<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi,<br>
<br>
<div class="moz-cite-prefix">On 10/16/2015 02:48 PM, Akshay Karle
wrote:<br>
</div>
<blockquote
cite="mid:CAEEG8gdxKNy8Gb7uvR1O-LMBBVmscwg8i596fStBs3iomO005g@mail.gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div dir="ltr"><span style="font-size:small;line-height:20px">Ok,
great! So how can I get started? I've been playing around with
unprivileged lxc and docker for the last 2 months so I have
experience using them but little experience developing them.
But, I would like to start doing some development work and
happy to help.</span></div>
</blockquote>
<br>
That's great, any help is appreciated!<br>
<br>
<blockquote
cite="mid:CAEEG8gdxKNy8Gb7uvR1O-LMBBVmscwg8i596fStBs3iomO005g@mail.gmail.com"
type="cite">
<div dir="ltr">
<div style="font-size:small;line-height:20px"><br>
</div>
<div style="font-size:small;line-height:20px">To begin with, I
will try to build up docker with that PR and see what problems
I see. Previously, I tried getting the docker inside lxc
working, faced a bunch of issues and ended up <a
moz-do-not-send="true"
href="https://github.com/akshaykarle/docker/tree/nesting-docker-lxc"
style="z-index: 0;">creating a fork of docker</a> to work
with. It was basically some devices not being available and
mknod not working in the unprivileged context. Hopefully,
using the graphdriver proxy we should get those out of the
way. Let me know what you all think.</div>
</div>
</blockquote>
<br>
I'm currently working on porting graphdriver proxy-daemon from
<a class="moz-txt-link-freetext" href="https://github.com/docker/docker/pull/15594">https://github.com/docker/docker/pull/15594</a> to recently merged
"graphdriver extpoint" feature
(<a class="moz-txt-link-freetext" href="https://github.com/docker/docker/pull/13777">https://github.com/docker/docker/pull/13777</a>). If you are interested
to play with some preliminary version, I'll try to publish it in a
week or two. This will allow you to verify if any issues other than
"some devices not being available and mknod not working" exists and
work on fixing them.<br>
<br>
On the other hand, if you are interested in development of
graphdriver proxy-daemon itself, there are at least two things
worthy to mention. Both are related to the way how a mount-point to
be passed from host system namespace to container where docker
daemon runs. First thing is about checking if the pid we're going to
use for setns() is really corresponds to mount namespace of the
entity who is communicating with proxy-daemon via unix socket. Serge
suggested to use SO_PEERCRED:<br>
<br>
<blockquote type="cite">When a request comes in over the unix
socket, the proxy gets the
<br>
requestor's (host) pid from SO_PEERCRED. The client passes the
<br>
container-name. The proxy asks the container driver for the init
<br>
pid of the container-name, and verifies that the pid on
SO_PEERCRED
<br>
is inside the pid-ns of the container.</blockquote>
<br>
but I have not investigated it yet. Another thing is about docker
implementation. I've managed to reuse existing docker code for
setns:
<a class="moz-txt-link-freetext" href="https://github.com/mpatlasov/docker/commit/b9931c4ab34d4be099c9b77af71d0394ac08143c">https://github.com/mpatlasov/docker/commit/b9931c4ab34d4be099c9b77af71d0394ac08143c</a>,
but I have not verified yet whether similar approach works for
stand-alone proxy-daemon.<br>
<br>
Thanks,<br>
Maxim<br>
<br>
<blockquote
cite="mid:CAEEG8gdxKNy8Gb7uvR1O-LMBBVmscwg8i596fStBs3iomO005g@mail.gmail.com"
type="cite"><br>
<div class="gmail_quote">
<div dir="ltr">On Fri, Oct 16, 2015 at 2:08 PM Serge Hallyn <<a
moz-do-not-send="true" href="mailto:serge.hallyn@ubuntu.com"><a class="moz-txt-link-abbreviated" href="mailto:serge.hallyn@ubuntu.com">serge.hallyn@ubuntu.com</a></a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">Absolutely!
I've not actually started working on that. (I hadn't noticed<br>
that the docker PR was merged) Maxim (cc:d) is the one who is
working on<br>
this at Odin - I think it'd be best if we can all work
together.<br>
<br>
-serge<br>
<br>
Quoting Akshay Karle (<a moz-do-not-send="true"
href="mailto:akshay.a.karle@gmail.com" target="_blank">akshay.a.karle@gmail.com</a>):<br>
> Hey Serge,<br>
><br>
> This is something I'm interested in as well. Anyway I
could help with the<br>
> implementation of the graphdriver proxy?<br>
><br>
> ... <skipped> ...<br>
</blockquote>
</div>
</blockquote>
<br>
</body>
</html>