=(attach_disconnected,mediate_de
 
   mount fstype=proc -> /var/cache/lxc/**,
   mount fstype=sysfs -> /var/cache/lxc/**,
-  mount options=(rw,bind) /var/cache/lxc/**/dev/shm/ -> /var/cache/lxc/**/run/shm/,
+  mount options=(rw,bind),
 }
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index e7def3e..aeabb6c 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -65,6 +65,7 @@
 
 #include "network.h"
 #include "error.h"
+#include "af_unix.h"
 #include "parse.h"
 #include "utils.h"
 #include "conf.h"
@@ -968,29 +969,26 @@ static bool append_ptyname(char **pp, char *name)
 
 static int setup_tty(struct lxc_conf *conf)
 {
-	const struct lxc_rootfs *rootfs = &conf->rootfs;
 	const struct lxc_tty_info *tty_info = &conf->tty_info;
 	char *ttydir = conf->ttydir;
 	char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
 	int i, ret;
 
-	if (!rootfs->path)
+	if (!conf->rootfs.path)
 		return 0;
 
 	for (i = 0; i < tty_info->nbtty; i++) {
 
 		struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
 
-		ret = snprintf(path, sizeof(path), "%s/dev/tty%d",
-			 rootfs->mount, i + 1);
+		ret = snprintf(path, sizeof(path), "/dev/tty%d", i + 1);
 		if (ret >= sizeof(path)) {
 			ERROR("pathname too long for ttys");
 			return -1;
 		}
 		if (ttydir) {
 			/* create dev/lxc/tty%d" */
-			ret = snprintf(lxcpath, sizeof(lxcpath), "%s/dev/%s/tty%d",
-				 rootfs->mount, ttydir, i + 1);
+			ret = snprintf(lxcpath, sizeof(lxcpath), "/dev/%s/tty%d", ttydir, i + 1);
 			if (ret >= sizeof(lxcpath)) {
 				ERROR("pathname too long for ttys");
 				return -1;
@@ -1024,8 +1022,6 @@ static int setup_tty(struct lxc_conf *conf)
 				SYSERROR("failed to create symlink for tty %d", i+1);
 				return -1;
 			}
-			/* Now save the relative path in @path for append_ptyname */
-			sprintf(path, "%s/tty%d", ttydir, i + 1);
 		} else {
 			/* If we populated /dev, then we need to create /dev/ttyN */
 			if (access(path, F_OK)) {
@@ -1038,14 +1034,11 @@ static int setup_tty(struct lxc_conf *conf)
 				}
 			}
 			if (mount(pty_info->name, path, "none", MS_BIND, 0)) {
-				WARN("failed to mount '%s'->'%s'",
-						pty_info->name, path);
+				SYSERROR("failed to mount '%s'->'%s'", pty_info->name, path);
 				continue;
 			}
-			/* Now save the relative path in @path for append_ptyname */
-			sprintf(path, "tty%d", i + 1);
 		}
-		if (!append_ptyname(&conf->pty_names, path)) {
+		if (!append_ptyname(&conf->pty_names, pty_info->name)) {
 			ERROR("Error setting up container_ttys string");
 			return -1;
 		}
@@ -3506,20 +3499,9 @@ int chown_mapped_root(char *path, struct lxc_conf *conf)
 
 int ttys_shift_ids(struct lxc_conf *c)
 {
-	int i;
-
 	if (lxc_list_empty(&c->id_map))
 		return 0;
 
-	for (i = 0; i < c->tty_info.nbtty; i++) {
-		struct lxc_pty_info *pty_info = &c->tty_info.pty_info[i];
-
-		if (chown_mapped_root(pty_info->name, c) < 0) {
-			ERROR("Failed to chown %s", pty_info->name);
-			return -1;
-		}
-	}
-
 	if (strcmp(c->console.name, "") !=0 && chown_mapped_root(c->console.name, c) < 0) {
 		ERROR("Failed to chown %s", c->console.name);
 		return -1;
@@ -3737,6 +3719,48 @@ static bool verify_start_hooks(struct lxc_conf *conf)
 	return true;
 }
 
+static int send_fd(int sock, int fd)
+{
+	int ret = lxc_abstract_unix_send_fd(sock, fd, NULL, 0);
+
+
+	if (ret < 0) {
+		SYSERROR("Error sending tty fd to parent");
+		return -1;
+	}
+
+	return 0;
+}
+
+static int send_ttys_to_parent(struct lxc_handler *handler)
+{
+	struct lxc_conf *conf = handler->conf;
+	const struct lxc_tty_info *tty_info = &conf->tty_info;
+	int i;
+	int sock = handler->ttysock[0];
+
+	for (i = 0; i < tty_info->nbtty; i++) {
+		struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
+		if (send_fd(sock, pty_info->slave) < 0)
+			goto bad;
+		close(pty_info->slave);
+		pty_info->slave = -1;
+		if (send_fd(sock, pty_info->master) < 0)
+			goto bad;
+		close(pty_info->master);
+		pty_info->master = -1;
+	}
+
+	close(handler->ttysock[0]);
+	close(handler->ttysock[1]);
+
+	return 0;
+
+bad:
+	ERROR("Error writing tty fd to parent");
+	return -1;
+}
+
 int lxc_setup(struct lxc_handler *handler)
 {
 	const char *name = handler->name;
@@ -3827,14 +3851,6 @@ int lxc_setup(struct lxc_handler *handler)
 			ERROR("failed to setup kmsg for '%s'", name);
 	}
 
-	if (!lxc_conf->is_execute && setup_tty(lxc_conf)) {
-		ERROR("failed to setup the ttys for '%s'", name);
-		return -1;
-	}
-
-	if (lxc_conf->pty_names && setenv("container_ttys", lxc_conf->pty_names, 1))
-		SYSERROR("failed to set environment variable for container ptys");
-
 	if (!lxc_conf->is_execute && setup_dev_symlinks(&lxc_conf->rootfs)) {
 		ERROR("failed to setup /dev symlinks for '%s'", name);
 		return -1;
@@ -3856,6 +3872,26 @@ int lxc_setup(struct lxc_handler *handler)
 		return -1;
 	}
 
+	if (lxc_create_tty(name, lxc_conf)) {
+		ERROR("failed to create the ttys");
+		return -1;
+	}
+
+	if (send_ttys_to_parent(handler) < 0) {
+		ERROR("failure sending console info to parent");
+		return -1;
+	}
+
+
+	if (!lxc_conf->is_execute && setup_tty(lxc_conf)) {
+		ERROR("failed to setup the ttys for '%s'", name);
+		return -1;
+	}
+
+	if (lxc_conf->pty_names && setenv("container_ttys", lxc_conf->pty_names, 1))
+		SYSERROR("failed to set environment variable for container ptys");
+
+
 	if (setup_personality(lxc_conf->personality)) {
 		ERROR("failed to setup personality");
 		return -1;
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 1949886..983f7a3 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -375,6 +375,7 @@ struct lxc_handler *lxc_init(const char *name, struct lxc_conf *conf, const char
 
 	memset(handler, 0, sizeof(*handler));
 
+	handler->ttysock[0] = handler->ttysock[1] = -1;
 	handler->conf = conf;
 	handler->lxcpath = lxcpath;
 	handler->pinfd = -1;
@@ -427,11 +428,6 @@ struct lxc_handler *lxc_init(const char *name, struct lxc_conf *conf, const char
 		goto out_aborting;
 	}
 
-	if (lxc_create_tty(name, conf)) {
-		ERROR("failed to create the ttys");
-		goto out_aborting;
-	}
-
 	/* the signal fd has to be created before forking otherwise
 	 * if the child process exits before we setup the signal fd,
 	 * the event will be lost and the command will be stuck */
@@ -492,6 +488,10 @@ void lxc_fini(const char *name, struct lxc_handler *handler)
 	close(handler->conf->maincmd_fd);
 	handler->conf->maincmd_fd = -1;
 	free(handler->name);
+	if (handler->ttysock[0] != -1) {
+		close(handler->ttysock[0]);
+		close(handler->ttysock[1]);
+	}
 	cgroup_destroy(handler);
 	free(handler);
 }
@@ -800,6 +800,46 @@ static int save_phys_nics(struct lxc_conf *conf)
 	return 0;
 }
 
+static int recv_fd(int sock, int *fd)
+{
+	if (lxc_abstract_unix_recv_fd(sock, fd, NULL, 0) < 0) {
+		SYSERROR("Error receiving tty fd from child");
+		return -1;
+	}
+	if (*fd == -1)
+		return -1;
+	return 0;
+}
+
+static int recv_ttys_from_child(struct lxc_handler *handler)
+{
+	struct lxc_conf *conf = handler->conf;
+	int i, sock = handler->ttysock[1];
+	struct lxc_tty_info *tty_info = &conf->tty_info;
+
+	if (!conf->tty)
+		return 0;
+
+	tty_info->pty_info = malloc(sizeof(*tty_info->pty_info)*conf->tty);
+	if (!tty_info->pty_info) {
+		SYSERROR("failed to allocate pty_info");
+		return -1;
+	}
+
+	for (i = 0; i < conf->tty; i++) {
+		struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
+		pty_info->busy = 0;
+		if (recv_fd(sock, &pty_info->slave) < 0 ||
+				recv_fd(sock, &pty_info->master) < 0) {
+			ERROR("Error receiving tty info from child");
+			return -1;
+		}
+	}
+	tty_info->nbtty = conf->tty;
+
+	return 0;
+}
+
 static int lxc_spawn(struct lxc_handler *handler)
 {
 	int failed_before_rename = 0;
@@ -824,6 +864,11 @@ static int lxc_spawn(struct lxc_handler *handler)
 		handler->clone_flags |= CLONE_NEWUSER;
 	}
 
+	if (socketpair(AF_UNIX, SOCK_DGRAM, 0, handler->ttysock) < 0) {
+		lxc_sync_fini(handler);
+		return -1;
+	}
+
 	if (handler->conf->inherit_ns_fd[LXC_NS_NET] == -1) {
 		if (!lxc_requests_empty_network(handler))
 			handler->clone_flags |= CLONE_NEWNET;
@@ -991,6 +1036,12 @@ static int lxc_spawn(struct lxc_handler *handler)
 	cgroup_disconnect();
 	cgroups_connected = false;
 
+	/* read tty fds allocated by child */
+	if (recv_ttys_from_child(handler) < 0) {
+		ERROR("failed to receive tty info from child");
+		goto out_delete_net;
+	}
+
 	/* Tell the child to complete its initialization and wait for
 	 * it to exec or return an error.  (the child will never
 	 * return LXC_SYNC_POST_CGROUP+1.  It will either close the
diff --git a/src/lxc/start.h b/src/lxc/start.h
index d39b3b4..92f5b7d 100644
--- a/src/lxc/start.h
+++ b/src/lxc/start.h
@@ -73,6 +73,7 @@ struct lxc_handler {
 	int pinfd;
 	const char *lxcpath;
 	void *cgroup_data;
+	int ttysock[2]; // socketpair for child->parent tty fd passing
 };
 
 
-- 
2.1.0


From serge.hallyn at ubuntu.com  Thu Jan 29 10:27:13 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Thu, 29 Jan 2015 10:27:13 +0000
Subject: [lxc-devel] [PATCH] Use consistent /proc,
 /sys and /sys/fs/cgroup (v2)
In-Reply-To: <1422523011-16656-1-git-send-email-stgraber@ubuntu.com>
References: <1422523011-16656-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150129102713.GE16770@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
>  - Implements mixed mode for /sys where it's mounted read-only but with
>    /sys/devices/virtual/net/ writable.
> 
>  - Sets lxc.mount.auto to "cgroup:mixed proc:mixed sys:mixed" for all
>    templates.
> 
>  - Drop any template-specific mount for /proc, /sys or /sys/fs/cgroup.
> 
>  - Get rid of the fstab file by default, using lxc.mount.entry instead.
> 
>  - Set sys:mixed as the default for "sys". sys:mixed is slightly more
>    permissive than sys:ro so this shouldn't be a problem.
> 
> The read-only bind mount of /sys on top of itself is there so that
> mountall and other init systems don't attempt to remount /sys
> read-write.
> 
> v2 changes:
>  - Fix the mount list, don't specify a source for the remount.
>  - Update the documentation.
> 
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  config/templates/archlinux.common.conf.in  |  3 ---
>  config/templates/centos.common.conf.in     |  3 ---
>  config/templates/common.conf.in            |  3 +++
>  config/templates/debian.common.conf.in     |  5 +----
>  config/templates/gentoo.common.conf.in     |  3 ---
>  config/templates/gentoo.moresecure.conf.in |  2 --
>  config/templates/openwrt.common.conf.in    |  4 ----
>  config/templates/oracle.common.conf.in     |  3 ---
>  config/templates/plamo.common.conf.in      |  1 -
>  config/templates/ubuntu.common.conf.in     |  5 +----
>  doc/lxc.container.conf.sgml.in             |  9 ++++++++-
>  src/lxc/conf.c                             | 25 ++++++++++++++++---------
>  src/lxc/conf.h                             |  1 +
>  src/lxc/confile.c                          |  3 ++-
>  templates/lxc-alpine.in                    |  3 +--
>  templates/lxc-altlinux.in                  |  6 +-----
>  templates/lxc-busybox.in                   | 22 ++++++----------------
>  templates/lxc-cirros.in                    |  4 +---
>  templates/lxc-debian.in                    |  5 -----
>  templates/lxc-openmandriva.in              |  7 +------
>  templates/lxc-opensuse.in                  |  8 +-------
>  templates/lxc-plamo.in                     |  5 +----
>  templates/lxc-sshd.in                      |  4 ++--
>  templates/lxc-ubuntu-cloud.in              |  4 ----
>  templates/lxc-ubuntu.in                    |  6 +-----
>  25 files changed, 47 insertions(+), 97 deletions(-)
> 
> diff --git a/config/templates/archlinux.common.conf.in b/config/templates/archlinux.common.conf.in
> index 693f2f4..f869491 100644
> --- a/config/templates/archlinux.common.conf.in
> +++ b/config/templates/archlinux.common.conf.in
> @@ -8,9 +8,6 @@ lxc.tty = 6
>  lxc.haltsignal=SIGRTMIN+4
>  lxc.stopsignal=SIGRTMIN+14
>  
> -# Mount entries
> -lxc.mount.auto = proc:mixed sys:ro
> -
>  # Uncomment to disable creating tty devices subdirectory in /dev
>  # lxc.devttydir =
>  
> diff --git a/config/templates/centos.common.conf.in b/config/templates/centos.common.conf.in
> index 4ce2fda..ee2e9e1 100644
> --- a/config/templates/centos.common.conf.in
> +++ b/config/templates/centos.common.conf.in
> @@ -1,9 +1,6 @@
>  # This derives from the global common config
>  lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  
> -# Mount entries
> -lxc.mount.auto = proc:mixed sys:ro
> -
>  # Capabilities
>  # Uncomment these if you don't run anything that needs the capability, and
>  # would like the container to run with less privilege.
> diff --git a/config/templates/common.conf.in b/config/templates/common.conf.in
> index f22ef0c..26b3229 100644
> --- a/config/templates/common.conf.in
> +++ b/config/templates/common.conf.in
> @@ -43,6 +43,9 @@ lxc.cgroup.devices.allow = c 1:9 rwm
>  ### /dev/pts/*
>  lxc.cgroup.devices.allow = c 136:* rwm
>  
> +# Setup the default mounts
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
> +
>  # Blacklist some syscalls which are not safe in privileged
>  # containers
>  lxc.seccomp = @LXCTEMPLATECONFIG@/common.seccomp
> diff --git a/config/templates/debian.common.conf.in b/config/templates/debian.common.conf.in
> index e1d421f..493feee 100644
> --- a/config/templates/debian.common.conf.in
> +++ b/config/templates/debian.common.conf.in
> @@ -5,8 +5,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  lxc.devttydir =
>  
>  # Default mount entries
> -lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
> -lxc.mount.entry = sysfs sys sysfs defaults 0 0
>  lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
>  
>  # When using LXC with apparmor, the container will be confined by default.
> @@ -15,9 +13,8 @@ lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,opt
>  #lxc.aa_profile = unconfined
>  
>  # To support container nesting on an Ubuntu host while retaining most of
> -# apparmor's added security, use the following two lines instead.
> +# apparmor's added security, use the following line instead.
>  #lxc.aa_profile = lxc-container-default-with-nesting
> -#lxc.mount.auto = cgroup:mixed
>  
>  # If you wish to allow mounting block filesystems, then use the following
>  # line instead, and make sure to grant access to the block device and/or loop
> diff --git a/config/templates/gentoo.common.conf.in b/config/templates/gentoo.common.conf.in
> index 7b96672..01c8f48 100644
> --- a/config/templates/gentoo.common.conf.in
> +++ b/config/templates/gentoo.common.conf.in
> @@ -6,9 +6,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  # But security is not the goal.
>  # Looking for more security, see gentoo.moresecure.conf
>  
> -# Default mount entries
> -lxc.mount.entry=sys sys sysfs defaults 0 0
> -
>  # Doesn't support consoles in /dev/lxc/
>  lxc.devttydir =
>  
> diff --git a/config/templates/gentoo.moresecure.conf.in b/config/templates/gentoo.moresecure.conf.in
> index 238303d..270e9df 100644
> --- a/config/templates/gentoo.moresecure.conf.in
> +++ b/config/templates/gentoo.moresecure.conf.in
> @@ -8,8 +8,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  # Container user ? see gentoo.common.conf
>  
>  # do not mount sysfs, see http://blog.bofh.it/debian/id_413
> -# lxc.mount.entry=sys sys sysfs rw 0 0
> -lxc.mount.entry=proc proc proc ro,nodev,noexec,nosuid 0 0
>  lxc.mount.entry=mqueue dev/mqueue mqueue rw,nodev,noexec,nosuid 0 0
>  lxc.mount.entry=shm dev/shm tmpfs rw,nosuid,nodev,noexec,relatime 0 0
>  lxc.mount.entry=run run tmpfs rw,nosuid,nodev,relatime,mode=755 0 0
> diff --git a/config/templates/openwrt.common.conf.in b/config/templates/openwrt.common.conf.in
> index 05918f0..6609333 100644
> --- a/config/templates/openwrt.common.conf.in
> +++ b/config/templates/openwrt.common.conf.in
> @@ -1,7 +1,3 @@
> -# Default mount entries
> -lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
> -lxc.mount.entry = sysfs sys sysfs defaults 0 0
> -
>  # Default console settings
>  lxc.devttydir = lxc
>  lxc.tty = 4
> diff --git a/config/templates/oracle.common.conf.in b/config/templates/oracle.common.conf.in
> index 10522b2..8a72ad0 100644
> --- a/config/templates/oracle.common.conf.in
> +++ b/config/templates/oracle.common.conf.in
> @@ -1,9 +1,6 @@
>  # This derives from the global common config
>  lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  
> -# Mount entries
> -lxc.mount.auto = cgroup:mixed proc:mixed sys:ro
> -
>  # Capabilities
>  # Uncomment these if you don't run anything that needs the capability, and
>  # would like the container to run with less privilege.
> diff --git a/config/templates/plamo.common.conf.in b/config/templates/plamo.common.conf.in
> index 9b0d02b..e7809e1 100644
> --- a/config/templates/plamo.common.conf.in
> +++ b/config/templates/plamo.common.conf.in
> @@ -2,7 +2,6 @@
>  lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  
>  # Default mount
> -lxc.mount.auto = proc sys cgroup
>  lxc.mount.entry = none dev/shm tmpfs nosuid,nodev,noexec,mode=1777 0 0
>  
>  # Doesn't support consoles in /dev/lxc/
> diff --git a/config/templates/ubuntu.common.conf.in b/config/templates/ubuntu.common.conf.in
> index 19a6a67..d1ce8e9 100644
> --- a/config/templates/ubuntu.common.conf.in
> +++ b/config/templates/ubuntu.common.conf.in
> @@ -2,8 +2,6 @@
>  lxc.include = @LXCTEMPLATECONFIG@/common.conf
>  
>  # Default mount entries
> -lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
> -lxc.mount.entry = sysfs sys sysfs defaults 0 0
>  lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
>  lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0
>  lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0
> @@ -15,9 +13,8 @@ lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0
>  #lxc.aa_profile = unconfined
>  
>  # To support container nesting on an Ubuntu host while retaining most of
> -# apparmor's added security, use the following two lines instead.
> +# apparmor's added security, use the following line instead.
>  #lxc.aa_profile = lxc-container-default-with-nesting
> -#lxc.mount.auto = cgroup:mixed
>  
>  # Uncomment the following line to autodetect squid-deb-proxy configuration on the
>  # host and forward it to the guest at start time.
> diff --git a/doc/lxc.container.conf.sgml.in b/doc/lxc.container.conf.sgml.in
> index a86b1e5..50c6a2a 100644
> --- a/doc/lxc.container.conf.sgml.in
> +++ b/doc/lxc.container.conf.sgml.in
> @@ -774,7 +774,14 @@ proc proc proc nodev,noexec,nosuid 0 0
>                </listitem>
>                <listitem>
>                  <para>
> -                  <option>sys:ro</option> (or <option>sys</option>):
> +                  <option>sys:mixed</option> (or <option>sys</option>):
> +                  mount <filename>/sys</filename> as read-only but with
> +                  /sys/devices/virtual/net writable.
> +                </para>
> +              </listitem>
> +              <listitem>
> +                <para>
> +                  <option>sys:ro</option>:
>                    mount <filename>/sys</filename> as read-only
>                    for security / container isolation purposes.
>                  </para>
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index e7def3e..d2cfbe8 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -750,15 +750,21 @@ static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_ha
>  		 * MS_REMOUNT|MS_BIND|MS_RDONLY seems to work for kernels as low as
>  		 * 2.6.32...
>  		 */
> -		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc",                  "%r/proc",               "proc",  MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
> -		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys",           "%r/proc/sys",           NULL,    MS_BIND,                      NULL },
> -		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                    "%r/proc/sys",           NULL,    MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
> -		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger", "%r/proc/sysrq-trigger", NULL,    MS_BIND,                      NULL },
> -		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                    "%r/proc/sysrq-trigger", NULL,    MS_REMOUNT|MS_BIND|MS_RDONLY, NULL },
> -		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW,    "proc",                  "%r/proc",               "proc",  MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL },
> -		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RW,     "sysfs",                 "%r/sys",                "sysfs", 0,                            NULL },
> -		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RO,     "sysfs",                 "%r/sys",                "sysfs", MS_RDONLY,                    NULL },
> -		{ 0,                  0,                   NULL,                    NULL,                    NULL,    0,                            NULL }
> +		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc",                                              "%r/proc",                      "proc",     MS_NODEV|MS_NOEXEC|MS_NOSUID,   NULL },
> +		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys",                                       "%r/proc/sys",                  NULL,       MS_BIND,                        NULL },
> +		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                                                "%r/proc/sys",                  NULL,       MS_REMOUNT|MS_BIND|MS_RDONLY,   NULL },
> +		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sysrq-trigger",                             "%r/proc/sysrq-trigger",        NULL,       MS_BIND,                        NULL },
> +		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                                                "%r/proc/sysrq-trigger",        NULL,       MS_REMOUNT|MS_BIND|MS_RDONLY,   NULL },
> +		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW,    "proc",                                              "%r/proc",                      "proc",     MS_NODEV|MS_NOEXEC|MS_NOSUID,   NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RW,     "sysfs",                                             "%r/sys",                       "sysfs",    0,                              NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RO,     "sysfs",                                             "%r/sys",                       "sysfs",    MS_RDONLY,                      NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "sysfs",                                             "%r/sys",                       "sysfs",    MS_NODEV|MS_NOEXEC|MS_NOSUID,   NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "%r/sys",                                            "%r/sys",                       NULL,       MS_BIND,                        NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  NULL,                                                "%r/sys",                       NULL,       MS_REMOUNT|MS_BIND|MS_RDONLY,   NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "sysfs",                                             "%r/sys/devices/virtual/net",   "sysfs",    0,                              NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "%r/sys/devices/virtual/net/devices/virtual/net",    "%r/sys/devices/virtual/net",   NULL,       MS_BIND,                        NULL },
> +		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  NULL,                                                "%r/sys/devices/virtual/net",   NULL,       MS_REMOUNT|MS_BIND|MS_NOSUID|MS_NODEV|MS_NOEXEC,   NULL },
> +		{ 0,                  0,                   NULL,                                                NULL,                           NULL,       0,                              NULL }
>  	};
>  
>  	for (i = 0; default_mounts[i].match_mask; i++) {
> @@ -793,6 +799,7 @@ static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_ha
>  			saved_errno = errno;
>  			if (r < 0)
>  				SYSERROR("error mounting %s on %s flags %lu", source, destination, mflags);
> +
>  			free(source);
>  			free(destination);
>  			if (r < 0) {
> diff --git a/src/lxc/conf.h b/src/lxc/conf.h
> index 8ec3e8e..afa5517 100644
> --- a/src/lxc/conf.h
> +++ b/src/lxc/conf.h
> @@ -236,6 +236,7 @@ enum {
>  
>  	LXC_AUTO_SYS_RW               = 0x004,   /* /sys */
>  	LXC_AUTO_SYS_RO               = 0x008,   /* /sys read-only */
> +	LXC_AUTO_SYS_MIXED            = 0x00C,   /* /sys read-only and /sys/class/net read-write */
>  	LXC_AUTO_SYS_MASK             = 0x00C,
>  
>  	LXC_AUTO_CGROUP_RO            = 0x010,   /* /sys/fs/cgroup (partial mount, read-only) */
> diff --git a/src/lxc/confile.c b/src/lxc/confile.c
> index ccdf26c..8544ac9 100644
> --- a/src/lxc/confile.c
> +++ b/src/lxc/confile.c
> @@ -1416,8 +1416,9 @@ static int config_mount_auto(const char *key, const char *value,
>  		{ "proc",               LXC_AUTO_PROC_MASK,      LXC_AUTO_PROC_MIXED         },
>  		{ "proc:mixed",         LXC_AUTO_PROC_MASK,      LXC_AUTO_PROC_MIXED         },
>  		{ "proc:rw",            LXC_AUTO_PROC_MASK,      LXC_AUTO_PROC_RW            },
> -		{ "sys",                LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_RO             },
> +		{ "sys",                LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_MIXED          },
>  		{ "sys:ro",             LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_RO             },
> +		{ "sys:mixed",          LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_MIXED          },
>  		{ "sys:rw",             LXC_AUTO_SYS_MASK,       LXC_AUTO_SYS_RW             },
>  		{ "cgroup",             LXC_AUTO_CGROUP_MASK,    LXC_AUTO_CGROUP_NOSPEC      },
>  		{ "cgroup:mixed",       LXC_AUTO_CGROUP_MASK,    LXC_AUTO_CGROUP_MIXED       },
> diff --git a/templates/lxc-alpine.in b/templates/lxc-alpine.in
> index 187a032..886a838 100644
> --- a/templates/lxc-alpine.in
> +++ b/templates/lxc-alpine.in
> @@ -249,9 +249,8 @@ lxc.cgroup.devices.allow = c 5:2 rwm
>  lxc.cgroup.devices.allow = c 254:0 rm
>  
>  # mounts point
> -lxc.mount.entry=proc proc proc nodev,noexec,nosuid 0 0
> +lxc.mount.auto=cgroup:mixed proc:mixed sys:mixed
>  lxc.mount.entry=run run tmpfs nodev,noexec,nosuid,relatime,size=1m,mode=0755 0 0
> -lxc.mount.entry=none dev/pts devpts gid=5,mode=620 0 0
>  lxc.mount.entry=shm dev/shm tmpfs nodev,nosuid,noexec,mode=1777 0 0
>  
>  EOF
> diff --git a/templates/lxc-altlinux.in b/templates/lxc-altlinux.in
> index ac4527b..8b4168c 100644
> --- a/templates/lxc-altlinux.in
> +++ b/templates/lxc-altlinux.in
> @@ -266,7 +266,6 @@ copy_configuration()
>  lxc.utsname = $name
>  lxc.tty = 4
>  lxc.pts = 1024
> -lxc.mount = $config_path/fstab
>  lxc.cap.drop = sys_module mac_admin mac_override sys_time
>  
>  # When using LXC with apparmor, uncomment the next line to run unconfined:
> @@ -317,11 +316,8 @@ lxc.cgroup.devices.allow = c 136:* rwm
>  lxc.cgroup.devices.allow = c 5:2 rwm
>  # rtc
>  lxc.cgroup.devices.allow = c 10:135 rwm
> -EOF
>  
> -    cat <<EOF > $config_path/fstab
> -proc            proc         proc    nodev,noexec,nosuid 0 0
> -sysfs           sys          sysfs   defaults  0 0
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
>  EOF
>  
>      if [ $? -ne 0 ]; then
> diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in
> index 3cfa958..72531d6 100644
> --- a/templates/lxc-busybox.in
> +++ b/templates/lxc-busybox.in
> @@ -74,7 +74,7 @@ $rootfs/usr/lib64"
>      # minimal devices needed for busybox
>      if [ $in_userns -eq 1 ]; then
>          for dev in tty console tty0 tty1 ram0 null urandom; do
> -            echo "/dev/$dev dev/$dev    none bind,optional,create=file 0 0" >> $path/fstab
> +            echo "lxc.mount.entry = /dev/$dev dev/$dev    none bind,optional,create=file 0 0" >> $path/config
>          done
>      else
>          mknod -m 666 tty c 5 0       || res=1
> @@ -110,14 +110,6 @@ EOF
>      # executable
>      chmod 744 $rootfs/etc/init.d/rcS || return 1
>  
> -    # mount points
> -    cat <<EOF >> $rootfs/etc/fstab
> -shm   /dev/shm   tmpfs   defaults     0      0
> -EOF
> -
> -    # writable and readable for other
> -    chmod 644 $rootfs/etc/fstab || return 1
> -
>      # launch rcS first then make a console available
>      # and propose a shell on the tty, the last one is
>      # not needed
> @@ -285,6 +277,9 @@ lxc.cap.drop = sys_module mac_admin mac_override sys_time
>  
>  # When using LXC with apparmor, uncomment the next line to run unconfined:
>  #lxc.aa_profile = unconfined
> +
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
> +lxc.mount.entry = shm /dev/shm tmpfs defaults 0 0
>  EOF
>  
>      libdirs="\
> @@ -299,11 +294,6 @@ EOF
>          fi
>      done
>      echo "lxc.mount.entry = /sys/kernel/security sys/kernel/security none ro,bind,optional 0 0" >>$path/config
> -    echo "lxc.mount.auto = proc:mixed sys" >>$path/config
> -
> -    if [ -f "$path/fstab" ]; then
> -        echo "lxc.mount = $path/fstab" >>$path/config
> -    fi
>  }
>  
>  remap_userns()
> @@ -311,12 +301,12 @@ remap_userns()
>      path=$1
>  
>      if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
> -        chown $LXC_MAPPED_UID $path/config $path/fstab >/dev/null 2>&1
> +        chown $LXC_MAPPED_UID $path/config >/dev/null 2>&1
>          chown -R root $path/rootfs >/dev/null 2>&1
>      fi
>  
>      if [ -n "$LXC_MAPPED_GID" ] && [ "$LXC_MAPPED_GID" != "-1" ]; then
> -        chgrp $LXC_MAPPED_GID $path/config $path/fstab >/dev/null 2>&1
> +        chgrp $LXC_MAPPED_GID $path/config >/dev/null 2>&1
>          chgrp -R root $path/rootfs >/dev/null 2>&1
>      fi
>  }
> diff --git a/templates/lxc-cirros.in b/templates/lxc-cirros.in
> index c8a8b36..349cdbf 100644
> --- a/templates/lxc-cirros.in
> +++ b/templates/lxc-cirros.in
> @@ -118,7 +118,6 @@ cat >> "$path/config" <<EOF
>  # Template used to create this container: cirros
>  
>  lxc.rootfs = $rootfs
> -#lxc.mount = $path/fstab
>  lxc.pivotdir = lxc_putold
>  
>  lxc.tty = 4
> @@ -132,7 +131,7 @@ lxc.cap.drop = sys_module mac_admin mac_override sys_time
>  #lxc.aa_profile = unconfined
>  # To support container nesting on an Ubuntu host, uncomment next two lines:
>  #lxc.aa_profile = lxc-container-default-with-nesting
> -#lxc.mount.auto = cgroup
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
>  
>  lxc.cgroup.devices.deny = a
>  # Allow any mknod (but not using the node)
> @@ -165,7 +164,6 @@ EOF
>  
>      if [ $in_userns -eq 1 ] && [ -e "${LXC_TEMPLATE_CONFIG}/ubuntu-cloud.userns.conf" ]; then
>          echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/ubuntu.userns.conf" >> $path/config
> -        echo "lxc.mount.auto = cgroup:mixed proc:mixed sys:ro" >> $path/config
>      fi
>  
>  }
> diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
> index 05eee06..938f0db 100644
> --- a/templates/lxc-debian.in
> +++ b/templates/lxc-debian.in
> @@ -202,7 +202,6 @@ configure_debian_systemd()
>  
>      # This function has been copied and adapted from lxc-fedora
>      rm -f ${rootfs}/etc/systemd/system/default.target
> -    touch ${rootfs}/etc/fstab
>      chroot ${rootfs} ln -s /dev/null /etc/systemd/system/udev.service
>      chroot ${rootfs} ln -s /dev/null /etc/systemd/system/systemd-udevd.service
>      chroot ${rootfs} ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
> @@ -325,9 +324,6 @@ copy_configuration()
>      arch=$4
>  
>      # Generate the configuration file
> -    ## Create the fstab (empty by default)
> -    touch $path/fstab
> -
>      # if there is exactly one veth network entry, make sure it has an
>      # associated hwaddr.
>      nics=`grep -e '^lxc\.network\.type[ \t]*=[ \t]*veth' $path/config | wc -l`
> @@ -351,7 +347,6 @@ copy_configuration()
>      grep -q "^lxc.rootfs" $path/config 2> /dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
>  
>      cat <<EOF >> $path/config
> -lxc.mount = $path/fstab
>  lxc.utsname = $hostname
>  lxc.arch = $arch
>  EOF
> diff --git a/templates/lxc-openmandriva.in b/templates/lxc-openmandriva.in
> index 46c829d..6123c5e 100644
> --- a/templates/lxc-openmandriva.in
> +++ b/templates/lxc-openmandriva.in
> @@ -231,8 +231,8 @@ copy_configuration()
>  lxc.utsname = $name
>  lxc.tty = 4
>  lxc.pts = 1024
> -lxc.mount = $config_path/fstab
>  lxc.cap.drop = sys_module mac_admin mac_override sys_time
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
>  
>  # When using LXC with apparmor, uncomment the next line to run unconfined:
>  #lxc.aa_profile = unconfined
> @@ -284,11 +284,6 @@ lxc.cgroup.devices.allow = c 5:2 rwm
>  lxc.cgroup.devices.allow = c 10:135 rwm
>  EOF
>  
> -    cat <<EOF > $config_path/fstab
> -proc            $rootfs_path/proc         proc    nodev,noexec,nosuid 0 0
> -sysfs           $rootfs_path/sys          sysfs defaults  0 0
> -EOF
> -
>      if [ $? -ne 0 ]; then
>          echo "Failed to add configuration"
>          return 1
> diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
> index bb015c8..4ff1dcf 100644
> --- a/templates/lxc-opensuse.in
> +++ b/templates/lxc-opensuse.in
> @@ -321,7 +321,7 @@ lxc.include = @LXCTEMPLATECONFIG@/opensuse.common.conf
>  lxc.arch = $arch
>  lxc.utsname = $name
>  
> -lxc.mount = $path/fstab
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
>  
>  # When using LXC with apparmor, uncomment the next line to run unconfined:
>  #lxc.aa_profile = unconfined
> @@ -340,12 +340,6 @@ lxc.mount = $path/fstab
>  
>  EOF
>  
> -    cat <<EOF > $path/fstab
> -proc            proc         proc	nodev,noexec,nosuid 0 0
> -sysfs           sys          sysfs	defaults  0 0
> -tmpfs           run          tmpfs	mode=0755,nodev,nosuid 0 0
> -EOF
> -
>      if [ $? -ne 0 ]; then
>          echo "Failed to add configuration"
>          return 1
> diff --git a/templates/lxc-plamo.in b/templates/lxc-plamo.in
> index 5061056..c588ddb 100644
> --- a/templates/lxc-plamo.in
> +++ b/templates/lxc-plamo.in
> @@ -247,7 +247,6 @@ copy_configuration() {
>    ret=0
>    cat <<- EOF >> $path/config || let ret++
>  	lxc.utsname = $name
> -	lxc.mount = $path/fstab
>  	lxc.arch = $arch
>  	EOF
>    if [ -f "@LXCTEMPLATECONFIG@/plamo.common.conf" ] ; then
> @@ -256,8 +255,6 @@ copy_configuration() {
>  	lxc.include = @LXCTEMPLATECONFIG@/plamo.common.conf
>  	EOF
>    fi
> -  # create the fstab (empty by default)
> -  touch $path/fstab || let ret++
>    if [ $ret -ne 0 ] ; then
>      echo "Failed to add configuration."
>      return 1
> @@ -274,7 +271,7 @@ do_bindhome() {
>    # bind-mount the user's path into the container's /home
>    h=`getent passwd $bindhome | cut -d: -f6`
>    mkdir -p $rootfs/$h
> -  echo "$h $rootfs/$h none bind 0 0" >> $path/fstab
> +  echo "lxc.mount.entry = $h $rootfs/$h none bind 0 0" >> $path/config
>    # copy /etc/passwd, /etc/shadow, and /etc/group entries into container
>    if ! pwd=`getent passwd $bindhome` ; then
>      echo "Warning: failed to copy password entry for $bindhome."
> diff --git a/templates/lxc-sshd.in b/templates/lxc-sshd.in
> index aa45c1d..d34b3b4 100644
> --- a/templates/lxc-sshd.in
> +++ b/templates/lxc-sshd.in
> @@ -141,9 +141,9 @@ lxc.mount.entry = /usr usr none ro,bind 0 0
>  lxc.mount.entry = /sbin sbin none ro,bind 0 0
>  lxc.mount.entry = tmpfs var/run/sshd tmpfs mode=0644 0 0
>  lxc.mount.entry = @LXCTEMPLATEDIR@/lxc-sshd sbin/init none ro,bind 0 0
> -lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
> -lxc.mount.entry = sysfs sys sysfs ro 0 0
>  lxc.mount.entry = /etc/init.d etc/init.d none ro,bind 0 0
> +
> +lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
>  EOF
>  
>      # Oracle Linux and Fedora need the following two bind mounted
> diff --git a/templates/lxc-ubuntu-cloud.in b/templates/lxc-ubuntu-cloud.in
> index c4eb5ca..81abf2a 100644
> --- a/templates/lxc-ubuntu-cloud.in
> +++ b/templates/lxc-ubuntu-cloud.in
> @@ -66,9 +66,6 @@ copy_configuration()
>      fi
>  
>      # Generate the configuration file
> -    ## Create the fstab (empty by default)
> -    touch $path/fstab
> -
>      ## Relocate all the network config entries
>      sed -i -e "/lxc.network/{w ${path}/config-network" -e "d}" $path/config
>  
> @@ -94,7 +91,6 @@ copy_configuration()
>      [ -e "$path/config-auto" ] && cat $path/config-auto >> $path/config && rm $path/config-auto
>      grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
>      cat <<EOF >> $path/config
> -lxc.mount = $path/fstab
>  lxc.utsname = $name
>  lxc.arch = $arch
>  EOF
> diff --git a/templates/lxc-ubuntu.in b/templates/lxc-ubuntu.in
> index bbe7f7d..073724b 100644
> --- a/templates/lxc-ubuntu.in
> +++ b/templates/lxc-ubuntu.in
> @@ -483,9 +483,6 @@ copy_configuration()
>      fi
>  
>      # Generate the configuration file
> -    ## Create the fstab (empty by default)
> -    touch $path/fstab
> -
>      ## Relocate all the network config entries
>      sed -i -e "/lxc.network/{w ${path}/config-network" -e "d}" $path/config
>  
> @@ -508,7 +505,6 @@ copy_configuration()
>      [ -e "$path/config-auto" ] && cat $path/config-auto >> $path/config && rm $path/config-auto
>      grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
>      cat <<EOF >> $path/config
> -lxc.mount = $path/fstab
>  lxc.utsname = $name
>  lxc.arch = $arch
>  EOF
> @@ -659,7 +655,7 @@ do_bindhome()
>      while [ ${h2:0:1} = "/" ]; do
>          h2=${h2#/}
>      done
> -    echo "$h $h2 none bind 0 0" >> $path/fstab
> +    echo "lxc.mount.entry = $h $h2 none bind 0 0" >> $path/config
>  
>      # Make sure the group exists in container
>      grp=`echo $pwd | cut -d: -f 4`  # group number for $user
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From stgraber at ubuntu.com  Thu Jan 29 10:39:51 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 29 Jan 2015 11:39:51 +0100
Subject: [lxc-devel] [PATCH] create lxc.tty ptys from container process
In-Reply-To: <20150129101336.GD16770@ubuntumail>
References: <20150129101336.GD16770@ubuntumail>
Message-ID: <20150129103951.GH14174@castiana.ipv6.teksavvy.com>

On Thu, Jan 29, 2015 at 10:13:36AM +0000, Serge Hallyn wrote:
> Lxc has always created the ptys for use by console and ttys early
> on from the monitor process.  This has some advantages, but also
> has disadvantages, namely (1) container ptys counting against the
> max ptys for the host, and (2) not having a /dev/pts/N in the
> container to pass to getty.  (2) was not a problem for us historically
> because we bind-mounted the host's /dev/pts/N onto a /dev/ttyN in
> the container.  However, systemd hardocdes a check for container_ttys
> that the path have 'pts/' in it.  If it were only for (2) I'd have
> opted for a systemd patch to check the device major number, but (1)
> made it worth moving the openpty to the container namespace.
> 
> So this patch moves the tty creation into the task which becomes
> the container init.  It then passes the fds for the opened ptys
> back to the monitor over a unix socketpair (for use by lxc-console).
> The /dev/console is still created in the monitor process, so that
> it can for instance be used by lxc.logfd.
> 
> So now if you have a foreground container with lxc.tty = 4, you
> should end up with one host /dev/pts entry per container rather than 5.
> 
> And lxc-console now works with systemd containers.
> 
> Note that if the container init mounts its own devpts over the
> one mounted by lxc, the tty /dev/pts/n will be hidden.  This is ok
> since it's only systemd that needs it, and systemd won't do that.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  config/apparmor/abstractions/start-container      |   1 +
>  config/apparmor/profiles/lxc-default-with-nesting |   2 +-
>  src/lxc/conf.c                                    | 100 +++++++++++++++-------
>  src/lxc/start.c                                   |  61 +++++++++++--
>  src/lxc/start.h                                   |   1 +
>  5 files changed, 127 insertions(+), 38 deletions(-)
> 
> diff --git a/config/apparmor/abstractions/start-container b/config/apparmor/abstractions/start-container
> index e361968..0d02379 100644
> --- a/config/apparmor/abstractions/start-container
> +++ b/config/apparmor/abstractions/start-container
> @@ -13,6 +13,7 @@
>    mount -> /usr/lib/lxc/{**,},
>    mount fstype=devpts -> /dev/pts/,
>    mount options=bind /dev/pts/ptmx/ -> /dev/ptmx/,
> +  mount options=bind /dev/pts/** -> /dev/tty*/,
>    mount options=(rw, make-slave) -> **,
>    mount fstype=debugfs,
>    # allow pre-mount hooks to stage mounts under /var/lib/lxc/<container>/
> diff --git a/config/apparmor/profiles/lxc-default-with-nesting b/config/apparmor/profiles/lxc-default-with-nesting
> index 03325aa..91ad6de 100644
> --- a/config/apparmor/profiles/lxc-default-with-nesting
> +++ b/config/apparmor/profiles/lxc-default-with-nesting
> @@ -10,5 +10,5 @@ profile lxc-container-default-with-nesting flags=(attach_disconnected,mediate_de
>  
>    mount fstype=proc -> /var/cache/lxc/**,
>    mount fstype=sysfs -> /var/cache/lxc/**,
> -  mount options=(rw,bind) /var/cache/lxc/**/dev/shm/ -> /var/cache/lxc/**/run/shm/,
> +  mount options=(rw,bind),
>  }
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index e7def3e..aeabb6c 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -65,6 +65,7 @@
>  
>  #include "network.h"
>  #include "error.h"
> +#include "af_unix.h"
>  #include "parse.h"
>  #include "utils.h"
>  #include "conf.h"
> @@ -968,29 +969,26 @@ static bool append_ptyname(char **pp, char *name)
>  
>  static int setup_tty(struct lxc_conf *conf)
>  {
> -	const struct lxc_rootfs *rootfs = &conf->rootfs;
>  	const struct lxc_tty_info *tty_info = &conf->tty_info;
>  	char *ttydir = conf->ttydir;
>  	char path[MAXPATHLEN], lxcpath[MAXPATHLEN];
>  	int i, ret;
>  
> -	if (!rootfs->path)
> +	if (!conf->rootfs.path)
>  		return 0;
>  
>  	for (i = 0; i < tty_info->nbtty; i++) {
>  
>  		struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
>  
> -		ret = snprintf(path, sizeof(path), "%s/dev/tty%d",
> -			 rootfs->mount, i + 1);
> +		ret = snprintf(path, sizeof(path), "/dev/tty%d", i + 1);
>  		if (ret >= sizeof(path)) {
>  			ERROR("pathname too long for ttys");
>  			return -1;
>  		}
>  		if (ttydir) {
>  			/* create dev/lxc/tty%d" */
> -			ret = snprintf(lxcpath, sizeof(lxcpath), "%s/dev/%s/tty%d",
> -				 rootfs->mount, ttydir, i + 1);
> +			ret = snprintf(lxcpath, sizeof(lxcpath), "/dev/%s/tty%d", ttydir, i + 1);
>  			if (ret >= sizeof(lxcpath)) {
>  				ERROR("pathname too long for ttys");
>  				return -1;
> @@ -1024,8 +1022,6 @@ static int setup_tty(struct lxc_conf *conf)
>  				SYSERROR("failed to create symlink for tty %d", i+1);
>  				return -1;
>  			}
> -			/* Now save the relative path in @path for append_ptyname */
> -			sprintf(path, "%s/tty%d", ttydir, i + 1);
>  		} else {
>  			/* If we populated /dev, then we need to create /dev/ttyN */
>  			if (access(path, F_OK)) {
> @@ -1038,14 +1034,11 @@ static int setup_tty(struct lxc_conf *conf)
>  				}
>  			}
>  			if (mount(pty_info->name, path, "none", MS_BIND, 0)) {
> -				WARN("failed to mount '%s'->'%s'",
> -						pty_info->name, path);
> +				SYSERROR("failed to mount '%s'->'%s'", pty_info->name, path);
>  				continue;
>  			}
> -			/* Now save the relative path in @path for append_ptyname */
> -			sprintf(path, "tty%d", i + 1);
>  		}
> -		if (!append_ptyname(&conf->pty_names, path)) {
> +		if (!append_ptyname(&conf->pty_names, pty_info->name)) {
>  			ERROR("Error setting up container_ttys string");
>  			return -1;
>  		}
> @@ -3506,20 +3499,9 @@ int chown_mapped_root(char *path, struct lxc_conf *conf)
>  
>  int ttys_shift_ids(struct lxc_conf *c)
>  {
> -	int i;
> -
>  	if (lxc_list_empty(&c->id_map))
>  		return 0;
>  
> -	for (i = 0; i < c->tty_info.nbtty; i++) {
> -		struct lxc_pty_info *pty_info = &c->tty_info.pty_info[i];
> -
> -		if (chown_mapped_root(pty_info->name, c) < 0) {
> -			ERROR("Failed to chown %s", pty_info->name);
> -			return -1;
> -		}
> -	}
> -
>  	if (strcmp(c->console.name, "") !=0 && chown_mapped_root(c->console.name, c) < 0) {
>  		ERROR("Failed to chown %s", c->console.name);
>  		return -1;
> @@ -3737,6 +3719,48 @@ static bool verify_start_hooks(struct lxc_conf *conf)
>  	return true;
>  }
>  
> +static int send_fd(int sock, int fd)
> +{
> +	int ret = lxc_abstract_unix_send_fd(sock, fd, NULL, 0);
> +
> +
> +	if (ret < 0) {
> +		SYSERROR("Error sending tty fd to parent");
> +		return -1;
> +	}
> +
> +	return 0;
> +}
> +
> +static int send_ttys_to_parent(struct lxc_handler *handler)
> +{
> +	struct lxc_conf *conf = handler->conf;
> +	const struct lxc_tty_info *tty_info = &conf->tty_info;
> +	int i;
> +	int sock = handler->ttysock[0];
> +
> +	for (i = 0; i < tty_info->nbtty; i++) {
> +		struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
> +		if (send_fd(sock, pty_info->slave) < 0)
> +			goto bad;
> +		close(pty_info->slave);
> +		pty_info->slave = -1;
> +		if (send_fd(sock, pty_info->master) < 0)
> +			goto bad;
> +		close(pty_info->master);
> +		pty_info->master = -1;
> +	}
> +
> +	close(handler->ttysock[0]);
> +	close(handler->ttysock[1]);
> +
> +	return 0;
> +
> +bad:
> +	ERROR("Error writing tty fd to parent");
> +	return -1;
> +}
> +
>  int lxc_setup(struct lxc_handler *handler)
>  {
>  	const char *name = handler->name;
> @@ -3827,14 +3851,6 @@ int lxc_setup(struct lxc_handler *handler)
>  			ERROR("failed to setup kmsg for '%s'", name);
>  	}
>  
> -	if (!lxc_conf->is_execute && setup_tty(lxc_conf)) {
> -		ERROR("failed to setup the ttys for '%s'", name);
> -		return -1;
> -	}
> -
> -	if (lxc_conf->pty_names && setenv("container_ttys", lxc_conf->pty_names, 1))
> -		SYSERROR("failed to set environment variable for container ptys");
> -
>  	if (!lxc_conf->is_execute && setup_dev_symlinks(&lxc_conf->rootfs)) {
>  		ERROR("failed to setup /dev symlinks for '%s'", name);
>  		return -1;
> @@ -3856,6 +3872,26 @@ int lxc_setup(struct lxc_handler *handler)
>  		return -1;
>  	}
>  
> +	if (lxc_create_tty(name, lxc_conf)) {
> +		ERROR("failed to create the ttys");
> +		return -1;
> +	}
> +
> +	if (send_ttys_to_parent(handler) < 0) {
> +		ERROR("failure sending console info to parent");
> +		return -1;
> +	}
> +
> +
> +	if (!lxc_conf->is_execute && setup_tty(lxc_conf)) {
> +		ERROR("failed to setup the ttys for '%s'", name);
> +		return -1;
> +	}
> +
> +	if (lxc_conf->pty_names && setenv("container_ttys", lxc_conf->pty_names, 1))
> +		SYSERROR("failed to set environment variable for container ptys");
> +
> +
>  	if (setup_personality(lxc_conf->personality)) {
>  		ERROR("failed to setup personality");
>  		return -1;
> diff --git a/src/lxc/start.c b/src/lxc/start.c
> index 1949886..983f7a3 100644
> --- a/src/lxc/start.c
> +++ b/src/lxc/start.c
> @@ -375,6 +375,7 @@ struct lxc_handler *lxc_init(const char *name, struct lxc_conf *conf, const char
>  
>  	memset(handler, 0, sizeof(*handler));
>  
> +	handler->ttysock[0] = handler->ttysock[1] = -1;
>  	handler->conf = conf;
>  	handler->lxcpath = lxcpath;
>  	handler->pinfd = -1;
> @@ -427,11 +428,6 @@ struct lxc_handler *lxc_init(const char *name, struct lxc_conf *conf, const char
>  		goto out_aborting;
>  	}
>  
> -	if (lxc_create_tty(name, conf)) {
> -		ERROR("failed to create the ttys");
> -		goto out_aborting;
> -	}
> -
>  	/* the signal fd has to be created before forking otherwise
>  	 * if the child process exits before we setup the signal fd,
>  	 * the event will be lost and the command will be stuck */
> @@ -492,6 +488,10 @@ void lxc_fini(const char *name, struct lxc_handler *handler)
>  	close(handler->conf->maincmd_fd);
>  	handler->conf->maincmd_fd = -1;
>  	free(handler->name);
> +	if (handler->ttysock[0] != -1) {
> +		close(handler->ttysock[0]);
> +		close(handler->ttysock[1]);
> +	}
>  	cgroup_destroy(handler);
>  	free(handler);
>  }
> @@ -800,6 +800,46 @@ static int save_phys_nics(struct lxc_conf *conf)
>  	return 0;
>  }
>  
> +static int recv_fd(int sock, int *fd)
> +{
> +	if (lxc_abstract_unix_recv_fd(sock, fd, NULL, 0) < 0) {
> +		SYSERROR("Error receiving tty fd from child");
> +		return -1;
> +	}
> +	if (*fd == -1)
> +		return -1;
> +	return 0;
> +}
> +
> +static int recv_ttys_from_child(struct lxc_handler *handler)
> +{
> +	struct lxc_conf *conf = handler->conf;
> +	int i, sock = handler->ttysock[1];
> +	struct lxc_tty_info *tty_info = &conf->tty_info;
> +
> +	if (!conf->tty)
> +		return 0;
> +
> +	tty_info->pty_info = malloc(sizeof(*tty_info->pty_info)*conf->tty);
> +	if (!tty_info->pty_info) {
> +		SYSERROR("failed to allocate pty_info");
> +		return -1;
> +	}
> +
> +	for (i = 0; i < conf->tty; i++) {
> +		struct lxc_pty_info *pty_info = &tty_info->pty_info[i];
> +		pty_info->busy = 0;
> +		if (recv_fd(sock, &pty_info->slave) < 0 ||
> +				recv_fd(sock, &pty_info->master) < 0) {
> +			ERROR("Error receiving tty info from child");
> +			return -1;
> +		}
> +	}
> +	tty_info->nbtty = conf->tty;
> +
> +	return 0;
> +}
> +
>  static int lxc_spawn(struct lxc_handler *handler)
>  {
>  	int failed_before_rename = 0;
> @@ -824,6 +864,11 @@ static int lxc_spawn(struct lxc_handler *handler)
>  		handler->clone_flags |= CLONE_NEWUSER;
>  	}
>  
> +	if (socketpair(AF_UNIX, SOCK_DGRAM, 0, handler->ttysock) < 0) {
> +		lxc_sync_fini(handler);
> +		return -1;
> +	}
> +
>  	if (handler->conf->inherit_ns_fd[LXC_NS_NET] == -1) {
>  		if (!lxc_requests_empty_network(handler))
>  			handler->clone_flags |= CLONE_NEWNET;
> @@ -991,6 +1036,12 @@ static int lxc_spawn(struct lxc_handler *handler)
>  	cgroup_disconnect();
>  	cgroups_connected = false;
>  
> +	/* read tty fds allocated by child */
> +	if (recv_ttys_from_child(handler) < 0) {
> +		ERROR("failed to receive tty info from child");
> +		goto out_delete_net;
> +	}
> +
>  	/* Tell the child to complete its initialization and wait for
>  	 * it to exec or return an error.  (the child will never
>  	 * return LXC_SYNC_POST_CGROUP+1.  It will either close the
> diff --git a/src/lxc/start.h b/src/lxc/start.h
> index d39b3b4..92f5b7d 100644
> --- a/src/lxc/start.h
> +++ b/src/lxc/start.h
> @@ -73,6 +73,7 @@ struct lxc_handler {
>  	int pinfd;
>  	const char *lxcpath;
>  	void *cgroup_data;
> +	int ttysock[2]; // socketpair for child->parent tty fd passing
>  };
>  
>  
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150129/9a32c0be/attachment-0001.sig>

From noreply at github.com  Thu Jan 29 10:46:25 2015
From: noreply at github.com (GitHub)
Date: Thu, 29 Jan 2015 02:46:25 -0800
Subject: [lxc-devel] [lxc/lxc] f24a52: Use consistent /proc,
	/sys and /sys/fs/cgroup (v2)
Message-ID: <54ca0f817f9c8_69283f93433eb2bc748c5@hookshot-fe3-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: f24a52d5f588ff4e4575046903fb9498c376d833
      https://github.com/lxc/lxc/commit/f24a52d5f588ff4e4575046903fb9498c376d833
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-29 (Thu, 29 Jan 2015)

  Changed paths:
    M config/templates/archlinux.common.conf.in
    M config/templates/centos.common.conf.in
    M config/templates/common.conf.in
    M config/templates/debian.common.conf.in
    M config/templates/gentoo.common.conf.in
    M config/templates/gentoo.moresecure.conf.in
    M config/templates/openwrt.common.conf.in
    M config/templates/oracle.common.conf.in
    M config/templates/plamo.common.conf.in
    M config/templates/ubuntu.common.conf.in
    M doc/lxc.container.conf.sgml.in
    M src/lxc/conf.c
    M src/lxc/conf.h
    M src/lxc/confile.c
    M templates/lxc-alpine.in
    M templates/lxc-altlinux.in
    M templates/lxc-busybox.in
    M templates/lxc-cirros.in
    M templates/lxc-debian.in
    M templates/lxc-openmandriva.in
    M templates/lxc-opensuse.in
    M templates/lxc-plamo.in
    M templates/lxc-sshd.in
    M templates/lxc-ubuntu-cloud.in
    M templates/lxc-ubuntu.in

  Log Message:
  -----------
  Use consistent /proc, /sys and /sys/fs/cgroup (v2)

 - Implements mixed mode for /sys where it's mounted read-only but with
   /sys/devices/virtual/net/ writable.

 - Sets lxc.mount.auto to "cgroup:mixed proc:mixed sys:mixed" for all
   templates.

 - Drop any template-specific mount for /proc, /sys or /sys/fs/cgroup.

 - Get rid of the fstab file by default, using lxc.mount.entry instead.

 - Set sys:mixed as the default for "sys". sys:mixed is slightly more
   permissive than sys:ro so this shouldn't be a problem.

The read-only bind mount of /sys on top of itself is there so that
mountall and other init systems don't attempt to remount /sys
read-write.

v2 changes:
 - Fix the mount list, don't specify a source for the remount.
 - Update the documentation.

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: e8bd4e430bf76ed4737563476ce685b2425412ec
      https://github.com/lxc/lxc/commit/e8bd4e430bf76ed4737563476ce685b2425412ec
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-29 (Thu, 29 Jan 2015)

  Changed paths:
    M config/apparmor/abstractions/start-container
    M config/apparmor/profiles/lxc-default-with-nesting
    M src/lxc/conf.c
    M src/lxc/start.c
    M src/lxc/start.h

  Log Message:
  -----------
  create lxc.tty ptys from container process

Lxc has always created the ptys for use by console and ttys early
on from the monitor process.  This has some advantages, but also
has disadvantages, namely (1) container ptys counting against the
max ptys for the host, and (2) not having a /dev/pts/N in the
container to pass to getty.  (2) was not a problem for us historically
because we bind-mounted the host's /dev/pts/N onto a /dev/ttyN in
the container.  However, systemd hardocdes a check for container_ttys
that the path have 'pts/' in it.  If it were only for (2) I'd have
opted for a systemd patch to check the device major number, but (1)
made it worth moving the openpty to the container namespace.

So this patch moves the tty creation into the task which becomes
the container init.  It then passes the fds for the opened ptys
back to the monitor over a unix socketpair (for use by lxc-console).
The /dev/console is still created in the monitor process, so that
it can for instance be used by lxc.logfd.

So now if you have a foreground container with lxc.tty = 4, you
should end up with one host /dev/pts entry per container rather than 5.

And lxc-console now works with systemd containers.

Note that if the container init mounts its own devpts over the
one mounted by lxc, the tty /dev/pts/n will be hidden.  This is ok
since it's only systemd that needs it, and systemd won't do that.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/e088e9267c8f...e8bd4e430bf7

From serge.hallyn at ubuntu.com  Thu Jan 29 16:09:45 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Thu, 29 Jan 2015 16:09:45 +0000
Subject: [lxc-devel] [PATCH 1/1] clone_paths: use 'rootfs' for destination
	directory
Message-ID: <20150129160945.GJ16770@ubuntumail>

We were trying to be smart and use whatever the last part of
the container's rootfs path was.  However for block devices
that doesn't make much sense.  I.e. if lxc.rootfs = /dev/md-1,
chances are that /var/lib/lxc/c1/md-1 does not exist.

So always use the $lxcpath/$lxcname/rootfs, and if it does
not exist, try to create it.

With this, 'lxc-clone -s -o c1 -n c2' where c1 has an lvm backend
is fixed.  See https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1414771

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/lxc/bdev.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/lxc/bdev.c b/src/lxc/bdev.c
index 721a72b..197ab55 100644
--- a/src/lxc/bdev.c
+++ b/src/lxc/bdev.c
@@ -3340,7 +3340,6 @@ struct bdev *bdev_copy(struct lxc_container *c0, const char *cname,
 	const char *oldname = c0->name;
 	const char *oldpath = c0->config_path;
 	struct rsync_data data;
-	char *rootfs;
 
 	/* if the container name doesn't show up in the rootfs path, then
 	 * we don't know how to come up with a new name
@@ -3359,25 +3358,26 @@ struct bdev *bdev_copy(struct lxc_container *c0, const char *cname,
 
 	if (!orig->dest) {
 		int ret;
-		orig->dest = malloc(MAXPATHLEN);
+		size_t len;
+		struct stat sb;
+
+		len = strlen(oldpath) + strlen(oldname) + strlen("/rootfs") + 2;
+		orig->dest = malloc(len);
 		if (!orig->dest) {
 			ERROR("out of memory");
 			bdev_put(orig);
 			return NULL;
 		}
-		rootfs = strrchr(orig->src, '/');
-		if (!rootfs) {
-			ERROR("invalid rootfs path");
-			bdev_put(orig);
-			return NULL;
-		}
-		rootfs++;
-		ret = snprintf(orig->dest, MAXPATHLEN, "%s/%s/%s", oldpath, oldname, rootfs);
-		if (ret < 0 || ret >= MAXPATHLEN) {
+		ret = snprintf(orig->dest, len, "%s/%s/rootfs", oldpath, oldname);
+		if (ret < 0 || ret >= len) {
 			ERROR("rootfs path too long");
 			bdev_put(orig);
 			return NULL;
 		}
+		ret = stat(orig->dest, &sb);
+		if (ret < 0 && errno == ENOENT)
+			if (mkdir_p(orig->dest, 0755) < 0)
+				WARN("Error creating '%s', continuing.", orig->dest);
 	}
 
 	/*
-- 
2.1.0


From stgraber at ubuntu.com  Thu Jan 29 16:53:04 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Thu, 29 Jan 2015 17:53:04 +0100
Subject: [lxc-devel] [PATCH 1/1] clone_paths: use 'rootfs' for
 destination directory
In-Reply-To: <20150129160945.GJ16770@ubuntumail>
References: <20150129160945.GJ16770@ubuntumail>
Message-ID: <20150129165304.GA18477@castiana.ipv6.teksavvy.com>

On Thu, Jan 29, 2015 at 04:09:45PM +0000, Serge Hallyn wrote:
> We were trying to be smart and use whatever the last part of
> the container's rootfs path was.  However for block devices
> that doesn't make much sense.  I.e. if lxc.rootfs = /dev/md-1,
> chances are that /var/lib/lxc/c1/md-1 does not exist.
> 
> So always use the $lxcpath/$lxcname/rootfs, and if it does
> not exist, try to create it.
> 
> With this, 'lxc-clone -s -o c1 -n c2' where c1 has an lvm backend
> is fixed.  See https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1414771
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/bdev.c | 22 +++++++++++-----------
>  1 file changed, 11 insertions(+), 11 deletions(-)
> 
> diff --git a/src/lxc/bdev.c b/src/lxc/bdev.c
> index 721a72b..197ab55 100644
> --- a/src/lxc/bdev.c
> +++ b/src/lxc/bdev.c
> @@ -3340,7 +3340,6 @@ struct bdev *bdev_copy(struct lxc_container *c0, const char *cname,
>  	const char *oldname = c0->name;
>  	const char *oldpath = c0->config_path;
>  	struct rsync_data data;
> -	char *rootfs;
>  
>  	/* if the container name doesn't show up in the rootfs path, then
>  	 * we don't know how to come up with a new name
> @@ -3359,25 +3358,26 @@ struct bdev *bdev_copy(struct lxc_container *c0, const char *cname,
>  
>  	if (!orig->dest) {
>  		int ret;
> -		orig->dest = malloc(MAXPATHLEN);
> +		size_t len;
> +		struct stat sb;
> +
> +		len = strlen(oldpath) + strlen(oldname) + strlen("/rootfs") + 2;
> +		orig->dest = malloc(len);
>  		if (!orig->dest) {
>  			ERROR("out of memory");
>  			bdev_put(orig);
>  			return NULL;
>  		}
> -		rootfs = strrchr(orig->src, '/');
> -		if (!rootfs) {
> -			ERROR("invalid rootfs path");
> -			bdev_put(orig);
> -			return NULL;
> -		}
> -		rootfs++;
> -		ret = snprintf(orig->dest, MAXPATHLEN, "%s/%s/%s", oldpath, oldname, rootfs);
> -		if (ret < 0 || ret >= MAXPATHLEN) {
> +		ret = snprintf(orig->dest, len, "%s/%s/rootfs", oldpath, oldname);
> +		if (ret < 0 || ret >= len) {
>  			ERROR("rootfs path too long");
>  			bdev_put(orig);
>  			return NULL;
>  		}
> +		ret = stat(orig->dest, &sb);
> +		if (ret < 0 && errno == ENOENT)
> +			if (mkdir_p(orig->dest, 0755) < 0)
> +				WARN("Error creating '%s', continuing.", orig->dest);
>  	}
>  
>  	/*
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150129/940b73ff/attachment.sig>

From noreply at github.com  Thu Jan 29 16:55:15 2015
From: noreply at github.com (GitHub)
Date: Thu, 29 Jan 2015 08:55:15 -0800
Subject: [lxc-devel] [lxc/lxc] 730e3f: clone_paths: use 'rootfs' for
 destination director...
Message-ID: <54ca65f3ae28c_4cfb3fcde2b8b2b8762a1@hookshot-fe1-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 730e3f9e2ffcc7e34c4236a37215f6be8c8cc7f3
      https://github.com/lxc/lxc/commit/730e3f9e2ffcc7e34c4236a37215f6be8c8cc7f3
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-29 (Thu, 29 Jan 2015)

  Changed paths:
    M src/lxc/bdev.c

  Log Message:
  -----------
  clone_paths: use 'rootfs' for destination directory

We were trying to be smart and use whatever the last part of
the container's rootfs path was.  However for block devices
that doesn't make much sense.  I.e. if lxc.rootfs = /dev/md-1,
chances are that /var/lib/lxc/c1/md-1 does not exist.

So always use the $lxcpath/$lxcname/rootfs, and if it does
not exist, try to create it.

With this, 'lxc-clone -s -o c1 -n c2' where c1 has an lvm backend
is fixed.  See https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1414771

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>



From stgraber at ubuntu.com  Thu Jan 29 21:59:58 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Thu, 29 Jan 2015 22:59:58 +0100
Subject: [lxc-devel] [PATCH 1/2] centos: Fix booting a Centos 6 container
Message-ID: <1422568799-8944-1-git-send-email-stgraber@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 templates/lxc-centos.in | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
index 4696ce3..dd9b254 100644
--- a/templates/lxc-centos.in
+++ b/templates/lxc-centos.in
@@ -270,7 +270,6 @@ EOF
     # set minimal fstab
     cat <<EOF > $rootfs_path/etc/fstab
 /dev/root               /                       rootfs   defaults        0 0
-none                    /dev/shm                tmpfs    nosuid,nodev    0 0
 EOF
 
     # create lxc compatibility init script
@@ -280,14 +279,19 @@ start on startup
 env container
 
 pre-start script
-        if [ "x$container" != "xlxc" -a "x$container" != "xlibvirt" ]; then
+        if [ "x\$container" != "xlxc" -a "x\$container" != "xlibvirt" ]; then
                 stop;
         fi
-        initctl start tty TTY=console
+
         rm -f /var/lock/subsys/*
         rm -f /var/run/*.pid
+        [ -e /etc/mtab ] || ln -s /proc/mounts /etc/mtab
+        mkdir -p /dev/shm
+        mount -t tmpfs -o nosuid,nodev tmpfs /dev/shm
+
+        initctl start tty TTY=console
         telinit 3
-        exit 0;
+        exit 0
 end script
 EOF
     elif [ "$release" = "5" ]; then
-- 
1.9.1


From stgraber at ubuntu.com  Thu Jan 29 21:59:59 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Thu, 29 Jan 2015 22:59:59 +0100
Subject: [lxc-devel] [PATCH 2/2] oracle: Fix /dev/shm
In-Reply-To: <1422568799-8944-1-git-send-email-stgraber@ubuntu.com>
References: <1422568799-8944-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <1422568799-8944-2-git-send-email-stgraber@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 templates/.lxc-ubuntu.in.swp | Bin 0 -> 16384 bytes
 templates/lxc-oracle.in      |   8 ++++----
 2 files changed, 4 insertions(+), 4 deletions(-)
 create mode 100644 templates/.lxc-ubuntu.in.swp

diff --git a/templates/.lxc-ubuntu.in.swp b/templates/.lxc-ubuntu.in.swp
new file mode 100644
index 0000000000000000000000000000000000000000..20fcc390292a4bbc7b45c5d905f0ce6a6d0a7e9d
GIT binary patch
literal 16384
zcmeI3TWlQF8OMj-xD{H_hr&bAm-RMlC!W1Hi9vQY#27nqWyi_dCb0-OvomLR2hYw-
z=Hj(U(n?idP#-|Os1H?9OX&q at RUSZ4T7g8RR;3b!6eOsGRH>D!_NA&oRN~tIcjmI2
zwH at H0s;bUPKkx3je&;*qeCIpgj_c)HXXfaJ;$8)>Pb<pLzVqxN9sa8F+s`VBA2dC!
zE<Db<*h|;^z|?H*Vr4k*i%EkeLkqN$?iiwEt?QCNv|URJgwNm9upZh$STybTYck8v
zG>~cF18d+aWzR^Z%*6+CJLoglEPddbS;0&LnFcZqWE#jckZB;(K&F9A1DOW?_cai>
zmnvVvFg_9wr4zqj()a#e{7UlI`|{t7^ZhveAAR}n#Q9&2)9Y~uNk4DL`FfoHm%jYB
z`r1Df3!K#dXk5>Y-=FNukCU^vOaqw)G7V%J$TW~?Ak#pmflLFL1~Ls~8pt&8f2je@
zi0=Mx@<kfI|0nnR*FU8wuYrGp$H8O31{PQaD!3B- at oGhR8GH*YgX_Q_u2Piq;2tms
zE(0%pQc+$6_ktPluPYVh4e%Uz5_}sR2UmcnuTYdnz=Plc at O{t$hrl$r2^;{|gV!&I
zoZvk81$Y8H4jusagKvPZfDo8q8Jqwrc=s}t2R`t?F)#y0Km`=QHQ;J+6?o%PMR@`I
z2K)*<4DJR#xE-7XJHWf2P?W!c7r-yU55V`pcYzK@!CN0!lsCaoz&Ah>oB}K0Ch*?J
z6y?|8Y48-d3ycB<JcD4z&%xc`82AF10V?<_;vSEIhr#{eKHvfe+zjMA%au;?tGz~f
z&vAl=UlM^{GHo*``F^XYJ9cCHoT6d+THO+clC<NsNxiTFTH%&fT8<yA>{=BYyOgxF
z-fBAr?OsoN2z{^Q*G;?RI+m$#sGeRll&Se?MXZ|vRmv4*U`L7b{Z_XTEuaGzZGrah
zCvJp=G#hjqsofseG_Pct^^)PPHZkmmQ*vBkLtxbx-kR`=F61_CKcL&kDQF2>wlY9X
zVG9qBs*o)@w6JiPFfxR_xQm7<-}s~6Vx=a+QRw2C7ol2?u33U+CypGd=J_w3JxhTX
zitXw}6;$*|o68H!-?riw9SVD8X`#5ZIIZ6JA-dhJR;13mC at 1C0(e2!(&|6L-C^bFd
zk~&4|Y0BL(Ie4;I+&#1_pSwVrZEaPMA9{j1f?C>|U`>-AdY-TYiq&O^hG`3fOgqYT
z>_9^T9!z3Q_b6R<pUa1sz_Glm`F_Xoj2xZqpAEewGrNnof40zoW*DTZx+i$vT25P#
z>XTf7b<J;)>_qn8RRor&!6l)Lc#!=9Zr&tvzXid at nSH~f=j5i7buca(z-UdMl1HO@
z(mm03psG8ax=#(qBkWb*v4l_iNV5$ZCEv7lsZz(bHYged?d_K1C#$#%e)-U>YEsTG
zRZr%G=bg-zs^wBHS-R3Hgoaov at t=MP{m^wi;rp1XCRt)lSmcC(8wOG?uAy)rQb#-b
z4TKy!WRGT3HAEovATm6u0(ti~8s(9(u at N%eQB|`n4?PIakCQ7&vW at 4-WMX-2tSl4T
z{A3!$YnbawLzL5WxvXpvC}U$4mQEIyiEOIkZ;o5n^i^em7O@~3j%7I=)5aLF at O;v+
zV9}e2=i{)Qc?xEZu8oqexiW#9fk~*0+)ykRD at E=k&uO;S7I7-lk(zd@;0vk;FjyFI
zk5yxv95u%!1~6LzwV}ASW>J*R8tS(Ge(gvRx=rzJOC^)`)@*24IwEL6htLrjE!|bL
zFmPlVPEna}IZ>|V#Cnn?EGO1ik_;OeU=OaMFs6)a;?X0yMq5sY(59vb<{BGQ2+}Un
zG&I?Epj@`cURw)H#~#L*IU#PqAKW)ol-*!&G)$-;6QO%%9n-?2+0-LuYfUpPIWdk+
z8&2qvzu{wBDHl^#+zw8Lq+?lpfHzUYY_iGf?JmTYYswU<Fj+RSK-K&{`JL at jHNRJW
z_Jk!gUsUsZ<kw^ls`-&9Tb{_(d__5<q#dqA&qWRnDN1bgiX^uu45SuX0Y5v5`Qc;E
z+mz9 at NwX&=R~Dz{j?PXjPOVJNADNyxRLvbkYLXbG9n2}S^OF;^3yUas%S?^S^nORa
z!mClmoQieV at d7$Jv3R(e=f7j6<Uo%;!8DG^^L>m>D5h^NHT<l_&=0Ymc{lKkNBaxb
zo?B8B!?B}duGi8_uRyAb at QMuovJ+BU+n|nyvjdAO at HXU(oXi<c$F>~JIGIb$DOMEL
zfMyhPR5`FS(t5Y4#a_#cjcFGGs<WIhmb~3V+x5&ftiC1^QWNI)HYO(`m)E>zj;fSX
z)wbrk!capKN0RE`;M|ne<gCQ>u`st?P>K)Poja+HGig;}DbN6hfieeisv5lcZjm;W
z<%EcafS_1&Q0QQ2v#G`;2?NV#fUwn2Al_gzwq6{jeHEJaG<y{$jurw>h+vqe%|_6o
zY3yfjm~Ms%<NY`{K~x^8RLW{)PZ?%xX<>p}oHcd$Pl7bd!B*&)s3;FGI9Z<NZH)6N
zU^{5E<C(nUF+rI6X>>#jP9x~RsB$wri+;-qEhBOWJfRD74Qke)Xm^90hOBq!$P&%s
z<iQvZNsr8;qhTGsqa59qIjMxKJ85Qc<iIreY)@!zsy2Ce;>hB}%`>wzi_3&E(=&@l
zrWO`xdcH;zSdF#CnaQQui5eYUsvVtQm?{!2Kzbeq#NkHjIQfpxEFPX;TBM01%XECA
zRzsW1<5C|uxCm!t<i?nI;@QNoFm7l);DK=qa^=M;BbYci+5xN^j=a<XYQa%Or#LO(
z8h1>~ikD_1w1(yA;l29UM>K*%CRSHGIm0}xLDZCH&~bUY4Z$F95I=qGQCw3hB%M#6
zT-L1Lf(Z3!OI<K)J!@&41m+#C8AbvR-)wBKjL}kLHKC8TpUAZR6mFr12Cox8UMJ%$
zKW|I&L{~xF75tx)gYF@~L>ROjZ;XzcR!dlIniD2QxE~7Ruf;ZhJ=kcet5(qv2T)-W
z%gZyHt$?0+kVeXt@`Y8mC{e-udrd)y;g)RJv>&UnDT*!m?I6T+Y!ePYT$=U)Obi;3
zv&+Yo8?f1c*Jkp?02U8^n^+HoZA8Zyu04GFfWxt_Q)Krks^`mw60a~$ltwAOnQ*PR
zMrxU4K1 at 97CKoAoV->#tpT)iL1n!)C|4)8DKaacpkHI-m1G|9&UcvqT5pV`9fxTci
z*a<!lt^^8r2Y3Fr!JoiW-~rGA%b*74!4bgmffCpOt_Pn3e at A@aG4K%h5%?iE0j>eB
zB0g{){2p-Z;G5tSSOPV03|tHTjM%`-;3e=P;P}BBxC4xW-Cz(Dz-8bS!~>oKzXQ*L
zCjrM0R>3iF9e4#Xfak%Z;HTgr at E|w`nqUl+z%bYiUPCP4Rd65pI=C0y1D3%gxE5Rm
zt^k(<ju$)+9tB?mYv43k2DgGGFb5_<0bBy!#=JcN+Tc#WF$A8=;~;xw8pt&8-_bzi
zkmi)=ePAG$c<gZkEx}RZ1F_(ThEu><&~Eb)0H??c;U8%JD$WF-WDu!8?orGsT~9T-
zpvE@<>F%-DP>}J7Lga-d_YkBe9}7DmTM|A>WSYet9(|!(_8KXl#xvqe1$&xlTI#2E
zhZudrwIFuX5w+1Q^DeOxHOGIuo%UrW?aGlE&Pwt<2}5+Hxu`G-2kll|&(S$35eGK$
z9^JMm4_B(a(mfTS4}Dc at 3S8D>nWJ!HkA53)5ZOzUJ}YX<yPx!%iEp2|NSyplq}qbY
zsaDuk<&Juaqcga~sZ4wmC)@#aPK)GwUn#IWk~ZPs%m0!~E6XFEedIWvvb|*S{WZQ$
z_DhuNDw?%q#e5Li_(}!er(d$|B#Db}k|UL%VTFE6*YuW1d+)geMp5gkRBI{v63tt(
zu6dIrg$A|GDyh>|DwOVkOI3{0saiTixXIzZm>;2Y1<FV29g+><z7oYSPg9|%Qd){e
z4wN`BW``Ja9PyL4K9$3wQ4ihw+yLKylG&H;olo$T#jy0^vFTXTk&`d)PO2J at DH5rg
ziv}8f%fXk7;$`s&Qw42Wz`ZVKe6PYymaPo>EN~x%c!F~IK at +jSa41JRaAPfZW#4vp
z6nIS+Ai9Uu%ohmQ9#5POP59+;t5O+Utf#q7%fzxbL>;~3dZW42qsfs2J1ZPaJ`-Q-
z3q9q!mJ%JcO`oGKIl}#YoEjSDeVop1uZidyA4fx at otN$w!gWbT(Rf293znlYa)Uw}
zuG0~otK;gf#k-bul%^)P_H8xwp*v4H*1Y!U-uUW&TUSOoMM+)~Zr;v_eTdGnXV8o6
zoCk;=T8+LzBTZPF)1;KW+aT2^$3K#W at cTfoT9dXmC#Qox`5&55bI*;VJ)>Y5+eYso
zlDTAMRJn9y>p5_PHNt~3N4be~?vn~VMyh8!vN?*5$SKd`i>d9%J<mT<5Pt4Jw5q{D
z8EMG72W?`CFf09s47ccZjOwW-_8x4QwADuUs62J?voaP_2JzP8a}0YeY$B$2nkwCK
zr4cycYr2$&d)_s~f4eUkm!k1;g_BhE!d$<FND@`Xqv%z)lrQjOj~Q&JZIhKUL<>`s
zOEtt_R_11EwfPzXqT>h$apjS;>7;Db_x1&ivnqa7z<?rI<i{#xNQ8++T|hC!uMr6l
z8z{*iSMYJGt~D--*^dV&SH>0+)=@0+U{EyqxK)d4;(|m?Cf~Ly>Y>&6Y~;f6$E`|E
Tqoh1MRe5?2QTHUhaQy!UtKDyf

literal 0
HcmV?d00001

diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in
index c35ac40..5a6c3de 100644
--- a/templates/lxc-oracle.in
+++ b/templates/lxc-oracle.in
@@ -297,13 +297,13 @@ EOF
     if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
         grep -q "mount -t tmpfs tmpfs /dev/shm" $container_rootfs/etc/rc.sysinit
         if [ $? -eq 1 ]; then
-            echo "mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.sysinit
-            echo "mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.d/rc.sysinit
+            echo "mkdir -p /dev/shm && mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.sysinit
+            echo "mkdir -p /dev/shm && mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.d/rc.sysinit
         fi
     fi
     if [ $container_release_major = "6" ]; then
-        sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.sysinit
-        sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.d/rc.sysinit
+        sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mkdir -p /dev/shm && mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.sysinit
+        sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mkdir -p /dev/shm && mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.d/rc.sysinit
     fi
 
     # there might be other services that are useless but the below set is a good start
-- 
1.9.1


From stgraber at ubuntu.com  Thu Jan 29 22:06:05 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Thu, 29 Jan 2015 23:06:05 +0100
Subject: [lxc-devel] [PATCH] ubuntu: Drop lucid support and refresh releaess
	list
Message-ID: <1422569165-11669-1-git-send-email-stgraber@ubuntu.com>

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 templates/lxc-ubuntu-cloud.in |  2 +-
 templates/lxc-ubuntu.in       | 22 ----------------------
 2 files changed, 1 insertion(+), 23 deletions(-)

diff --git a/templates/lxc-ubuntu-cloud.in b/templates/lxc-ubuntu-cloud.in
index 81abf2a..92dc691 100644
--- a/templates/lxc-ubuntu-cloud.in
+++ b/templates/lxc-ubuntu-cloud.in
@@ -25,7 +25,7 @@ STATE_DIR="@LOCALSTATEDIR@"
 HOOK_DIR="@LXCHOOKDIR@"
 CLONE_HOOK_FN="$HOOK_DIR/ubuntu-cloud-prep"
 LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@"
-KNOWN_RELEASES="lucid precise quantal saucy trusty"
+KNOWN_RELEASES="precise trusty utopic vivid"
 skip_arch_check=${UCTEMPLATE_SKIP_ARCH_CHECK:-0}
 
 # Make sure the usual locations are in PATH
diff --git a/templates/lxc-ubuntu.in b/templates/lxc-ubuntu.in
index 073724b..55199dc 100644
--- a/templates/lxc-ubuntu.in
+++ b/templates/lxc-ubuntu.in
@@ -536,28 +536,6 @@ exit 101
 EOF
     chmod +x $rootfs/usr/sbin/policy-rc.d
 
-    if [ ! -f $rootfs/etc/init/container-detect.conf ]; then
-        # Make sure we have a working resolv.conf
-        cresolvonf="${rootfs}/etc/resolv.conf"
-        mv $cresolvonf ${cresolvonf}.lxcbak
-        cat /etc/resolv.conf > ${cresolvonf}
-
-        # for lucid, if not trimming, then add the ubuntu-virt
-        # ppa and install lxcguest
-        if [ $release = "lucid" ]; then
-            chroot $rootfs apt-get update
-            install_packages $rootfs "python-software-properties"
-            chroot $rootfs add-apt-repository ppa:ubuntu-virt/ppa
-        fi
-
-        chroot $rootfs apt-get update
-        chroot $rootfs apt-get install --force-yes -y lxcguest
-
-        # Restore old resolv.conf
-        rm -f ${cresolvonf}
-        mv ${cresolvonf}.lxcbak ${cresolvonf}
-    fi
-
     # If the container isn't running a native architecture, setup multiarch
     if [ -x "$(ls -1 ${rootfs}/usr/bin/qemu-*-static 2>/dev/null)" ]; then
         dpkg_version=$(chroot $rootfs dpkg-query -W -f='${Version}' dpkg)
-- 
1.9.1


From serge.hallyn at ubuntu.com  Thu Jan 29 22:46:37 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Thu, 29 Jan 2015 22:46:37 +0000
Subject: [lxc-devel] [PATCH 2/2] oracle: Fix /dev/shm
In-Reply-To: <1422568799-8944-2-git-send-email-stgraber@ubuntu.com>
References: <1422568799-8944-1-git-send-email-stgraber@ubuntu.com>
 <1422568799-8944-2-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150129224637.GL16770@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

though do drop the .swp please :)

> ---
>  templates/.lxc-ubuntu.in.swp | Bin 0 -> 16384 bytes
>  templates/lxc-oracle.in      |   8 ++++----
>  2 files changed, 4 insertions(+), 4 deletions(-)
>  create mode 100644 templates/.lxc-ubuntu.in.swp
> 
> diff --git a/templates/.lxc-ubuntu.in.swp b/templates/.lxc-ubuntu.in.swp
> new file mode 100644
> index 0000000000000000000000000000000000000000..20fcc390292a4bbc7b45c5d905f0ce6a6d0a7e9d
> GIT binary patch
> literal 16384
> zcmeI3TWlQF8OMj-xD{H_hr&bAm-RMlC!W1Hi9vQY#27nqWyi_dCb0-OvomLR2hYw-
> z=Hj(U(n?idP#-|Os1H?9OX&q at RUSZ4T7g8RR;3b!6eOsGRH>D!_NA&oRN~tIcjmI2
> zwH at H0s;bUPKkx3je&;*qeCIpgj_c)HXXfaJ;$8)>Pb<pLzVqxN9sa8F+s`VBA2dC!
> zE<Db<*h|;^z|?H*Vr4k*i%EkeLkqN$?iiwEt?QCNv|URJgwNm9upZh$STybTYck8v
> zG>~cF18d+aWzR^Z%*6+CJLoglEPddbS;0&LnFcZqWE#jckZB;(K&F9A1DOW?_cai>
> zmnvVvFg_9wr4zqj()a#e{7UlI`|{t7^ZhveAAR}n#Q9&2)9Y~uNk4DL`FfoHm%jYB
> z`r1Df3!K#dXk5>Y-=FNukCU^vOaqw)G7V%J$TW~?Ak#pmflLFL1~Ls~8pt&8f2je@
> zi0=Mx@<kfI|0nnR*FU8wuYrGp$H8O31{PQaD!3B- at oGhR8GH*YgX_Q_u2Piq;2tms
> zE(0%pQc+$6_ktPluPYVh4e%Uz5_}sR2UmcnuTYdnz=Plc at O{t$hrl$r2^;{|gV!&I
> zoZvk81$Y8H4jusagKvPZfDo8q8Jqwrc=s}t2R`t?F)#y0Km`=QHQ;J+6?o%PMR@`I
> z2K)*<4DJR#xE-7XJHWf2P?W!c7r-yU55V`pcYzK@!CN0!lsCaoz&Ah>oB}K0Ch*?J
> z6y?|8Y48-d3ycB<JcD4z&%xc`82AF10V?<_;vSEIhr#{eKHvfe+zjMA%au;?tGz~f
> z&vAl=UlM^{GHo*``F^XYJ9cCHoT6d+THO+clC<NsNxiTFTH%&fT8<yA>{=BYyOgxF
> z-fBAr?OsoN2z{^Q*G;?RI+m$#sGeRll&Se?MXZ|vRmv4*U`L7b{Z_XTEuaGzZGrah
> zCvJp=G#hjqsofseG_Pct^^)PPHZkmmQ*vBkLtxbx-kR`=F61_CKcL&kDQF2>wlY9X
> zVG9qBs*o)@w6JiPFfxR_xQm7<-}s~6Vx=a+QRw2C7ol2?u33U+CypGd=J_w3JxhTX
> zitXw}6;$*|o68H!-?riw9SVD8X`#5ZIIZ6JA-dhJR;13mC at 1C0(e2!(&|6L-C^bFd
> zk~&4|Y0BL(Ie4;I+&#1_pSwVrZEaPMA9{j1f?C>|U`>-AdY-TYiq&O^hG`3fOgqYT
> z>_9^T9!z3Q_b6R<pUa1sz_Glm`F_Xoj2xZqpAEewGrNnof40zoW*DTZx+i$vT25P#
> z>XTf7b<J;)>_qn8RRor&!6l)Lc#!=9Zr&tvzXid at nSH~f=j5i7buca(z-UdMl1HO@
> z(mm03psG8ax=#(qBkWb*v4l_iNV5$ZCEv7lsZz(bHYged?d_K1C#$#%e)-U>YEsTG
> zRZr%G=bg-zs^wBHS-R3Hgoaov at t=MP{m^wi;rp1XCRt)lSmcC(8wOG?uAy)rQb#-b
> z4TKy!WRGT3HAEovATm6u0(ti~8s(9(u at N%eQB|`n4?PIakCQ7&vW at 4-WMX-2tSl4T
> z{A3!$YnbawLzL5WxvXpvC}U$4mQEIyiEOIkZ;o5n^i^em7O@~3j%7I=)5aLF at O;v+
> zV9}e2=i{)Qc?xEZu8oqexiW#9fk~*0+)ykRD at E=k&uO;S7I7-lk(zd@;0vk;FjyFI
> zk5yxv95u%!1~6LzwV}ASW>J*R8tS(Ge(gvRx=rzJOC^)`)@*24IwEL6htLrjE!|bL
> zFmPlVPEna}IZ>|V#Cnn?EGO1ik_;OeU=OaMFs6)a;?X0yMq5sY(59vb<{BGQ2+}Un
> zG&I?Epj@`cURw)H#~#L*IU#PqAKW)ol-*!&G)$-;6QO%%9n-?2+0-LuYfUpPIWdk+
> z8&2qvzu{wBDHl^#+zw8Lq+?lpfHzUYY_iGf?JmTYYswU<Fj+RSK-K&{`JL at jHNRJW
> z_Jk!gUsUsZ<kw^ls`-&9Tb{_(d__5<q#dqA&qWRnDN1bgiX^uu45SuX0Y5v5`Qc;E
> z+mz9 at NwX&=R~Dz{j?PXjPOVJNADNyxRLvbkYLXbG9n2}S^OF;^3yUas%S?^S^nORa
> z!mClmoQieV at d7$Jv3R(e=f7j6<Uo%;!8DG^^L>m>D5h^NHT<l_&=0Ymc{lKkNBaxb
> zo?B8B!?B}duGi8_uRyAb at QMuovJ+BU+n|nyvjdAO at HXU(oXi<c$F>~JIGIb$DOMEL
> zfMyhPR5`FS(t5Y4#a_#cjcFGGs<WIhmb~3V+x5&ftiC1^QWNI)HYO(`m)E>zj;fSX
> z)wbrk!capKN0RE`;M|ne<gCQ>u`st?P>K)Poja+HGig;}DbN6hfieeisv5lcZjm;W
> z<%EcafS_1&Q0QQ2v#G`;2?NV#fUwn2Al_gzwq6{jeHEJaG<y{$jurw>h+vqe%|_6o
> zY3yfjm~Ms%<NY`{K~x^8RLW{)PZ?%xX<>p}oHcd$Pl7bd!B*&)s3;FGI9Z<NZH)6N
> zU^{5E<C(nUF+rI6X>>#jP9x~RsB$wri+;-qEhBOWJfRD74Qke)Xm^90hOBq!$P&%s
> z<iQvZNsr8;qhTGsqa59qIjMxKJ85Qc<iIreY)@!zsy2Ce;>hB}%`>wzi_3&E(=&@l
> zrWO`xdcH;zSdF#CnaQQui5eYUsvVtQm?{!2Kzbeq#NkHjIQfpxEFPX;TBM01%XECA
> zRzsW1<5C|uxCm!t<i?nI;@QNoFm7l);DK=qa^=M;BbYci+5xN^j=a<XYQa%Or#LO(
> z8h1>~ikD_1w1(yA;l29UM>K*%CRSHGIm0}xLDZCH&~bUY4Z$F95I=qGQCw3hB%M#6
> zT-L1Lf(Z3!OI<K)J!@&41m+#C8AbvR-)wBKjL}kLHKC8TpUAZR6mFr12Cox8UMJ%$
> zKW|I&L{~xF75tx)gYF@~L>ROjZ;XzcR!dlIniD2QxE~7Ruf;ZhJ=kcet5(qv2T)-W
> z%gZyHt$?0+kVeXt@`Y8mC{e-udrd)y;g)RJv>&UnDT*!m?I6T+Y!ePYT$=U)Obi;3
> zv&+Yo8?f1c*Jkp?02U8^n^+HoZA8Zyu04GFfWxt_Q)Krks^`mw60a~$ltwAOnQ*PR
> zMrxU4K1 at 97CKoAoV->#tpT)iL1n!)C|4)8DKaacpkHI-m1G|9&UcvqT5pV`9fxTci
> z*a<!lt^^8r2Y3Fr!JoiW-~rGA%b*74!4bgmffCpOt_Pn3e at A@aG4K%h5%?iE0j>eB
> zB0g{){2p-Z;G5tSSOPV03|tHTjM%`-;3e=P;P}BBxC4xW-Cz(Dz-8bS!~>oKzXQ*L
> zCjrM0R>3iF9e4#Xfak%Z;HTgr at E|w`nqUl+z%bYiUPCP4Rd65pI=C0y1D3%gxE5Rm
> zt^k(<ju$)+9tB?mYv43k2DgGGFb5_<0bBy!#=JcN+Tc#WF$A8=;~;xw8pt&8-_bzi
> zkmi)=ePAG$c<gZkEx}RZ1F_(ThEu><&~Eb)0H??c;U8%JD$WF-WDu!8?orGsT~9T-
> zpvE@<>F%-DP>}J7Lga-d_YkBe9}7DmTM|A>WSYet9(|!(_8KXl#xvqe1$&xlTI#2E
> zhZudrwIFuX5w+1Q^DeOxHOGIuo%UrW?aGlE&Pwt<2}5+Hxu`G-2kll|&(S$35eGK$
> z9^JMm4_B(a(mfTS4}Dc at 3S8D>nWJ!HkA53)5ZOzUJ}YX<yPx!%iEp2|NSyplq}qbY
> zsaDuk<&Juaqcga~sZ4wmC)@#aPK)GwUn#IWk~ZPs%m0!~E6XFEedIWvvb|*S{WZQ$
> z_DhuNDw?%q#e5Li_(}!er(d$|B#Db}k|UL%VTFE6*YuW1d+)geMp5gkRBI{v63tt(
> zu6dIrg$A|GDyh>|DwOVkOI3{0saiTixXIzZm>;2Y1<FV29g+><z7oYSPg9|%Qd){e
> z4wN`BW``Ja9PyL4K9$3wQ4ihw+yLKylG&H;olo$T#jy0^vFTXTk&`d)PO2J at DH5rg
> ziv}8f%fXk7;$`s&Qw42Wz`ZVKe6PYymaPo>EN~x%c!F~IK at +jSa41JRaAPfZW#4vp
> z6nIS+Ai9Uu%ohmQ9#5POP59+;t5O+Utf#q7%fzxbL>;~3dZW42qsfs2J1ZPaJ`-Q-
> z3q9q!mJ%JcO`oGKIl}#YoEjSDeVop1uZidyA4fx at otN$w!gWbT(Rf293znlYa)Uw}
> zuG0~otK;gf#k-bul%^)P_H8xwp*v4H*1Y!U-uUW&TUSOoMM+)~Zr;v_eTdGnXV8o6
> zoCk;=T8+LzBTZPF)1;KW+aT2^$3K#W at cTfoT9dXmC#Qox`5&55bI*;VJ)>Y5+eYso
> zlDTAMRJn9y>p5_PHNt~3N4be~?vn~VMyh8!vN?*5$SKd`i>d9%J<mT<5Pt4Jw5q{D
> z8EMG72W?`CFf09s47ccZjOwW-_8x4QwADuUs62J?voaP_2JzP8a}0YeY$B$2nkwCK
> zr4cycYr2$&d)_s~f4eUkm!k1;g_BhE!d$<FND@`Xqv%z)lrQjOj~Q&JZIhKUL<>`s
> zOEtt_R_11EwfPzXqT>h$apjS;>7;Db_x1&ivnqa7z<?rI<i{#xNQ8++T|hC!uMr6l
> z8z{*iSMYJGt~D--*^dV&SH>0+)=@0+U{EyqxK)d4;(|m?Cf~Ly>Y>&6Y~;f6$E`|E
> Tqoh1MRe5?2QTHUhaQy!UtKDyf
> 
> literal 0
> HcmV?d00001
> 
> diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in
> index c35ac40..5a6c3de 100644
> --- a/templates/lxc-oracle.in
> +++ b/templates/lxc-oracle.in
> @@ -297,13 +297,13 @@ EOF
>      if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
>          grep -q "mount -t tmpfs tmpfs /dev/shm" $container_rootfs/etc/rc.sysinit
>          if [ $? -eq 1 ]; then
> -            echo "mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.sysinit
> -            echo "mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.d/rc.sysinit
> +            echo "mkdir -p /dev/shm && mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.sysinit
> +            echo "mkdir -p /dev/shm && mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.d/rc.sysinit
>          fi
>      fi
>      if [ $container_release_major = "6" ]; then
> -        sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.sysinit
> -        sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.d/rc.sysinit
> +        sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mkdir -p /dev/shm && mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.sysinit
> +        sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mkdir -p /dev/shm && mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.d/rc.sysinit
>      fi
>  
>      # there might be other services that are useless but the below set is a good start
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From serge.hallyn at ubuntu.com  Thu Jan 29 22:47:41 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Thu, 29 Jan 2015 22:47:41 +0000
Subject: [lxc-devel] [PATCH 1/2] centos: Fix booting a Centos 6 container
In-Reply-To: <1422568799-8944-1-git-send-email-stgraber@ubuntu.com>
References: <1422568799-8944-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150129224741.GM16770@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  templates/lxc-centos.in | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
> index 4696ce3..dd9b254 100644
> --- a/templates/lxc-centos.in
> +++ b/templates/lxc-centos.in
> @@ -270,7 +270,6 @@ EOF
>      # set minimal fstab
>      cat <<EOF > $rootfs_path/etc/fstab
>  /dev/root               /                       rootfs   defaults        0 0
> -none                    /dev/shm                tmpfs    nosuid,nodev    0 0
>  EOF
>  
>      # create lxc compatibility init script
> @@ -280,14 +279,19 @@ start on startup
>  env container
>  
>  pre-start script
> -        if [ "x$container" != "xlxc" -a "x$container" != "xlibvirt" ]; then
> +        if [ "x\$container" != "xlxc" -a "x\$container" != "xlibvirt" ]; then
>                  stop;
>          fi
> -        initctl start tty TTY=console
> +
>          rm -f /var/lock/subsys/*
>          rm -f /var/run/*.pid
> +        [ -e /etc/mtab ] || ln -s /proc/mounts /etc/mtab
> +        mkdir -p /dev/shm
> +        mount -t tmpfs -o nosuid,nodev tmpfs /dev/shm
> +
> +        initctl start tty TTY=console
>          telinit 3
> -        exit 0;
> +        exit 0
>  end script
>  EOF
>      elif [ "$release" = "5" ]; then
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From noreply at github.com  Thu Jan 29 22:56:28 2015
From: noreply at github.com (GitHub)
Date: Thu, 29 Jan 2015 14:56:28 -0800
Subject: [lxc-devel] [lxc/lxc] 03cbef: change version to 1.1.0.rc4 in
	configure.ac
Message-ID: <54caba9cd2ec0_128d3fd5586f729c669ca@hookshot-fe6-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 03cbefb8148c681a70601ce43577e9e2f697971c
      https://github.com/lxc/lxc/commit/03cbefb8148c681a70601ce43577e9e2f697971c
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-29 (Thu, 29 Jan 2015)

  Changed paths:
    M configure.ac

  Log Message:
  -----------
  change version to 1.1.0.rc4 in configure.ac

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>



From noreply at github.com  Thu Jan 29 22:57:48 2015
From: noreply at github.com (GitHub)
Date: Thu, 29 Jan 2015 14:57:48 -0800
Subject: [lxc-devel] [lxc/lxc]
Message-ID: <54cabaeca75a0_220c3fb7ecb932bc776de@hookshot-fe5-cp1-prd.iad.github.net.mail>

  Branch: refs/tags/lxc-1.1.0.rc4
  Home:   https://github.com/lxc/lxc

From serge.hallyn at ubuntu.com  Thu Jan 29 23:01:38 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Thu, 29 Jan 2015 23:01:38 +0000
Subject: [lxc-devel] [PATCH] ubuntu: Drop lucid support and refresh
 releaess list
In-Reply-To: <1422569165-11669-1-git-send-email-stgraber@ubuntu.com>
References: <1422569165-11669-1-git-send-email-stgraber@ubuntu.com>
Message-ID: <20150129230138.GN16770@ubuntumail>

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  templates/lxc-ubuntu-cloud.in |  2 +-
>  templates/lxc-ubuntu.in       | 22 ----------------------
>  2 files changed, 1 insertion(+), 23 deletions(-)
> 
> diff --git a/templates/lxc-ubuntu-cloud.in b/templates/lxc-ubuntu-cloud.in
> index 81abf2a..92dc691 100644
> --- a/templates/lxc-ubuntu-cloud.in
> +++ b/templates/lxc-ubuntu-cloud.in
> @@ -25,7 +25,7 @@ STATE_DIR="@LOCALSTATEDIR@"
>  HOOK_DIR="@LXCHOOKDIR@"
>  CLONE_HOOK_FN="$HOOK_DIR/ubuntu-cloud-prep"
>  LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@"
> -KNOWN_RELEASES="lucid precise quantal saucy trusty"
> +KNOWN_RELEASES="precise trusty utopic vivid"
>  skip_arch_check=${UCTEMPLATE_SKIP_ARCH_CHECK:-0}
>  
>  # Make sure the usual locations are in PATH
> diff --git a/templates/lxc-ubuntu.in b/templates/lxc-ubuntu.in
> index 073724b..55199dc 100644
> --- a/templates/lxc-ubuntu.in
> +++ b/templates/lxc-ubuntu.in
> @@ -536,28 +536,6 @@ exit 101
>  EOF
>      chmod +x $rootfs/usr/sbin/policy-rc.d
>  
> -    if [ ! -f $rootfs/etc/init/container-detect.conf ]; then
> -        # Make sure we have a working resolv.conf
> -        cresolvonf="${rootfs}/etc/resolv.conf"
> -        mv $cresolvonf ${cresolvonf}.lxcbak
> -        cat /etc/resolv.conf > ${cresolvonf}
> -
> -        # for lucid, if not trimming, then add the ubuntu-virt
> -        # ppa and install lxcguest
> -        if [ $release = "lucid" ]; then
> -            chroot $rootfs apt-get update
> -            install_packages $rootfs "python-software-properties"
> -            chroot $rootfs add-apt-repository ppa:ubuntu-virt/ppa
> -        fi
> -
> -        chroot $rootfs apt-get update
> -        chroot $rootfs apt-get install --force-yes -y lxcguest
> -
> -        # Restore old resolv.conf
> -        rm -f ${cresolvonf}
> -        mv ${cresolvonf}.lxcbak ${cresolvonf}
> -    fi
> -
>      # If the container isn't running a native architecture, setup multiarch
>      if [ -x "$(ls -1 ${rootfs}/usr/bin/qemu-*-static 2>/dev/null)" ]; then
>          dpkg_version=$(chroot $rootfs dpkg-query -W -f='${Version}' dpkg)
> -- 
> 1.9.1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From noreply at github.com  Thu Jan 29 23:08:19 2015
From: noreply at github.com (GitHub)
Date: Thu, 29 Jan 2015 15:08:19 -0800
Subject: [lxc-devel] [lxc/lxc] a79df2: centos: Fix booting a Centos 6
	container
Message-ID: <54cabd63275fa_5c083ffc9ac4f2bc101792@hookshot-fe2-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: a79df22733c48898aaeb600cc073278236d4b489
      https://github.com/lxc/lxc/commit/a79df22733c48898aaeb600cc073278236d4b489
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-centos.in

  Log Message:
  -----------
  centos: Fix booting a Centos 6 container

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: c60edd18659c3aa84a38df173418fb511a3a94c0
      https://github.com/lxc/lxc/commit/c60edd18659c3aa84a38df173418fb511a3a94c0
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-oracle.in

  Log Message:
  -----------
  oracle: Fix /dev/shm

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: ae0aeadeaab6b2535952dd699efdf889c4f7464f
      https://github.com/lxc/lxc/commit/ae0aeadeaab6b2535952dd699efdf889c4f7464f
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-ubuntu-cloud.in
    M templates/lxc-ubuntu.in

  Log Message:
  -----------
  ubuntu: Drop lucid support and refresh releaess list

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/03cbefb8148c...ae0aeadeaab6

From tpapp at chemaxon.com  Thu Jan 29 23:04:56 2015
From: tpapp at chemaxon.com (Tamas Papp)
Date: Fri, 30 Jan 2015 00:04:56 +0100
Subject: [lxc-devel] lxd ppa
Message-ID: <54CABC98.2010309@chemaxon.com>

hi All,

lxd daily ppa misses lxd package (there are others like criu, golang).

Is is intentional/temporary behaviour?

10x
tamas

From builds at travis-ci.org  Thu Jan 29 23:06:36 2015
From: builds at travis-ci.org (Travis CI)
Date: Thu, 29 Jan 2015 23:06:36 +0000
Subject: [lxc-devel] Passed: lxc/lxc#841 (lxc-1.1.0.rc4 - 03cbefb)
In-Reply-To: <lxc/lxc+48828526+passed@travis-ci.org>
Message-ID: <54cabcfba9308_3168f30441464e@a30b6f92-5dbf-4129-be2d-debc22ce8ecf.mail>

Build Update for lxc/lxc
-------------------------------------

Build: #841
Status: Passed

Duration: 55 seconds
Commit: 03cbefb (lxc-1.1.0.rc4)
Author: Stéphane Graber
Message: change version to 1.1.0.rc4 in configure.ac

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

View the changeset: https://github.com/lxc/lxc/compare/lxc-1.1.0.rc4

View the full build log and details: https://travis-ci.org/lxc/lxc/builds/48828526

--

You can configure recipients for build notifications in your .travis.yml file. See http://docs.travis-ci.com/user/notifications



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150129/ae0d41af/attachment.html>

From stgraber at ubuntu.com  Thu Jan 29 23:26:41 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 30 Jan 2015 00:26:41 +0100
Subject: [lxc-devel] lxd ppa
In-Reply-To: <54CABC98.2010309@chemaxon.com>
References: <54CABC98.2010309@chemaxon.com>
Message-ID: <20150129232641.GE18477@castiana.ipv6.teksavvy.com>

On Fri, Jan 30, 2015 at 12:04:56AM +0100, Tamas Papp wrote:
> hi All,
> 
> lxd daily ppa misses lxd package (there are others like criu, golang).
> 
> Is is intentional/temporary behaviour?
> 
> 10x
> tamas

Hi,

Yes, it's intentional as we are still working on the packaging, they
should appear in the next few days though.

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150130/c0cb1c39/attachment.sig>

From serge.hallyn at ubuntu.com  Thu Jan 29 23:50:41 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Thu, 29 Jan 2015 23:50:41 +0000
Subject: [lxc-devel] [PATCH 1/1] apparmor: support lxc.ttydir when
	bind-mounting ptys
Message-ID: <20150129235041.GO16770@ubuntumail>

Because we now create the ttys from inside the container, we had to
add an apparmor rule for start-container to bind-mount /dev/pts/** -> /dev/tty*/.
However that's not sufficient if the container sets lxc.ttydir, in
which case we need to support mounting onto files in subdirs of /dev.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 config/apparmor/abstractions/start-container | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/apparmor/abstractions/start-container b/config/apparmor/abstractions/start-container
index 0d02379..b06a84d 100644
--- a/config/apparmor/abstractions/start-container
+++ b/config/apparmor/abstractions/start-container
@@ -13,7 +13,7 @@
   mount -> /usr/lib/lxc/{**,},
   mount fstype=devpts -> /dev/pts/,
   mount options=bind /dev/pts/ptmx/ -> /dev/ptmx/,
-  mount options=bind /dev/pts/** -> /dev/tty*/,
+  mount options=bind /dev/pts/** -> /dev/**,
   mount options=(rw, make-slave) -> **,
   mount fstype=debugfs,
   # allow pre-mount hooks to stage mounts under /var/lib/lxc/<container>/
-- 
2.1.0


From stgraber at ubuntu.com  Fri Jan 30 00:01:39 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 30 Jan 2015 01:01:39 +0100
Subject: [lxc-devel] [PATCH 1/1] apparmor: support lxc.ttydir when
 bind-mounting ptys
In-Reply-To: <20150129235041.GO16770@ubuntumail>
References: <20150129235041.GO16770@ubuntumail>
Message-ID: <20150130000139.GG18477@castiana.ipv6.teksavvy.com>

On Thu, Jan 29, 2015 at 11:50:41PM +0000, Serge Hallyn wrote:
> Because we now create the ttys from inside the container, we had to
> add an apparmor rule for start-container to bind-mount /dev/pts/** -> /dev/tty*/.
> However that's not sufficient if the container sets lxc.ttydir, in
> which case we need to support mounting onto files in subdirs of /dev.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  config/apparmor/abstractions/start-container | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/config/apparmor/abstractions/start-container b/config/apparmor/abstractions/start-container
> index 0d02379..b06a84d 100644
> --- a/config/apparmor/abstractions/start-container
> +++ b/config/apparmor/abstractions/start-container
> @@ -13,7 +13,7 @@
>    mount -> /usr/lib/lxc/{**,},
>    mount fstype=devpts -> /dev/pts/,
>    mount options=bind /dev/pts/ptmx/ -> /dev/ptmx/,
> -  mount options=bind /dev/pts/** -> /dev/tty*/,
> +  mount options=bind /dev/pts/** -> /dev/**,
>    mount options=(rw, make-slave) -> **,
>    mount fstype=debugfs,
>    # allow pre-mount hooks to stage mounts under /var/lib/lxc/<container>/
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150130/f244ecee/attachment.sig>

From noreply at github.com  Fri Jan 30 00:02:09 2015
From: noreply at github.com (GitHub)
Date: Thu, 29 Jan 2015 16:02:09 -0800
Subject: [lxc-devel] [lxc/lxc] 1b0c17: apparmor: support lxc.ttydir when
 bind-mounting pt...
Message-ID: <54caca01ed350_489f3f8a0bb8f2c097822@hookshot-fe1-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 1b0c17462ad4f9a05ea6e5ced5e444152ec7a193
      https://github.com/lxc/lxc/commit/1b0c17462ad4f9a05ea6e5ced5e444152ec7a193
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M config/apparmor/abstractions/start-container

  Log Message:
  -----------
  apparmor: support lxc.ttydir when bind-mounting ptys

Because we now create the ttys from inside the container, we had to
add an apparmor rule for start-container to bind-mount /dev/pts/** -> /dev/tty*/.
However that's not sufficient if the container sets lxc.ttydir, in
which case we need to support mounting onto files in subdirs of /dev.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>



From karma at jazz.email.ne.jp  Fri Jan 30 07:05:59 2015
From: karma at jazz.email.ne.jp (KATOH Yasufumi)
Date: Fri, 30 Jan 2015 16:05:59 +0900
Subject: [lxc-devel] [PATCH] doc: Add the description of sys:mixed in
	Japanese lxc.container.conf(5)
Message-ID: <1422601559-10391-1-git-send-email-karma@jazz.email.ne.jp>

Update for commit f24a52d

Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>
---
 doc/ja/lxc.container.conf.sgml.in | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/doc/ja/lxc.container.conf.sgml.in b/doc/ja/lxc.container.conf.sgml.in
index afdd31e..488b9dd 100644
--- a/doc/ja/lxc.container.conf.sgml.in
+++ b/doc/ja/lxc.container.conf.sgml.in
@@ -1075,15 +1075,28 @@ proc proc proc nodev,noexec,nosuid 0 0
                 </para>
 	      </listitem>
 	      <listitem>
+		<!--
+                <para>
+                  <option>sys:mixed</option> (or <option>sys</option>):
+                  mount <filename>/sys</filename> as read-only but with
+                  /sys/devices/virtual/net writable.
+                </para>
+		-->
+		<para>
+		  <option>sys:mixed</option> (or <option>sys</option>):
+		  /sys/devices/virtual/net のみ書き込み可能で、その他の <filename>/sys</filename> はリードオンリーでマウントします。
+		</para>
+              </listitem>
+	      <listitem>
                 <!--
 	        <para>
-	          <option>sys:ro</option> (or <option>sys</option>):
+	          <option>sys:ro</option>
 	          mount <filename>/sys</filename> as read-only
 	          for security / container isolation purposes.
 	        </para>
                 -->
                 <para>
-                  <option>sys:ro</option> (or <option>sys</option>):
+                  <option>sys:ro</option>:
                   <filename>/sys</filename> を、セキュリティとコンテナの隔離の目的でリードオンリーでマウントします。
                 </para>
 	      </listitem>
-- 
2.2.1


From noreply at github.com  Fri Jan 30 07:53:57 2015
From: noreply at github.com (GitHub)
Date: Thu, 29 Jan 2015 23:53:57 -0800
Subject: [lxc-devel] [lxc/lxc] dd93ef: doc: Add the description of sys:mixed
 in Japanese ...
Message-ID: <54cb3895d27a3_1d723fab9ad072a01105ad@hookshot-fe5-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: dd93ef87b2cdf5683c805396b9b36a519db4d0a3
      https://github.com/lxc/lxc/commit/dd93ef87b2cdf5683c805396b9b36a519db4d0a3
  Author: KATOH Yasufumi <karma at jazz.email.ne.jp>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M doc/ja/lxc.container.conf.sgml.in

  Log Message:
  -----------
  doc: Add the description of sys:mixed in Japanese lxc.container.conf(5)

Update for commit f24a52d

Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>



From stgraber at ubuntu.com  Fri Jan 30 07:57:15 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 30 Jan 2015 08:57:15 +0100
Subject: [lxc-devel] LXC 1.1 expected to be released later today
Message-ID: <20150130075715.GH18477@castiana.ipv6.teksavvy.com>

Hello,

After those last few minute patches and RCs, it looks like we're finally
ready to release LXC 1.1

I'll now start to prepare the release paperwork for it and expect to do
the final tagging and send out the announcement in 3-4 hours time.

So that's basically your last chance for sending any critical bugfix for
inclusion in 1.1.

As I said before, we will be maintaining LXC 1.1 for 9 months or 2
months after LXC 1.2 is released, whichever happens last. This means
that we will be issuing bugfix releases of 1.1 as we're doing with 1.0,
however I expect to mostly process patches for 1.1 on request rather
than systematically do it for every bugfix commit.

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150130/3f8c6b9f/attachment.sig>

From noreply at github.com  Fri Jan 30 09:12:10 2015
From: noreply at github.com (GitHub)
Date: Fri, 30 Jan 2015 01:12:10 -0800
Subject: [lxc-devel] [lxc/lxc] dbe92c: centos: Fix booting a Centos 6
	container
Message-ID: <54cb4aeadf809_26fe3fb48951d2b843246@hookshot-fe1-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/stable-1.0
  Home:   https://github.com/lxc/lxc
  Commit: dbe92cfb77856372b5698665e22a39757692d7fd
      https://github.com/lxc/lxc/commit/dbe92cfb77856372b5698665e22a39757692d7fd
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-29 (Thu, 29 Jan 2015)

  Changed paths:
    M templates/lxc-centos.in

  Log Message:
  -----------
  centos: Fix booting a Centos 6 container

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: ca1bc485157632627759dc0231b2928f24efbfd8
      https://github.com/lxc/lxc/commit/ca1bc485157632627759dc0231b2928f24efbfd8
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-29 (Thu, 29 Jan 2015)

  Changed paths:
    M templates/lxc-oracle.in

  Log Message:
  -----------
  oracle: Fix /dev/shm

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: e8a1665479c979e74950cb2b07568636c8290561
      https://github.com/lxc/lxc/commit/e8a1665479c979e74950cb2b07568636c8290561
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-fedora.in

  Log Message:
  -----------
  lxc-fedora: when using systemd, set lxc.kmsg = 0 in the config

This is to prevent systemd-journald to enter a 100% cpu loop.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 479da11fa40ddeef8d8f132f47795df085a70be0
      https://github.com/lxc/lxc/commit/479da11fa40ddeef8d8f132f47795df085a70be0
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-fedora.in

  Log Message:
  -----------
  lxc-fedora: In fedora21, the fedora-repos package is needed.

fedora-release has been split into fedora-release and fedora-repos.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: fca113ed229df759a831b65f6ea6d130ccd93030
      https://github.com/lxc/lxc/commit/fca113ed229df759a831b65f6ea6d130ccd93030
  Author: Natanael Copa <ncopa at alpinelinux.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-alpine.in

  Log Message:
  -----------
  lxc-alpine: use yaml for detection of latest release

Alpine Linux provides yaml files with latest release instead of the old
approach with .latest.txt.

Signed-off-by: Natanael Copa <ncopa at alpinelinux.org>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 1a18db0a6cd4b8a9db6245b2d59367a3f8c337c0
      https://github.com/lxc/lxc/commit/1a18db0a6cd4b8a9db6245b2d59367a3f8c337c0
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M config/apparmor/abstractions/container-base
    M config/apparmor/abstractions/container-base.in

  Log Message:
  -----------
  apparmor: Block access to /proc/kcore

Just like we block access to mem and kmem, there's no good reason for
the container to have access to kcore.

Reported-by: Marc Schaefer
Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 32d9a5f177f3cdeefb91a19bf748c9aec6c34965
      https://github.com/lxc/lxc/commit/32d9a5f177f3cdeefb91a19bf748c9aec6c34965
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M src/lxc/conf.c

  Log Message:
  -----------
  Also drop caps in unpriv containers

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 6efee35cac5dd43d28d8dac1dd0232d3371cb1f1
      https://github.com/lxc/lxc/commit/6efee35cac5dd43d28d8dac1dd0232d3371cb1f1
  Author: Martin Pitt <martin.pitt at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M config/apparmor/abstractions/start-container

  Log Message:
  -----------
  apparmor: Fix slave bind mounts

The permission to make a mount "slave" is spelt "make-slave", not "slave", see
https://launchpad.net/bugs/1401619. Also, we need to make all mounts slave, not
just the root dir.

https://launchpad.net/bugs/1350947


  Commit: 1f746dccf7180f8c1466ac26bc96599a92518bed
      https://github.com/lxc/lxc/commit/1f746dccf7180f8c1466ac26bc96599a92518bed
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-debian.in

  Log Message:
  -----------
  lxc-debian: fix parsing of option "--clean": it takes no argument.

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: e5f558376e7ae6da449ca0c7da102aae917524e0
      https://github.com/lxc/lxc/commit/e5f558376e7ae6da449ca0c7da102aae917524e0
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-debian.in

  Log Message:
  -----------
  lxc-debian: document "--clean" in the usage.

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 17b9040910b1020ce0700c2494152822694ec483
      https://github.com/lxc/lxc/commit/17b9040910b1020ce0700c2494152822694ec483
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-debian.in

  Log Message:
  -----------
  lxc-debian: protect possibly unset variable with quotes for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 2987371f83b0f3ada434cf21a102530f273feb0e
      https://github.com/lxc/lxc/commit/2987371f83b0f3ada434cf21a102530f273feb0e
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-opensuse.in

  Log Message:
  -----------
  lxc-opensuse: fix parsing of option "--clean": it takes no argument

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: ffc36deb7758b21f39069d21a0fe68b9553a1189
      https://github.com/lxc/lxc/commit/ffc36deb7758b21f39069d21a0fe68b9553a1189
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-opensuse.in

  Log Message:
  -----------
  lxc-opensuse: protect possibly unset variable with quotes in -z check

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 21b11e837d94f0d23772e419b6194c9b29dece2d
      https://github.com/lxc/lxc/commit/21b11e837d94f0d23772e419b6194c9b29dece2d
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-altlinux.in

  Log Message:
  -----------
  lxc-altlinux: fix parsing of option "--clean": it takes no argument

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 1af6ee0fe224a3f4ccdb39299e76259f6693cd14
      https://github.com/lxc/lxc/commit/1af6ee0fe224a3f4ccdb39299e76259f6693cd14
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-altlinux.in

  Log Message:
  -----------
  lxc-altlinux: protect possibly unset variable with quotes for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: c9abed30ac5c0d9e44f1c39859137f236f5c7419
      https://github.com/lxc/lxc/commit/c9abed30ac5c0d9e44f1c39859137f236f5c7419
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-openmandriva.in

  Log Message:
  -----------
  lxc-openmandriva: fix parsing of option "--clean": it takes no argument

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: e182043368c7c6351edc2e393694e2106a88ddf0
      https://github.com/lxc/lxc/commit/e182043368c7c6351edc2e393694e2106a88ddf0
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-openmandriva.in

  Log Message:
  -----------
  lxc-openmandriva: protect possibly unset variable with quotes in -z check

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: b60ce6b26f8f14adfcddb4f716459a872681e0a7
      https://github.com/lxc/lxc/commit/b60ce6b26f8f14adfcddb4f716459a872681e0a7
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-centos.in

  Log Message:
  -----------
  lxc-centos: fix parsing of option "--clean": it takes no argument

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: f2e0cfa949bf46ebde1b02300a96a0e8a8b48c77
      https://github.com/lxc/lxc/commit/f2e0cfa949bf46ebde1b02300a96a0e8a8b48c77
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-centos.in

  Log Message:
  -----------
  lxc-centos: fix tab/space mixup in help text.

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 2575832f88d0e6d483fc86f13044cf602fb9bb10
      https://github.com/lxc/lxc/commit/2575832f88d0e6d483fc86f13044cf602fb9bb10
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-centos.in

  Log Message:
  -----------
  lxc-centos: protect possibly unset variable with quotes for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: 562f7f4701b2494df4c2a4e6bccd31a52a4b74a3
      https://github.com/lxc/lxc/commit/562f7f4701b2494df4c2a4e6bccd31a52a4b74a3
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-fedora.in

  Log Message:
  -----------
  lxc-fedora: fix parsing of option "--clean": it takes no argument

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: eb2dc4cfd79c0f99a37372682d8f37d6f4799bab
      https://github.com/lxc/lxc/commit/eb2dc4cfd79c0f99a37372682d8f37d6f4799bab
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-fedora.in

  Log Message:
  -----------
  lxc-fedora: protect possibly unset variable with quotes for -z check

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: cfa21b346d986ad318f579347a7b6d58f26f391b
      https://github.com/lxc/lxc/commit/cfa21b346d986ad318f579347a7b6d58f26f391b
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-fedora.in

  Log Message:
  -----------
  lxc-fedora: let help text fit into 80 columns

by breaking and shortening some lines.

Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: a79b3d60076967cc418763b7f0fd1dbfeeeeeace
      https://github.com/lxc/lxc/commit/a79b3d60076967cc418763b7f0fd1dbfeeeeeace
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M src/lxc/conf.c

  Log Message:
  -----------
  Fix reversed args in mount call

Riya Khanna reported that with a ramfs rootfs the mount to make
/ rprivate was returning -EFAULT.  NULL was being passed as the
mount target.  Pass "/" instead.

Reported-by: riya khanna <riyakhanna1983 at gmail.com>>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 15b208c100acdf405e37b6535c75f61e234c0920
      https://github.com/lxc/lxc/commit/15b208c100acdf405e37b6535c75f61e234c0920
  Author: Axel Neumann <neumann at cgws.de>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M src/lxc/conf.c

  Log Message:
  -----------
  Fix instantiation of multiple vlan interfaces with same id

Container fail to start with configs (as shown below) where the same
vlan id is used for several type=vlan container interfaces.
Then, during the instantiation of the vlan interfaces, an error occurs
because the lxc code tries to assign the same temporary name to both
of them before it is bound into the container.

> lxc.network.type      = vlan
> lxc.network.flags     = up
> lxc.network.link      = eth1
> lxc.network.vlan.id   = 3842
> lxc.network.name      = iso0
>
> lxc.network.type      = vlan
> lxc.network.flags     = up
> lxc.network.link      = eth2
> lxc.network.vlan.id   = 3842
> lxc.network.name      = iso1

Signed-off-by: Axel Neumann <neumann at cgws.de>


  Commit: dd955df0e908f90101cde5404dc6cc722a0d14d2
      https://github.com/lxc/lxc/commit/dd955df0e908f90101cde5404dc6cc722a0d14d2
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M doc/lxc.container.conf.sgml.in

  Log Message:
  -----------
  doc: clarify the description of the veth network type in the  manpage.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 61795f78c7d98299696e40ccbe52721585179b8b
      https://github.com/lxc/lxc/commit/61795f78c7d98299696e40ccbe52721585179b8b
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-download.in

  Log Message:
  -----------
  lxc-download: fix typo in help text.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 7f774d9e109559d3d513d81e20f866e92b01781c
      https://github.com/lxc/lxc/commit/7f774d9e109559d3d513d81e20f866e92b01781c
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-download.in

  Log Message:
  -----------
  lxc-download: make --list more useful.

Make it possible to use --list without having to specify
--dist, --release, and --arch, which does not make a lot
of sense.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 1d467358817ab1ad1007b717e8829578a470009a
      https://github.com/lxc/lxc/commit/1d467358817ab1ad1007b717e8829578a470009a
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-download.in

  Log Message:
  -----------
  lxc-download: improve help text.

--help and --list are special in the sense that they
are independent of the other options and exit early.
Document them separately.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 3745e7528a3b12d356a36c7632f1f6395677eda4
      https://github.com/lxc/lxc/commit/3745e7528a3b12d356a36c7632f1f6395677eda4
  Author: KATOH Yasufumi <karma at jazz.email.ne.jp>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M doc/ja/lxc.container.conf.sgml.in

  Log Message:
  -----------
  doc: Update the description of the veth in the Japanese lxc.container.conf(5)

Update for the commit 38005c5

Signed-off-by: KATOH Yasufumi <karma at jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 40b263899f7b7e13662ba4d131322c216fe9fe70
      https://github.com/lxc/lxc/commit/40b263899f7b7e13662ba4d131322c216fe9fe70
  Author: Alexander Vladimirov <alexander.idkfa.vladimirov at gmail.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-centos.in

  Log Message:
  -----------
  lxc-centos: pass releasever parameter to yum

Signed-off-by: Alexander Vladimirov <alexander.idkfa.vladimirov at gmail.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 548c34c37206a3903110059cffa97e3707f91927
      https://github.com/lxc/lxc/commit/548c34c37206a3903110059cffa97e3707f91927
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M MAINTAINERS

  Log Message:
  -----------
  Update MAINTAINERS

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 0e4e95fdf9d9a2d3f895912998b599473656814a
      https://github.com/lxc/lxc/commit/0e4e95fdf9d9a2d3f895912998b599473656814a
  Author: Michael Adam <obnox at samba.org>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-fedora.in

  Log Message:
  -----------
  add "--mask-tmp" to lxc-fedora, plus some template script fixes]

Hi Michael,

do you have any concerns with the attached patch to
the fedora template that adds an option --mask-tmp
that prevents fedora/systemd from over-mounting
/tmp with tmpfs, which is useful in some cases?

Thanks - Michael

----- Forwarded message from Michael Adam <obnox at samba.org> -----

Date: Sat, 10 Jan 2015 13:12:06 +0100
From: Michael Adam <obnox at samba.org>
To: LXC development mailing-list <lxc-devel at lists.linuxcontainers.org>
Subject: Re: [lxc-devel] [PATCHES] add "--mask-tmp" to lxc-fedora, plus some
	template script fixes
User-Agent: Mutt/1.5.23 (2014-03-12)

On 2015-01-10 at 13:08 +0100, Michael Adam wrote:
> On 2015-01-10 at 04:05 +0000, Serge Hallyn wrote:
>
> > The less controversial one is adding mask-tmp to the fedora template.
> > It looks fine to me, but that should go separately to mwarfield, our
> > fedora template maintainer :)
>
> I had notified mhw of my patches on irc, but apparently he is
> currently very busy.
>
> For a start, following is an update of the uncontroversial fix
> patches, i.e. the fix patche without the path ones, and without
> the mask-tmp patch.

And here comes the mask-tmp patch.
It needs to be applied onto the previous fix-patchset.

>From 9589dca113535ed2f4faad89db2fab33bb8a9d7e Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox at samba.org>
Date: Thu, 8 Jan 2015 10:25:24 +0100
Subject: [PATCH] lxc-fedora: add a new option --mask-tmp

This will configure the container to prevent the standard
behaviour of over-mounting /tmp with tmpfs, which can be
undesirable in some cases.

My personal use case is vagrant-lxc in combination with
vagrant-cachier.

Signed-off-by: Michael Adam <obnox at samba.org>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 2cb4c7a2d24b86bc0e468c3ffd5f32cb39624177
      https://github.com/lxc/lxc/commit/2cb4c7a2d24b86bc0e468c3ffd5f32cb39624177
  Author: Thomas Moschny <thomas.moschny at gmx.de>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M src/lua-lxc/core.c

  Log Message:
  -----------
  Small fix for Lua 5.3 compatibility.

Signed-off-by: Thomas Moschny <thomas.moschny at gmail.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 7a5448c37921759d2995a5475091d004fd5f06a1
      https://github.com/lxc/lxc/commit/7a5448c37921759d2995a5475091d004fd5f06a1
  Author: Vicente Olivert Riera <Vincent.Riera at imgtec.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-gentoo.in

  Log Message:
  -----------
  Gentoo template - Add a hwaddr if there is only one veth

Reuse the code from the Debian template to associate a hwaddr if there
is only one veth interface in the container's config file.

Signed-off-by: Vicente Olivert Riera <Vincent.Riera at imgtec.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 896003e2eb3fc5940b367fd3653f9359b1821651
      https://github.com/lxc/lxc/commit/896003e2eb3fc5940b367fd3653f9359b1821651
  Author: Patrick O'Leary <patrick.oleary at gmail.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M src/lxc/bdev.c
    M src/lxc/cgfs.c
    M src/lxc/conf.c
    M src/lxc/confile.c
    M src/lxc/lsm/apparmor.c
    M src/lxc/lxc_usernsexec.c
    M src/lxc/lxccontainer.c
    M src/tests/attach.c

  Log Message:
  -----------
  replace deprecated `index` with `strchr`

The `index` libc function was removed in POSIX 2008, and `strchr` is a direct
replacement. The bionic (Android) libc has removed `index` when you are
compiling for a 64-bit architecture, such as AArch64.

Signed-off-by: Patrick O'Leary <patrick.oleary at gmail.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: c21cf4cdbf277157fd54af9c762fd42af5434abd
      https://github.com/lxc/lxc/commit/c21cf4cdbf277157fd54af9c762fd42af5434abd
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M src/lua-lxc/lxc.lua

  Log Message:
  -----------
  lua: fix crash on missing blkio

Closes: #403

Signed-off-by: Dwight Engen
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 388db0d9ebf1b24c538a68813077b7ace31db68f
      https://github.com/lxc/lxc/commit/388db0d9ebf1b24c538a68813077b7ace31db68f
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M src/lxc/bdev.c

  Log Message:
  -----------
  Use 'overlay' as fs name when needed

Close #389

We will probably also want to switch the order of the mount attempts, as
the new overlay fs should quickly become the more common scenario.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: KATOH Yasufumi <karma at jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: 191b612f30668bc376c9df01d66ec1065997349c
      https://github.com/lxc/lxc/commit/191b612f30668bc376c9df01d66ec1065997349c
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-busybox.in

  Log Message:
  -----------
  fix busybox unpriv

1. tty5 is not needed
2. the devices should be optional in case they didn't exist in the
host / parent-container
3. switch from 'touch $rootfs/dev/$dev' to using create=file in the
mount entry.

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>


  Commit: c5cfcff14fff3ebe3bd3e8f3bbb318e4ed6ef1f6
      https://github.com/lxc/lxc/commit/c5cfcff14fff3ebe3bd3e8f3bbb318e4ed6ef1f6
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-centos.in
    M templates/lxc-fedora.in

  Log Message:
  -----------
  lxc-{centos|fedora}: Respect --rootfs

Close #406

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 355823a670499dfe6d3ae72dc6bcefdd4da74fc0
      https://github.com/lxc/lxc/commit/355823a670499dfe6d3ae72dc6bcefdd4da74fc0
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M src/lxc/confile.c

  Log Message:
  -----------
  Fix clearing IPv4/IPv6 addresses

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


  Commit: 2bb376c61a5f3ab2df22177001c7986af4e5f308
      https://github.com/lxc/lxc/commit/2bb376c61a5f3ab2df22177001c7986af4e5f308
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M src/lxc/bdev.c

  Log Message:
  -----------
  clone_paths: use 'rootfs' for destination directory

We were trying to be smart and use whatever the last part of
the container's rootfs path was.  However for block devices
that doesn't make much sense.  I.e. if lxc.rootfs = /dev/md-1,
chances are that /var/lib/lxc/c1/md-1 does not exist.

So always use the $lxcpath/$lxcname/rootfs, and if it does
not exist, try to create it.

With this, 'lxc-clone -s -o c1 -n c2' where c1 has an lvm backend
is fixed.  See https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1414771

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>


  Commit: c2f490ed52ca1bc039af87dff79ee400618f614a
      https://github.com/lxc/lxc/commit/c2f490ed52ca1bc039af87dff79ee400618f614a
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M templates/lxc-ubuntu-cloud.in
    M templates/lxc-ubuntu.in

  Log Message:
  -----------
  ubuntu: Drop lucid support and refresh releaess list

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>


Compare: https://github.com/lxc/lxc/compare/a4aed378f802...c2f490ed52ca

From noreply at github.com  Fri Jan 30 13:15:18 2015
From: noreply at github.com (GitHub)
Date: Fri, 30 Jan 2015 05:15:18 -0800
Subject: [lxc-devel] [lxc/lxc]
Message-ID: <54cb83e63648b_13aa3fecdc5bf2bc660a7@hookshot-fe3-cp1-prd.iad.github.net.mail>

  Branch: refs/tags/lxc-1.1.0
  Home:   https://github.com/lxc/lxc

From noreply at github.com  Fri Jan 30 13:15:15 2015
From: noreply at github.com (GitHub)
Date: Fri, 30 Jan 2015 05:15:15 -0800
Subject: [lxc-devel] [lxc/lxc] 62ed10: change version to 1.1.0 in
	configure.ac
Message-ID: <54cb83e370123_67b83feffd2592c0101317@hookshot-fe5-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 62ed104940747d135ffd71f513e51bf3d912d1d9
      https://github.com/lxc/lxc/commit/62ed104940747d135ffd71f513e51bf3d912d1d9
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M configure.ac

  Log Message:
  -----------
  change version to 1.1.0 in configure.ac

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>



From tycho.andersen at canonical.com  Fri Jan 30 13:18:53 2015
From: tycho.andersen at canonical.com (Tycho Andersen)
Date: Fri, 30 Jan 2015 14:18:53 +0100
Subject: [lxc-devel] [PATCH] set the monitor process title to something
	useful
Message-ID: <1422623933-6661-1-git-send-email-tycho.andersen@canonical.com>

Instead of having a parent process that's called whatever the caller of the
library is called, we instead set it to "[lxc monitor] <lxcpath> <container>"

Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>
---
 src/lxc/lxccontainer.c | 10 +++++++++
 src/lxc/utils.c        | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++
 src/lxc/utils.h        |  1 +
 3 files changed, 72 insertions(+)

diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 4da1627..1176a6f 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -598,6 +598,7 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
 	* while container is running...
 	*/
 	if (daemonize) {
+		char title[2048];
 		lxc_monitord_spawn(c->config_path);
 
 		pid_t pid = fork();
@@ -612,6 +613,15 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
 			return wait_on_daemonized_start(c, pid);
 		}
 
+		/* We don't really care if this doesn't print all the
+		 * characters; all that it means is that the proctitle will be
+		 * ugly. Similarly, we also don't care if setproctitle()
+		 * fails. */
+
+		snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
+		INFO("Attempting to set proc title to %s", title);
+		setproctitle(title);
+
 		/* second fork to be reparented by init */
 		pid = fork();
 		if (pid < 0) {
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index 93de1c3..f517ee6 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -39,6 +39,7 @@
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <assert.h>
+#include <sys/prctl.h>
 
 #include "utils.h"
 #include "log.h"
@@ -1540,3 +1541,63 @@ char *get_template_path(const char *t)
 
 	return tpath;
 }
+
+/*
+ * Sets the process title to the specified title. Note:
+ *   1. this function requires root to succeed
+ *   2. it clears /proc/self/environ
+ *   3. it may not succed (e.g. if title is longer than /proc/self/environ +
+ *      the original title)
+ */
+int setproctitle(char *title)
+{
+	char buf[2048], *tmp;
+	FILE *f;
+	int i, len, ret = 0;
+	unsigned long arg_start, arg_end, env_start, env_end;
+
+	f = fopen_cloexec("/proc/self/stat", "r");
+	if (!f) {
+		return -1;
+	}
+
+	tmp = fgets(buf, sizeof(buf), f);
+	fclose(f);
+	if (!tmp) {
+		return -1;
+	}
+
+	/* Skip the first 47 fields, column 48-51 are ARG_START and
+	 * ARG_END. */
+	tmp = strchr(buf, ' ');
+	for (i = 0; i < 46; i++)
+		tmp = strchr(tmp+1, ' ');
+
+	i = sscanf(tmp, "%lu %lu %lu %lu", &arg_start, &arg_end, &env_start, &env_end);
+	if (i != 4) {
+		return -1;
+	}
+
+	/* We're truncating the environment, so we should use at most the
+	 * length of the argument + environment for the title. */
+	len = strlen(title);
+	if (len > env_end - arg_start) {
+		arg_end = env_end;
+		len = env_end - arg_start;
+	} else {
+		arg_end = arg_start + len;
+	}
+
+	env_start = arg_end;
+	env_end = env_start;
+
+	/* memcpy instead of strcpy since this isn't null terminated */
+	memcpy((void*)arg_start, title, len);
+
+	ret |= prctl(PR_SET_MM, PR_SET_MM_ARG_START,   (long)arg_start, 0, 0);
+	ret |= prctl(PR_SET_MM, PR_SET_MM_ARG_END,     (long)arg_end, 0, 0);
+	ret |= prctl(PR_SET_MM, PR_SET_MM_ENV_START,   (long)env_start, 0, 0);
+	ret |= prctl(PR_SET_MM, PR_SET_MM_ENV_END,     (long)env_end, 0, 0);
+
+	return ret;
+}
diff --git a/src/lxc/utils.h b/src/lxc/utils.h
index b23cd8e..cc18906 100644
--- a/src/lxc/utils.h
+++ b/src/lxc/utils.h
@@ -286,3 +286,4 @@ int print_to_file(const char *file, const char *content);
 bool switch_to_ns(pid_t pid, const char *ns);
 int is_dir(const char *path);
 char *get_template_path(const char *t);
+int setproctitle(char *title);
-- 
2.1.0


From stgraber at ubuntu.com  Fri Jan 30 13:23:33 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 30 Jan 2015 14:23:33 +0100
Subject: [lxc-devel] LXC 1.1 has been released!
Message-ID: <20150130132333.GI18477@castiana.ipv6.teksavvy.com>

Hello everyone,

The LXC team is pleased to announce the release of LXC 1.1!

This new upstream release is the result of the work of over 80
individual contributors.

The highlights are:
 - Introduction of checkpoint/restore support for containers through CRIU.
   This allows to serialize the container running state to disk, for
   live migration or for later local restoration of the container.

 - Support for running systemd as the init system inside the container
   was also greatly improved and should now work by default both for
   privileged and unprivileged containers when combined with lxcfs and a
   recent systemd.

 - Init scripts have now all been updated to provide the same feature
   set, which means that a lxcbr0 bridge with a DHCP and DNS server
   (dnsmasq) is now the default for anyone using LXC. We currently provide
   init scripts for systemd, sysvinit and upstart. 

Those are just highlights, there are a lot more new features and user
experience improvements. For a full list, see:
https://linuxcontainers.org/lxc/news/

The release tarball can be downloaded at:
https://linuxcontainers.org/lxc/downloads/


This release will be supported until January 2016 or 2 months after the
next LXC release, whichever comes last.

We therefore still recommend that people using LXC in production
environments where long term support is important stick to LXC 1.0 which
is supported until April 2019 and receives frequent bugfix updates.


Stéphane Graber
On behalf of the LXC development team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150130/141b8d4e/attachment.sig>

From builds at travis-ci.org  Fri Jan 30 13:17:11 2015
From: builds at travis-ci.org (Travis CI)
Date: Fri, 30 Jan 2015 13:17:11 +0000
Subject: [lxc-devel] Passed: lxc/lxc#847 (lxc-1.1.0 - 62ed104)
In-Reply-To: <lxc/lxc+48892391+passed@travis-ci.org>
Message-ID: <54cb845717700_3282b576640547@eeb47dd9-000a-4782-a968-2005b9350ddc.mail>

Build Update for lxc/lxc
-------------------------------------

Build: #847
Status: Passed

Duration: 1 minute and 1 second
Commit: 62ed104 (lxc-1.1.0)
Author: Stéphane Graber
Message: change version to 1.1.0 in configure.ac

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

View the changeset: https://github.com/lxc/lxc/compare/lxc-1.1.0

View the full build log and details: https://travis-ci.org/lxc/lxc/builds/48892391

--

You can configure recipients for build notifications in your .travis.yml file. See http://docs.travis-ci.com/user/notifications



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150130/5bdac019/attachment.html>

From stgraber at ubuntu.com  Fri Jan 30 13:35:35 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 30 Jan 2015 14:35:35 +0100
Subject: [lxc-devel] [PATCH] set the monitor process title to something
 useful
In-Reply-To: <1422623933-6661-1-git-send-email-tycho.andersen@canonical.com>
References: <1422623933-6661-1-git-send-email-tycho.andersen@canonical.com>
Message-ID: <20150130133535.GA26470@castiana.ipv6.teksavvy.com>

On Fri, Jan 30, 2015 at 02:18:53PM +0100, Tycho Andersen wrote:
> Instead of having a parent process that's called whatever the caller of the
> library is called, we instead set it to "[lxc monitor] <lxcpath> <container>"
> 
> Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/lxccontainer.c | 10 +++++++++
>  src/lxc/utils.c        | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++
>  src/lxc/utils.h        |  1 +
>  3 files changed, 72 insertions(+)
> 
> diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
> index 4da1627..1176a6f 100644
> --- a/src/lxc/lxccontainer.c
> +++ b/src/lxc/lxccontainer.c
> @@ -598,6 +598,7 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
>  	* while container is running...
>  	*/
>  	if (daemonize) {
> +		char title[2048];
>  		lxc_monitord_spawn(c->config_path);
>  
>  		pid_t pid = fork();
> @@ -612,6 +613,15 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
>  			return wait_on_daemonized_start(c, pid);
>  		}
>  
> +		/* We don't really care if this doesn't print all the
> +		 * characters; all that it means is that the proctitle will be
> +		 * ugly. Similarly, we also don't care if setproctitle()
> +		 * fails. */
> +
> +		snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
> +		INFO("Attempting to set proc title to %s", title);
> +		setproctitle(title);
> +
>  		/* second fork to be reparented by init */
>  		pid = fork();
>  		if (pid < 0) {
> diff --git a/src/lxc/utils.c b/src/lxc/utils.c
> index 93de1c3..f517ee6 100644
> --- a/src/lxc/utils.c
> +++ b/src/lxc/utils.c
> @@ -39,6 +39,7 @@
>  #include <sys/types.h>
>  #include <sys/wait.h>
>  #include <assert.h>
> +#include <sys/prctl.h>
>  
>  #include "utils.h"
>  #include "log.h"
> @@ -1540,3 +1541,63 @@ char *get_template_path(const char *t)
>  
>  	return tpath;
>  }
> +
> +/*
> + * Sets the process title to the specified title. Note:
> + *   1. this function requires root to succeed
> + *   2. it clears /proc/self/environ
> + *   3. it may not succed (e.g. if title is longer than /proc/self/environ +
> + *      the original title)
> + */
> +int setproctitle(char *title)
> +{
> +	char buf[2048], *tmp;
> +	FILE *f;
> +	int i, len, ret = 0;
> +	unsigned long arg_start, arg_end, env_start, env_end;
> +
> +	f = fopen_cloexec("/proc/self/stat", "r");
> +	if (!f) {
> +		return -1;
> +	}
> +
> +	tmp = fgets(buf, sizeof(buf), f);
> +	fclose(f);
> +	if (!tmp) {
> +		return -1;
> +	}
> +
> +	/* Skip the first 47 fields, column 48-51 are ARG_START and
> +	 * ARG_END. */
> +	tmp = strchr(buf, ' ');
> +	for (i = 0; i < 46; i++)
> +		tmp = strchr(tmp+1, ' ');
> +
> +	i = sscanf(tmp, "%lu %lu %lu %lu", &arg_start, &arg_end, &env_start, &env_end);
> +	if (i != 4) {
> +		return -1;
> +	}
> +
> +	/* We're truncating the environment, so we should use at most the
> +	 * length of the argument + environment for the title. */
> +	len = strlen(title);
> +	if (len > env_end - arg_start) {
> +		arg_end = env_end;
> +		len = env_end - arg_start;
> +	} else {
> +		arg_end = arg_start + len;
> +	}
> +
> +	env_start = arg_end;
> +	env_end = env_start;
> +
> +	/* memcpy instead of strcpy since this isn't null terminated */
> +	memcpy((void*)arg_start, title, len);
> +
> +	ret |= prctl(PR_SET_MM, PR_SET_MM_ARG_START,   (long)arg_start, 0, 0);
> +	ret |= prctl(PR_SET_MM, PR_SET_MM_ARG_END,     (long)arg_end, 0, 0);
> +	ret |= prctl(PR_SET_MM, PR_SET_MM_ENV_START,   (long)env_start, 0, 0);
> +	ret |= prctl(PR_SET_MM, PR_SET_MM_ENV_END,     (long)env_end, 0, 0);
> +
> +	return ret;
> +}
> diff --git a/src/lxc/utils.h b/src/lxc/utils.h
> index b23cd8e..cc18906 100644
> --- a/src/lxc/utils.h
> +++ b/src/lxc/utils.h
> @@ -286,3 +286,4 @@ int print_to_file(const char *file, const char *content);
>  bool switch_to_ns(pid_t pid, const char *ns);
>  int is_dir(const char *path);
>  char *get_template_path(const char *t);
> +int setproctitle(char *title);
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150130/082596b6/attachment.sig>

From serge.hallyn at ubuntu.com  Fri Jan 30 13:38:59 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 30 Jan 2015 13:38:59 +0000
Subject: [lxc-devel] [PATCH] set the monitor process title to something
 useful
In-Reply-To: <1422623933-6661-1-git-send-email-tycho.andersen@canonical.com>
References: <1422623933-6661-1-git-send-email-tycho.andersen@canonical.com>
Message-ID: <20150130133859.GT16770@ubuntumail>

Quoting Tycho Andersen (tycho.andersen at canonical.com):
> Instead of having a parent process that's called whatever the caller of the
> library is called, we instead set it to "[lxc monitor] <lxcpath> <container>"
> 
> Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>
> ---
>  src/lxc/lxccontainer.c | 10 +++++++++
>  src/lxc/utils.c        | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++
>  src/lxc/utils.h        |  1 +
>  3 files changed, 72 insertions(+)
> 
> diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
> index 4da1627..1176a6f 100644
> --- a/src/lxc/lxccontainer.c
> +++ b/src/lxc/lxccontainer.c
> @@ -598,6 +598,7 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
>  	* while container is running...
>  	*/
>  	if (daemonize) {
> +		char title[2048];
>  		lxc_monitord_spawn(c->config_path);
>  
>  		pid_t pid = fork();
> @@ -612,6 +613,15 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
>  			return wait_on_daemonized_start(c, pid);
>  		}
>  
> +		/* We don't really care if this doesn't print all the
> +		 * characters; all that it means is that the proctitle will be
> +		 * ugly. Similarly, we also don't care if setproctitle()
> +		 * fails. */
> +
> +		snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
> +		INFO("Attempting to set proc title to %s", title);
> +		setproctitle(title);
> +
>  		/* second fork to be reparented by init */
>  		pid = fork();
>  		if (pid < 0) {
> diff --git a/src/lxc/utils.c b/src/lxc/utils.c
> index 93de1c3..f517ee6 100644
> --- a/src/lxc/utils.c
> +++ b/src/lxc/utils.c
> @@ -39,6 +39,7 @@
>  #include <sys/types.h>
>  #include <sys/wait.h>
>  #include <assert.h>
> +#include <sys/prctl.h>
>  
>  #include "utils.h"
>  #include "log.h"
> @@ -1540,3 +1541,63 @@ char *get_template_path(const char *t)
>  
>  	return tpath;
>  }
> +
> +/*
> + * Sets the process title to the specified title. Note:
> + *   1. this function requires root to succeed
> + *   2. it clears /proc/self/environ
> + *   3. it may not succed (e.g. if title is longer than /proc/self/environ +
> + *      the original title)
> + */
> +int setproctitle(char *title)
> +{
> +	char buf[2048], *tmp;
> +	FILE *f;
> +	int i, len, ret = 0;
> +	unsigned long arg_start, arg_end, env_start, env_end;
> +
> +	f = fopen_cloexec("/proc/self/stat", "r");
> +	if (!f) {
> +		return -1;
> +	}
> +
> +	tmp = fgets(buf, sizeof(buf), f);
> +	fclose(f);
> +	if (!tmp) {
> +		return -1;
> +	}
> +
> +	/* Skip the first 47 fields, column 48-51 are ARG_START and
> +	 * ARG_END. */
> +	tmp = strchr(buf, ' ');
> +	for (i = 0; i < 46; i++)
> +		tmp = strchr(tmp+1, ' ');

Could you add a check here at each step for tmp != NULL?  Or just

	for (i = 0; i < 46 && tmp; i++)
		tmp = strchr(tmp+1, ' ');
	if (!tmp)
		return -1;

> +
> +	i = sscanf(tmp, "%lu %lu %lu %lu", &arg_start, &arg_end, &env_start, &env_end);
> +	if (i != 4) {
> +		return -1;
> +	}
> +
> +	/* We're truncating the environment, so we should use at most the
> +	 * length of the argument + environment for the title. */
> +	len = strlen(title);
> +	if (len > env_end - arg_start) {
> +		arg_end = env_end;
> +		len = env_end - arg_start;
> +	} else {
> +		arg_end = arg_start + len;
> +	}
> +
> +	env_start = arg_end;
> +	env_end = env_start;
> +
> +	/* memcpy instead of strcpy since this isn't null terminated */
> +	memcpy((void*)arg_start, title, len);
> +
> +	ret |= prctl(PR_SET_MM, PR_SET_MM_ARG_START,   (long)arg_start, 0, 0);
> +	ret |= prctl(PR_SET_MM, PR_SET_MM_ARG_END,     (long)arg_end, 0, 0);
> +	ret |= prctl(PR_SET_MM, PR_SET_MM_ENV_START,   (long)env_start, 0, 0);
> +	ret |= prctl(PR_SET_MM, PR_SET_MM_ENV_END,     (long)env_end, 0, 0);
> +
> +	return ret;
> +}
> diff --git a/src/lxc/utils.h b/src/lxc/utils.h
> index b23cd8e..cc18906 100644
> --- a/src/lxc/utils.h
> +++ b/src/lxc/utils.h
> @@ -286,3 +286,4 @@ int print_to_file(const char *file, const char *content);
>  bool switch_to_ns(pid_t pid, const char *ns);
>  int is_dir(const char *path);
>  char *get_template_path(const char *t);
> +int setproctitle(char *title);
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From tycho.andersen at canonical.com  Fri Jan 30 13:59:13 2015
From: tycho.andersen at canonical.com (Tycho Andersen)
Date: Fri, 30 Jan 2015 14:59:13 +0100
Subject: [lxc-devel] [PATCH] set the monitor process title to something
 useful
In-Reply-To: <20150130133859.GT16770@ubuntumail>
References: <1422623933-6661-1-git-send-email-tycho.andersen@canonical.com>
 <20150130133859.GT16770@ubuntumail>
Message-ID: <20150130135913.GA2553@hopstrocity>

On Fri, Jan 30, 2015 at 01:38:59PM +0000, Serge Hallyn wrote:
> Quoting Tycho Andersen (tycho.andersen at canonical.com):
> > Instead of having a parent process that's called whatever the caller of the
> > library is called, we instead set it to "[lxc monitor] <lxcpath> <container>"
> > 
> > Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>
> > ---
> >  src/lxc/lxccontainer.c | 10 +++++++++
> >  src/lxc/utils.c        | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++
> >  src/lxc/utils.h        |  1 +
> >  3 files changed, 72 insertions(+)
> > 
> > diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
> > index 4da1627..1176a6f 100644
> > --- a/src/lxc/lxccontainer.c
> > +++ b/src/lxc/lxccontainer.c
> > @@ -598,6 +598,7 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
> >  	* while container is running...
> >  	*/
> >  	if (daemonize) {
> > +		char title[2048];
> >  		lxc_monitord_spawn(c->config_path);
> >  
> >  		pid_t pid = fork();
> > @@ -612,6 +613,15 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
> >  			return wait_on_daemonized_start(c, pid);
> >  		}
> >  
> > +		/* We don't really care if this doesn't print all the
> > +		 * characters; all that it means is that the proctitle will be
> > +		 * ugly. Similarly, we also don't care if setproctitle()
> > +		 * fails. */
> > +
> > +		snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
> > +		INFO("Attempting to set proc title to %s", title);
> > +		setproctitle(title);
> > +
> >  		/* second fork to be reparented by init */
> >  		pid = fork();
> >  		if (pid < 0) {
> > diff --git a/src/lxc/utils.c b/src/lxc/utils.c
> > index 93de1c3..f517ee6 100644
> > --- a/src/lxc/utils.c
> > +++ b/src/lxc/utils.c
> > @@ -39,6 +39,7 @@
> >  #include <sys/types.h>
> >  #include <sys/wait.h>
> >  #include <assert.h>
> > +#include <sys/prctl.h>
> >  
> >  #include "utils.h"
> >  #include "log.h"
> > @@ -1540,3 +1541,63 @@ char *get_template_path(const char *t)
> >  
> >  	return tpath;
> >  }
> > +
> > +/*
> > + * Sets the process title to the specified title. Note:
> > + *   1. this function requires root to succeed
> > + *   2. it clears /proc/self/environ
> > + *   3. it may not succed (e.g. if title is longer than /proc/self/environ +
> > + *      the original title)
> > + */
> > +int setproctitle(char *title)
> > +{
> > +	char buf[2048], *tmp;
> > +	FILE *f;
> > +	int i, len, ret = 0;
> > +	unsigned long arg_start, arg_end, env_start, env_end;
> > +
> > +	f = fopen_cloexec("/proc/self/stat", "r");
> > +	if (!f) {
> > +		return -1;
> > +	}
> > +
> > +	tmp = fgets(buf, sizeof(buf), f);
> > +	fclose(f);
> > +	if (!tmp) {
> > +		return -1;
> > +	}
> > +
> > +	/* Skip the first 47 fields, column 48-51 are ARG_START and
> > +	 * ARG_END. */
> > +	tmp = strchr(buf, ' ');
> > +	for (i = 0; i < 46; i++)
> > +		tmp = strchr(tmp+1, ' ');
> 
> Could you add a check here at each step for tmp != NULL?  Or just
> 
> 	for (i = 0; i < 46 && tmp; i++)
> 		tmp = strchr(tmp+1, ' ');
> 	if (!tmp)
> 		return -1;

Yep, here's a few other changes as well.

Tycho


>From 6af924ded6e4ca9f0826a50c73cfcc8715159b18 Mon Sep 17 00:00:00 2001
From: Tycho Andersen <tycho.andersen at canonical.com>
Date: Fri, 30 Jan 2015 14:14:51 +0100
Subject: [PATCH] set the monitor process title to something useful

Instead of having a parent process that's called whatever the caller of the
library is called, we instead set it to "[lxc monitor] <lxcpath> <container>"

Closes #180

v2: check for null in tok for loop, only truncate environment when necessary

Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>
---
 src/lxc/lxccontainer.c |  9 +++++++
 src/lxc/utils.c        | 67 ++++++++++++++++++++++++++++++++++++++++++++++++++
 src/lxc/utils.h        |  1 +
 3 files changed, 77 insertions(+)

diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 4da1627..e02ee93 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -598,6 +598,7 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
 	* while container is running...
 	*/
 	if (daemonize) {
+		char title[2048];
 		lxc_monitord_spawn(c->config_path);
 
 		pid_t pid = fork();
@@ -612,6 +613,14 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
 			return wait_on_daemonized_start(c, pid);
 		}
 
+		/* We don't really care if this doesn't print all the
+		 * characters; all that it means is that the proctitle will be
+		 * ugly. Similarly, we also don't care if setproctitle()
+		 * fails. */
+		snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
+		INFO("Attempting to set proc title to %s", title);
+		setproctitle(title);
+
 		/* second fork to be reparented by init */
 		pid = fork();
 		if (pid < 0) {
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index 93de1c3..9acf7e6 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -39,6 +39,7 @@
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <assert.h>
+#include <sys/prctl.h>
 
 #include "utils.h"
 #include "log.h"
@@ -1540,3 +1541,69 @@ char *get_template_path(const char *t)
 
 	return tpath;
 }
+
+/*
+ * Sets the process title to the specified title. Note:
+ *   1. this function requires root to succeed
+ *   2. it clears /proc/self/environ
+ *   3. it may not succed (e.g. if title is longer than /proc/self/environ +
+ *      the original title)
+ */
+int setproctitle(char *title)
+{
+	char buf[2048], *tmp;
+	FILE *f;
+	int i, len, ret = 0;
+	unsigned long arg_start, arg_end, env_start, env_end;
+
+	f = fopen_cloexec("/proc/self/stat", "r");
+	if (!f) {
+		return -1;
+	}
+
+	tmp = fgets(buf, sizeof(buf), f);
+	fclose(f);
+	if (!tmp) {
+		return -1;
+	}
+
+	/* Skip the first 47 fields, column 48-51 are ARG_START and
+	 * ARG_END. */
+	tmp = strchr(buf, ' ');
+	for (i = 0; i < 46; i++) {
+		if (!tmp)
+			return -1;
+		tmp = strchr(tmp+1, ' ');
+	}
+
+	i = sscanf(tmp, "%lu %lu %lu %lu", &arg_start, &arg_end, &env_start, &env_end);
+	if (i != 4) {
+		return -1;
+	}
+
+	/* We're truncating the environment, so we should use at most the
+	 * length of the argument + environment for the title. */
+	len = strlen(title);
+	if (len > env_end - arg_start) {
+		arg_end = env_end;
+		len = env_end - arg_start;
+	} else {
+		/* Only truncate the environment if we're actually going to
+		 * overwrite part of it. */
+		if (len >= arg_end - arg_start) {
+			env_start = env_end;
+		}
+		arg_end = arg_start + len;
+	}
+
+
+	/* memcpy instead of strcpy since this isn't null terminated */
+	memcpy((void*)arg_start, title, len);
+
+	ret |= prctl(PR_SET_MM, PR_SET_MM_ARG_START,   (long)arg_start, 0, 0);
+	ret |= prctl(PR_SET_MM, PR_SET_MM_ARG_END,     (long)arg_end, 0, 0);
+	ret |= prctl(PR_SET_MM, PR_SET_MM_ENV_START,   (long)env_start, 0, 0);
+	ret |= prctl(PR_SET_MM, PR_SET_MM_ENV_END,     (long)env_end, 0, 0);
+
+	return ret;
+}
diff --git a/src/lxc/utils.h b/src/lxc/utils.h
index b23cd8e..cc18906 100644
--- a/src/lxc/utils.h
+++ b/src/lxc/utils.h
@@ -286,3 +286,4 @@ int print_to_file(const char *file, const char *content);
 bool switch_to_ns(pid_t pid, const char *ns);
 int is_dir(const char *path);
 char *get_template_path(const char *t);
+int setproctitle(char *title);
-- 
2.1.0


From serge.hallyn at ubuntu.com  Fri Jan 30 14:10:29 2015
From: serge.hallyn at ubuntu.com (Serge Hallyn)
Date: Fri, 30 Jan 2015 14:10:29 +0000
Subject: [lxc-devel] [PATCH] set the monitor process title to something
 useful
In-Reply-To: <20150130135913.GA2553@hopstrocity>
References: <1422623933-6661-1-git-send-email-tycho.andersen@canonical.com>
 <20150130133859.GT16770@ubuntumail>
 <20150130135913.GA2553@hopstrocity>
Message-ID: <20150130141029.GU16770@ubuntumail>

Quoting Tycho Andersen (tycho.andersen at canonical.com):
> On Fri, Jan 30, 2015 at 01:38:59PM +0000, Serge Hallyn wrote:
> > Quoting Tycho Andersen (tycho.andersen at canonical.com):
> > > Instead of having a parent process that's called whatever the caller of the
> > > library is called, we instead set it to "[lxc monitor] <lxcpath> <container>"
> > > 
> > > Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>
> > > ---
> > >  src/lxc/lxccontainer.c | 10 +++++++++
> > >  src/lxc/utils.c        | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++
> > >  src/lxc/utils.h        |  1 +
> > >  3 files changed, 72 insertions(+)
> > > 
> > > diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
> > > index 4da1627..1176a6f 100644
> > > --- a/src/lxc/lxccontainer.c
> > > +++ b/src/lxc/lxccontainer.c
> > > @@ -598,6 +598,7 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
> > >  	* while container is running...
> > >  	*/
> > >  	if (daemonize) {
> > > +		char title[2048];
> > >  		lxc_monitord_spawn(c->config_path);
> > >  
> > >  		pid_t pid = fork();
> > > @@ -612,6 +613,15 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
> > >  			return wait_on_daemonized_start(c, pid);
> > >  		}
> > >  
> > > +		/* We don't really care if this doesn't print all the
> > > +		 * characters; all that it means is that the proctitle will be
> > > +		 * ugly. Similarly, we also don't care if setproctitle()
> > > +		 * fails. */
> > > +
> > > +		snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
> > > +		INFO("Attempting to set proc title to %s", title);
> > > +		setproctitle(title);
> > > +
> > >  		/* second fork to be reparented by init */
> > >  		pid = fork();
> > >  		if (pid < 0) {
> > > diff --git a/src/lxc/utils.c b/src/lxc/utils.c
> > > index 93de1c3..f517ee6 100644
> > > --- a/src/lxc/utils.c
> > > +++ b/src/lxc/utils.c
> > > @@ -39,6 +39,7 @@
> > >  #include <sys/types.h>
> > >  #include <sys/wait.h>
> > >  #include <assert.h>
> > > +#include <sys/prctl.h>
> > >  
> > >  #include "utils.h"
> > >  #include "log.h"
> > > @@ -1540,3 +1541,63 @@ char *get_template_path(const char *t)
> > >  
> > >  	return tpath;
> > >  }
> > > +
> > > +/*
> > > + * Sets the process title to the specified title. Note:
> > > + *   1. this function requires root to succeed
> > > + *   2. it clears /proc/self/environ
> > > + *   3. it may not succed (e.g. if title is longer than /proc/self/environ +
> > > + *      the original title)
> > > + */
> > > +int setproctitle(char *title)
> > > +{
> > > +	char buf[2048], *tmp;
> > > +	FILE *f;
> > > +	int i, len, ret = 0;
> > > +	unsigned long arg_start, arg_end, env_start, env_end;
> > > +
> > > +	f = fopen_cloexec("/proc/self/stat", "r");
> > > +	if (!f) {
> > > +		return -1;
> > > +	}
> > > +
> > > +	tmp = fgets(buf, sizeof(buf), f);
> > > +	fclose(f);
> > > +	if (!tmp) {
> > > +		return -1;
> > > +	}
> > > +
> > > +	/* Skip the first 47 fields, column 48-51 are ARG_START and
> > > +	 * ARG_END. */
> > > +	tmp = strchr(buf, ' ');
> > > +	for (i = 0; i < 46; i++)
> > > +		tmp = strchr(tmp+1, ' ');
> > 
> > Could you add a check here at each step for tmp != NULL?  Or just
> > 
> > 	for (i = 0; i < 46 && tmp; i++)
> > 		tmp = strchr(tmp+1, ' ');
> > 	if (!tmp)
> > 		return -1;
> 
> Yep, here's a few other changes as well.
> 
> Tycho
> 
> 
> From 6af924ded6e4ca9f0826a50c73cfcc8715159b18 Mon Sep 17 00:00:00 2001
> From: Tycho Andersen <tycho.andersen at canonical.com>
> Date: Fri, 30 Jan 2015 14:14:51 +0100
> Subject: [PATCH] set the monitor process title to something useful
> 
> Instead of having a parent process that's called whatever the caller of the
> library is called, we instead set it to "[lxc monitor] <lxcpath> <container>"
> 
> Closes #180
> 
> v2: check for null in tok for loop, only truncate environment when necessary
> 
> Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  src/lxc/lxccontainer.c |  9 +++++++
>  src/lxc/utils.c        | 67 ++++++++++++++++++++++++++++++++++++++++++++++++++
>  src/lxc/utils.h        |  1 +
>  3 files changed, 77 insertions(+)
> 
> diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
> index 4da1627..e02ee93 100644
> --- a/src/lxc/lxccontainer.c
> +++ b/src/lxc/lxccontainer.c
> @@ -598,6 +598,7 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
>  	* while container is running...
>  	*/
>  	if (daemonize) {
> +		char title[2048];
>  		lxc_monitord_spawn(c->config_path);
>  
>  		pid_t pid = fork();
> @@ -612,6 +613,14 @@ static bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv
>  			return wait_on_daemonized_start(c, pid);
>  		}
>  
> +		/* We don't really care if this doesn't print all the
> +		 * characters; all that it means is that the proctitle will be
> +		 * ugly. Similarly, we also don't care if setproctitle()
> +		 * fails. */
> +		snprintf(title, sizeof(title), "[lxc monitor] %s %s", c->config_path, c->name);
> +		INFO("Attempting to set proc title to %s", title);
> +		setproctitle(title);
> +
>  		/* second fork to be reparented by init */
>  		pid = fork();
>  		if (pid < 0) {
> diff --git a/src/lxc/utils.c b/src/lxc/utils.c
> index 93de1c3..9acf7e6 100644
> --- a/src/lxc/utils.c
> +++ b/src/lxc/utils.c
> @@ -39,6 +39,7 @@
>  #include <sys/types.h>
>  #include <sys/wait.h>
>  #include <assert.h>
> +#include <sys/prctl.h>
>  
>  #include "utils.h"
>  #include "log.h"
> @@ -1540,3 +1541,69 @@ char *get_template_path(const char *t)
>  
>  	return tpath;
>  }
> +
> +/*
> + * Sets the process title to the specified title. Note:
> + *   1. this function requires root to succeed
> + *   2. it clears /proc/self/environ
> + *   3. it may not succed (e.g. if title is longer than /proc/self/environ +
> + *      the original title)
> + */
> +int setproctitle(char *title)
> +{
> +	char buf[2048], *tmp;
> +	FILE *f;
> +	int i, len, ret = 0;
> +	unsigned long arg_start, arg_end, env_start, env_end;
> +
> +	f = fopen_cloexec("/proc/self/stat", "r");
> +	if (!f) {
> +		return -1;
> +	}
> +
> +	tmp = fgets(buf, sizeof(buf), f);
> +	fclose(f);
> +	if (!tmp) {
> +		return -1;
> +	}
> +
> +	/* Skip the first 47 fields, column 48-51 are ARG_START and
> +	 * ARG_END. */
> +	tmp = strchr(buf, ' ');
> +	for (i = 0; i < 46; i++) {
> +		if (!tmp)
> +			return -1;
> +		tmp = strchr(tmp+1, ' ');
> +	}
> +
> +	i = sscanf(tmp, "%lu %lu %lu %lu", &arg_start, &arg_end, &env_start, &env_end);
> +	if (i != 4) {
> +		return -1;
> +	}
> +
> +	/* We're truncating the environment, so we should use at most the
> +	 * length of the argument + environment for the title. */
> +	len = strlen(title);
> +	if (len > env_end - arg_start) {
> +		arg_end = env_end;
> +		len = env_end - arg_start;
> +	} else {
> +		/* Only truncate the environment if we're actually going to
> +		 * overwrite part of it. */
> +		if (len >= arg_end - arg_start) {
> +			env_start = env_end;
> +		}
> +		arg_end = arg_start + len;
> +	}
> +
> +
> +	/* memcpy instead of strcpy since this isn't null terminated */
> +	memcpy((void*)arg_start, title, len);
> +
> +	ret |= prctl(PR_SET_MM, PR_SET_MM_ARG_START,   (long)arg_start, 0, 0);
> +	ret |= prctl(PR_SET_MM, PR_SET_MM_ARG_END,     (long)arg_end, 0, 0);
> +	ret |= prctl(PR_SET_MM, PR_SET_MM_ENV_START,   (long)env_start, 0, 0);
> +	ret |= prctl(PR_SET_MM, PR_SET_MM_ENV_END,     (long)env_end, 0, 0);
> +
> +	return ret;
> +}
> diff --git a/src/lxc/utils.h b/src/lxc/utils.h
> index b23cd8e..cc18906 100644
> --- a/src/lxc/utils.h
> +++ b/src/lxc/utils.h
> @@ -286,3 +286,4 @@ int print_to_file(const char *file, const char *content);
>  bool switch_to_ns(pid_t pid, const char *ns);
>  int is_dir(const char *path);
>  char *get_template_path(const char *t);
> +int setproctitle(char *title);
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

From noreply at github.com  Fri Jan 30 14:14:25 2015
From: noreply at github.com (GitHub)
Date: Fri, 30 Jan 2015 06:14:25 -0800
Subject: [lxc-devel] [lxc/lxc] 0a4be2: set the monitor process title to
	something useful
Message-ID: <54cb91c15a8db_75e83ff15a1cf29c53234@hookshot-fe6-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 0a4be28d8cf24b529211ebc529136835645d76dd
      https://github.com/lxc/lxc/commit/0a4be28d8cf24b529211ebc529136835645d76dd
  Author: Tycho Andersen <tycho.andersen at canonical.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M src/lxc/lxccontainer.c
    M src/lxc/utils.c
    M src/lxc/utils.h

  Log Message:
  -----------
  set the monitor process title to something useful

Instead of having a parent process that's called whatever the caller of the
library is called, we instead set it to "[lxc monitor] <lxcpath> <container>"

Closes #180

v2: check for null in tok for loop, only truncate environment when necessary

Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>



From builds at travis-ci.org  Fri Jan 30 14:16:26 2015
From: builds at travis-ci.org (Travis CI)
Date: Fri, 30 Jan 2015 14:16:26 +0000
Subject: [lxc-devel] Broken: lxc/lxc#848 (master - 0a4be28)
In-Reply-To: <lxc/lxc+48898425+broken@travis-ci.org>
Message-ID: <54cb923a2af80_322f52439398@14ada992-6d07-4822-a823-4b9a55e49315.mail>

Build Update for lxc/lxc
-------------------------------------

Build: #848
Status: Broken

Duration: 1 minute and 19 seconds
Commit: 0a4be28 (master)
Author: Tycho Andersen
Message: set the monitor process title to something useful

Instead of having a parent process that's called whatever the caller of the
library is called, we instead set it to "[lxc monitor] <lxcpath> <container>"

Closes #180

v2: check for null in tok for loop, only truncate environment when necessary

Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

View the changeset: https://github.com/lxc/lxc/compare/62ed10494074...0a4be28d8cf2

View the full build log and details: https://travis-ci.org/lxc/lxc/builds/48898425

--

You can configure recipients for build notifications in your .travis.yml file. See http://docs.travis-ci.com/user/notifications


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150130/e522035e/attachment.html>

From tycho.andersen at canonical.com  Fri Jan 30 14:53:53 2015
From: tycho.andersen at canonical.com (Tycho Andersen)
Date: Fri, 30 Jan 2015 15:53:53 +0100
Subject: [lxc-devel] [PATCH] define some macros to fix the build
Message-ID: <1422629633-27711-1-git-send-email-tycho.andersen@canonical.com>

Not all kernels have these macros; they'll just give an EINVAL if/when invoked.

Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>
---
 src/lxc/utils.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index 9acf7e6..f9533db 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -46,6 +46,22 @@
 #include "lxclock.h"
 #include "namespace.h"
 
+#ifndef PR_SET_MM_ARG_START
+#define PR_SET_MM_ARG_START 8
+#endif
+
+#ifndef PR_SET_MM_ARG_END
+#define PR_SET_MM_ARG_END 9
+#endif
+
+#ifndef PR_SET_MM_ENV_START
+#define PR_SET_MM_ENV_START 10
+#endif
+
+#ifndef PR_SET_MM_ENV_END
+#define PR_SET_MM_ENV_END 11
+#endif
+
 lxc_log_define(lxc_utils, lxc);
 
 static int _recursive_rmdir_onedev(char *dirname, dev_t pdev,
-- 
2.1.0


From stgraber at ubuntu.com  Fri Jan 30 15:02:47 2015
From: stgraber at ubuntu.com (=?iso-8859-1?Q?St=E9phane?= Graber)
Date: Fri, 30 Jan 2015 16:02:47 +0100
Subject: [lxc-devel] [PATCH] define some macros to fix the build
In-Reply-To: <1422629633-27711-1-git-send-email-tycho.andersen@canonical.com>
References: <1422629633-27711-1-git-send-email-tycho.andersen@canonical.com>
Message-ID: <20150130150247.GB26470@castiana.ipv6.teksavvy.com>

On Fri, Jan 30, 2015 at 03:53:53PM +0100, Tycho Andersen wrote:
> Not all kernels have these macros; they'll just give an EINVAL if/when invoked.
> 
> Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>

Acked-by: Stéphane Graber <stgraber at ubuntu.com>

> ---
>  src/lxc/utils.c | 16 ++++++++++++++++
>  1 file changed, 16 insertions(+)
> 
> diff --git a/src/lxc/utils.c b/src/lxc/utils.c
> index 9acf7e6..f9533db 100644
> --- a/src/lxc/utils.c
> +++ b/src/lxc/utils.c
> @@ -46,6 +46,22 @@
>  #include "lxclock.h"
>  #include "namespace.h"
>  
> +#ifndef PR_SET_MM_ARG_START
> +#define PR_SET_MM_ARG_START 8
> +#endif
> +
> +#ifndef PR_SET_MM_ARG_END
> +#define PR_SET_MM_ARG_END 9
> +#endif
> +
> +#ifndef PR_SET_MM_ENV_START
> +#define PR_SET_MM_ENV_START 10
> +#endif
> +
> +#ifndef PR_SET_MM_ENV_END
> +#define PR_SET_MM_ENV_END 11
> +#endif
> +
>  lxc_log_define(lxc_utils, lxc);
>  
>  static int _recursive_rmdir_onedev(char *dirname, dev_t pdev,
> -- 
> 2.1.0
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150130/50d58f7f/attachment-0001.sig>

From noreply at github.com  Fri Jan 30 15:05:19 2015
From: noreply at github.com (GitHub)
Date: Fri, 30 Jan 2015 07:05:19 -0800
Subject: [lxc-devel] [lxc/lxc] 553347: define some macros to fix the build
Message-ID: <54cb9daf7e751_24993f89133d52bc389c1@hookshot-fe1-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 553347e403494185b959e424bc6a8af382eafe29
      https://github.com/lxc/lxc/commit/553347e403494185b959e424bc6a8af382eafe29
  Author: Tycho Andersen <tycho.andersen at canonical.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M src/lxc/utils.c

  Log Message:
  -----------
  define some macros to fix the build

Not all kernels have these macros; they'll just give an EINVAL if/when invoked.

Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>



From builds at travis-ci.org  Fri Jan 30 15:11:31 2015
From: builds at travis-ci.org (Travis CI)
Date: Fri, 30 Jan 2015 15:11:31 +0000
Subject: [lxc-devel] Fixed: lxc/lxc#849 (master - 553347e)
In-Reply-To: <lxc/lxc+48904213+fixed@travis-ci.org>
Message-ID: <54cb9f22cd910_34163867139d@14ada992-6d07-4822-a823-4b9a55e49315.mail>

Build Update for lxc/lxc
-------------------------------------

Build: #849
Status: Fixed

Duration: 3 minutes and 38 seconds
Commit: 553347e (master)
Author: Tycho Andersen
Message: define some macros to fix the build

Not all kernels have these macros; they'll just give an EINVAL if/when invoked.

Signed-off-by: Tycho Andersen <tycho.andersen at canonical.com>
Acked-by: Stéphane Graber <stgraber at ubuntu.com>

View the changeset: https://github.com/lxc/lxc/compare/0a4be28d8cf2...553347e40349

View the full build log and details: https://travis-ci.org/lxc/lxc/builds/48904213

--

You can configure recipients for build notifications in your .travis.yml file. See http://docs.travis-ci.com/user/notifications



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150130/2b7b01c0/attachment.html>

From noreply at github.com  Fri Jan 30 17:24:22 2015
From: noreply at github.com (GitHub)
Date: Fri, 30 Jan 2015 09:24:22 -0800
Subject: [lxc-devel] [lxc/lxc] 5d6ef2: Also define PR_SET_MM (fixes Android)
Message-ID: <54cbbe46646a9_76443f87862312a0162d8@hookshot-fe6-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 5d6ef2286fa9eb95c5c11a40c4dcab2e7f76c4b5
      https://github.com/lxc/lxc/commit/5d6ef2286fa9eb95c5c11a40c4dcab2e7f76c4b5
  Author: Stéphane Graber <stgraber at ubuntu.com>
  Date:   2015-01-30 (Fri, 30 Jan 2015)

  Changed paths:
    M src/lxc/utils.c

  Log Message:
  -----------
  Also define PR_SET_MM (fixes Android)

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>



From noreply at github.com  Sat Jan 31 13:10:29 2015
From: noreply at github.com (GitHub)
Date: Sat, 31 Jan 2015 05:10:29 -0800
Subject: [lxc-devel] [lxc/lxc] 73c1c8: getproctitle - check for null after
	last strchr
Message-ID: <54ccd445d3395_dfd3faf779552c09598c@hookshot-fe2-cp1-prd.iad.github.net.mail>

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 73c1c8871478537eed29fcd816ce5b792e4ed6ce
      https://github.com/lxc/lxc/commit/73c1c8871478537eed29fcd816ce5b792e4ed6ce
  Author: Serge Hallyn <serge.hallyn at ubuntu.com>
  Date:   2015-01-31 (Sat, 31 Jan 2015)

  Changed paths:
    M src/lxc/utils.c

  Log Message:
  -----------
  getproctitle - check for null after last strchr

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>



From stgraber at ubuntu.com  Sat Jan 31 13:40:38 2015
From: stgraber at ubuntu.com (=?UTF-8?q?St=C3=A9phane=20Graber?=)
Date: Sat, 31 Jan 2015 08:40:38 -0500
Subject: [lxc-devel] [PATCH] In lxc.mount.auto, skip on ENONENT
Message-ID: <1422711638-18973-1-git-send-email-stgraber@ubuntu.com>

This resolves the case where /proc/sysrq-trigger doesn't exist by simply
ignoring any mount failure on ENOENT. With the current mount list, this
will always result in a safe environment (typically the read-only
underlay).

Closes #425

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 src/lxc/conf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index fbe82b5..5a99324 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -798,7 +798,11 @@ static int lxc_mount_auto_mounts(struct lxc_conf *conf, int flags, struct lxc_ha
 					default_mounts[i].flags);
 			r = mount(source, destination, default_mounts[i].fstype, mflags, default_mounts[i].options);
 			saved_errno = errno;
-			if (r < 0)
+			if (r < 0 && errno == ENOENT) {
+				INFO("Mount source or target for %s on %s doesn't exist. Skipping.", source, destination);
+				r = 0;
+			}
+			else
 				SYSERROR("error mounting %s on %s flags %lu", source, destination, mflags);
 
 			free(source);
-- 
1.9.1