<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
That was very close<br>
<i>I am putting it here so that search might find it</i><br>
<br>
Thanks for the help it was just what I needed.<br>
<br>
Here is what I got to work<br>
<br>
/usr/local/bin/startunprivlxc:<br>
#!/bin/sh<br>
cgm movepid all $1 $$<br>
sudo -iH -u $2 -- lxc-start -n $3 -d<br>
<br>
/etc/init/lxc-user.conf:<br>
description "start unpriv containers"<br>
<br>
start on started lxc<br>
<br>
script<br>
USERS="user1 user2 user3"<br>
<br>
for u in $USERS; do<br>
cgm create all lxc$u<br>
cgm chown all lxc$u $(id -u $u) $(id -g $u)<br>
lxc-autostart -L -P /home/$u/.local/share/lxc | while read
line;<br>
do<br>
set -- $line<br>
/usr/local/bin/startunprivlxc lxc$u $u $1<br>
sleep $2<br>
done<br>
done<br>
end script<br>
<br>
<br>
<br>
:<br>
<div class="moz-cite-prefix">On 08/22/2014 01:24 AM, Serge Hallyn
wrote:<br>
</div>
<blockquote cite="mid:20140822052458.GP19663@ubuntumail" type="cite">
<pre wrap="">Quoting Mike Bernson (<a class="moz-txt-link-abbreviated" href="mailto:mike@mlb.org">mike@mlb.org</a>):
</pre>
<blockquote type="cite">
<pre wrap="">I have user on the server that wants to create container that have services
running in them. The users need to have the services runing at boot.
I want to keep user out of each other containers.
If a container is broken out of I would like to limit the damage to the user running the container
The users do not have access /var/lib/lxc. I want to keep
the users in there own area. I was hoping that the user
could create the contains under there home dir and use
the lxc-autostart of unprivileged containers to start them.
This all works when the user is logged in. I was just looking to
start the containers at boot.
If there is not a easy way to handle this can you give me info
on what needs to happen with cgroups ?
I can then write a small set uid c program to setup the cgroups and then run lxc-autostart.
I would also be willing to contribute the back to the lxc project if they find it usefull.
</pre>
</blockquote>
<pre wrap="">
Ok, so (this is all untested, so you may have to tweak0 create a script
/usr/bin/startunprivlxc which does
#!/bin/sh
cgm movepid all $1
sudo -u $2 -- lxc-start -P $2 -n $3 -d
then create yourself a new upstart job which does
description "start unpriv containers"
start on started lxc
script
USERS="user1 user2 user3"
for u in $USERS; do
cgm create all lxc$u
cgm chown all lxc$u $(id -u $u) $(id -g $u)
lxc-autostart -L -P /home/$u/.local/share/lxc | while read line; do
set -- $line
/usr/bin/startunprivlxc lxc$u $u $1
sleep $2
done
done
end script
_______________________________________________
lxc-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a>
<a class="moz-txt-link-freetext" href="http://lists.linuxcontainers.org/listinfo/lxc-users">http://lists.linuxcontainers.org/listinfo/lxc-users</a></pre>
</blockquote>
<br>
</body>
</html>