<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 10pt; color: #000000"><div>unfortunately, it's the only way to allow custom network configuration from an unprivileged exactly how lxc add the network interface into the Ovs switch .</div><div><br data-mce-bogus="1"></div><div>My design is this one , I use openvswitch for the newtorking</div><div><br data-mce-bogus="1"></div><div>log on the system as user : non-root<br>start your container: lxc-start -n unpriv-ubuntu </div><div><br data-mce-bogus="1"></div><div>- VethXXX is added to the bridge "br-container" </div><div><br></div><div>The configuration of the virtual switch is blocking everything BUT what you allow with Openflows rules. </div><div>So, to get a working network connection from the new container , I have to add some flows to openvswitch. <br></div><div><br data-mce-bogus="1"></div><div>The big thing is here, every time you shutdown the container, two things changes all the time :</div><div><br data-mce-bogus="1"></div><div> - veth name (vethxxxxx) <br> - port number in openvswitch </div><div><br>And, openflows rules are based on ... in_port </div><div><br data-mce-bogus="1"></div><div>This bring a lot of challenges that others people than me will get soon : </div><div><br data-mce-bogus="1"></div><div>- allow root setuid script that can be used by any lxc users to bring up the OpenFlow rules (every time I start a container)<br>- script the cleanup of vethXXX in openvswitch because LXC add it but is not able to remove it (every time I stop a container)</div><div>- script the cleanup of flow rules in openvswitch because the in_port previously used by the vethXXXX has been delete and will not be the same at a new boot. (every time I stop the container)</div><div><br></div><div>This can be handle by hand if you start / stop container using the command line lxc tools : lxc-stop, lxc-start <br>But there is no way a container will have its network back with an init 6 command witch generate a new vethXXXX , a new port AND it leave the other interface UP on the HOST ...</div><div><br data-mce-bogus="1"></div><div>So, I'm not saying there is a simple solution here.. but I think we should make those things much more easier for people who wants to have more complex configuration .<br><br>Unprivileged containers are amazing, technology is great , but to me, the work I did for the past two weeks is insane to have a fully working (and secure) LXC environment to brings up containers</div><div>Maybe I'm totally wrong, or I'm missing something :) </div><div><br data-mce-bogus="1"></div><div>I don't know how software like Openstack or Proxmox are integrating LXC Unprivileged container but they should talk/share more about it ^^ </div><div><br data-mce-bogus="1"></div><div>Regards, </div><div><br></div><div data-marker="__SIG_PRE__"><div><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif;">Cordialement,</span><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;"><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;"><br></span></span></div><div><br></div><div><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;">Benoît Georgelin </span></div></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>De: </b>"Serge Hallyn" <serge.hallyn@ubuntu.com><br><b>À: </b>"lxc-users" <lxc-users@lists.linuxcontainers.org><br><b>Envoyé: </b>Lundi 31 Août 2015 09:39:01<br><b>Objet: </b>Re: [lxc-users] Unprivileged container and lxc.network.script.up<br></div><div><br></div><div data-marker="__QUOTED_TEXT__">Quoting Benoit GEORGELIN - Association Web4all (benoit.georgelin@web4all.fr):<br>> Hi, <br>> <br>> I would like to know if there is an alternative option of lxc.network.script.up with an unprivileged containter. <br><br>No. You'll need to start the container as root to do that - else you're<br>allowing an unprivileged user to specify a script to run as root in the<br>initial network namespace.<br><br>-serge<br>_______________________________________________<br>lxc-users mailing list<br>lxc-users@lists.linuxcontainers.org<br>http://lists.linuxcontainers.org/listinfo/lxc-users<br></div></div></body></html>