<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Hi,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
But I do not want kernel virtualization, not sure where you saw me ask for that, I want the exact opposite, I want the kernel to be share, meaning same kernel, same instance, with just layers on top, exactly as system containers do.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
It is unconventional to run a system container without any security and such, yet, as seen in the thread I am not alone, but very few.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
--</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Yannick Koehler</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> lxc-users <lxc-users-bounces@lists.linuxcontainers.org> on behalf of Andrey Repin <anrdaemon@yandex.ru><br>
<b>Sent:</b> June 15, 2020 7:11 PM<br>
<b>To:</b> Yannick Koehler <lxc-users@lists.linuxcontainers.org>; All <lxc-users@lists.linuxcontainers.org><br>
<b>Subject:</b> Re: [lxc-users] Running unprotected system container</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Greetings, Koehler!<br>
<br>
> I am unclear how this answers my current questions. System containers are<br>
> marketed as being very close to a faster VM, as such, since I do have<br>
> control over the OS I am trying to run on top, I would need more details as<br>
> to why and which areas would cause the technical issues to achieve such<br>
> thing.<br>
<br>
System container != kernel virtualization.<br>
<br>
> The fact that the System container shares the kernel here is totally<br>
> what I am looking for, there is also no other application running on the<br>
> host except that container and snapd itself which should not be a problem <br>
> as it removes any race where one app may changes kernel-related<br>
> configuration from under the OS within the container.<br>
<br>
They aren't "sharing kernel", they are layer on top of it.<br>
<br>
> I do understand that this is unconventional and doesn't appear to fall<br>
> under the supported scenarios. Yet, so far the issue I am facing does not<br>
> appear related to my final goal.<br>
<br>
It's not "unconventional", it's not intended and contradictory.<br>
<br>
> Can't execute any command within container -> permission denied (files are<br>
> all uid/gid 0) this is a busybox type of OS on same CPU architecture (both<br>
> armhf where host is arm64, yet metadata provided indicate that container<br>
> should be armhf)Still seeing issue trying to write /proc and even though I<br>
> say mount rw I get read-only errorsFail to load the kernel module even<br>
> though I have clear the cap.drop as to keep cap_sys_modules.<br>
<br>
See above. If you want kernel virtualization, use a VM.<br>
QEMU/KVM is there for you.<br>
<br>
<br>
-- <br>
With best regards,<br>
Andrey Repin<br>
Tuesday, June 16, 2020 2:07:03<br>
<br>
Sorry for my terrible english...<br>
<br>
_______________________________________________<br>
lxc-users mailing list<br>
lxc-users@lists.linuxcontainers.org<br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users">http://lists.linuxcontainers.org/listinfo/lxc-users</a>
<br>
</div>
</span></font></div>
</body>
</html>