<div dir="ltr"><span style="font-size:small;line-height:20px">Ok, great! So how can I get started? I've been playing around with unprivileged lxc and docker for the last 2 months so I have experience using them but little experience developing them. But, I would like to start doing some development work and happy to help.</span><div style="font-size:small;line-height:20px"><br></div><div style="font-size:small;line-height:20px">To begin with, I will try to build up docker with that PR and see what problems I see. Previously, I tried getting the docker inside lxc working, faced a bunch of issues and ended up <a href="https://github.com/akshaykarle/docker/tree/nesting-docker-lxc" style="z-index: 0;">creating a fork of docker</a> to work with. It was basically some devices not being available and mknod not working in the unprivileged context. Hopefully, using the graphdriver proxy we should get those out of the way. Let me know what you all think.</div></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Oct 16, 2015 at 2:08 PM Serge Hallyn <<a href="mailto:serge.hallyn@ubuntu.com">serge.hallyn@ubuntu.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Absolutely! I've not actually started working on that. (I hadn't noticed<br>
that the docker PR was merged) Maxim (cc:d) is the one who is working on<br>
this at Odin - I think it'd be best if we can all work together.<br>
<br>
-serge<br>
<br>
Quoting Akshay Karle (<a href="mailto:akshay.a.karle@gmail.com" target="_blank">akshay.a.karle@gmail.com</a>):<br>
> Hey Serge,<br>
><br>
> This is something I'm interested in as well. Anyway I could help with the<br>
> implementation of the graphdriver proxy?<br>
><br>
> On Fri, Oct 16, 2015 at 12:10 PM Serge Hallyn <<a href="mailto:serge.hallyn@ubuntu.com" target="_blank">serge.hallyn@ubuntu.com</a>><br>
> wrote:<br>
><br>
> > Quoting Tamas Papp (<a href="mailto:tompos@martos.bme.hu" target="_blank">tompos@martos.bme.hu</a>):<br>
> > ><br>
> > ><br>
> > > On 08/31/2015 03:59 PM, Serge Hallyn wrote:<br>
> > > >Quoting Tamas Papp (<a href="mailto:tompos@martos.bme.hu" target="_blank">tompos@martos.bme.hu</a>):<br>
> > > >><br>
> > > >>On 08/28/2015 03:48 PM, Serge Hallyn wrote:<br>
> > > >>>Quoting Tamas Papp (<a href="mailto:tompos@martos.bme.hu" target="_blank">tompos@martos.bme.hu</a>):<br>
> > > >>>>hi,<br>
> > > >>>><br>
> > > >>>>I would like to achieve, what is in subject.<br>
> > > >>>><br>
> > > >>>><br>
> > > >>>>However, I cannot get over on this apparmor issue:<br>
> > > >>>><br>
> > > >>>>[7690496.246952] type=1400 audit(1440757904.938:1130):<br>
> > > >>>>apparmor="DENIED" operation="mount" info="failed flags match"<br>
> > > >>>>error=-13 profile="lxc-docker" name="/var/lib/docker/aufs/"<br>
> > > >>>>pid=32534 comm="docker" flags="rw, private"<br>
> > > >>>><br>
> > > >>>><br>
> > > >>>>I read some post on various forums, that I need to run the lxc<br>
> > > >>>>container with unconfined profile.<br>
> > > >>>>Is still the case?<br>
> > > >>>Excellent, I've been wanting to bring this up here :)<br>
> > > >>><br>
> > > >>>Maxim at Odin has been working on a proxy graphdriver for<br>
> > > >>>docker. The PR is at<br>
> > > >>><br>
> > > >>><a href="https://github.com/docker/docker/pull/15594" rel="noreferrer" target="_blank">https://github.com/docker/docker/pull/15594</a><br>
> > > >>><br>
> > > >>>I'm hoping to test that today and see what else is still<br>
> > > >>>needed. I would assume a custom apparmor policy will still<br>
> > > >>>be needed, but since the host is doing most of the mounting<br>
> > > >>>you should be able to avoid just being unconfined.<br>
> > > >>hi,<br>
> > > >><br>
> > > >>For the first look it seems to be a big change, that requires a more<br>
> > > >>qualified one for testing.<br>
> > > >>Did you take a look?<br>
> > > >I've taken a look at the code but haven't built it yet. (having<br>
> > > >some toolchain issues)<br>
> > ><br>
> > > <a href="https://github.com/docker/docker/pull/13777" rel="noreferrer" target="_blank">https://github.com/docker/docker/pull/13777</a><br>
> > ><br>
> > > This was merged, does it mean, that docker should be usable in LXC<br>
> > > from this point?<br>
> ><br>
> > Not exactly. As you can see from the final comment in<br>
> ><br>
> > <a href="https://github.com/docker/docker/pull/15924" rel="noreferrer" target="_blank">https://github.com/docker/docker/pull/15924</a><br>
> ><br>
> > it now means that we can write a graphdriver proxy. The original<br>
> > openvz pull request would have been almost all we needed - allowing<br>
> > the graphdriver to talk over a unix socket to the host where the<br>
> > requested actions could be done. The pull request which was accepted<br>
> > does less - only allowing you to implement your own proxy to talk to<br>
> > a service on the host. (that service *also* needs to be written)<br>
> > _______________________________________________<br>
> > lxc-users mailing list<br>
> > <a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank">lxc-users@lists.linuxcontainers.org</a><br>
> > <a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br>
<br>
> _______________________________________________<br>
> lxc-users mailing list<br>
> <a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank">lxc-users@lists.linuxcontainers.org</a><br>
> <a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br>
<br>
_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a></blockquote></div>