<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Greetings, Repin,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
I am unclear how this answers my current questions. System containers are marketed as being very close to a faster VM, as such, since I do have control over the OS I am trying to run on top, I would need more details as to why and which areas would cause the
technical issues to achieve such thing. The fact that the System container shares the kernel here is totally what I am looking for, there is also no other application running on the host except that container and snapd itself which should not be a problem
as it removes any race where one app may changes kernel-related configuration from under the OS within the container.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
I do understand that this is unconventional and doesn't appear to fall under the supported scenarios. Yet, so far the issue I am facing does not appear related to my final goal.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<ul>
<li>Can't execute any command within container -> permission denied (files are all uid/gid 0) this is a busybox type of OS on same CPU architecture (both armhf where host is arm64, yet metadata provided indicate that container should be armhf)</li><li>Still seeing issue trying to write /proc and even though I say mount rw I get read-only errors</li><li>Fail to load the kernel module even though I have clear the cap.drop as to keep cap_sys_modules.</li></ul>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
I am currently doing those evaluations under Ubuntu Core 18.04 with lxd installed as a snap.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
--</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Yannick Koehler</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> lxc-users <lxc-users-bounces@lists.linuxcontainers.org> on behalf of Andrey Repin <anrdaemon@yandex.ru><br>
<b>Sent:</b> June 15, 2020 10:49 AM<br>
<b>To:</b> Yannick Koehler <lxc-users@lists.linuxcontainers.org>; All <lxc-users@lists.linuxcontainers.org><br>
<b>Subject:</b> Re: [lxc-users] Running unprotected system container</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Greetings, Koehler!<br>
<br>
> As indicated, the code that will run inside that container is our previous<br>
> OS and if it does bad things, well, that means it was doing so previously so<br>
> not a "bigger" issue than it was before. Since if that works, we will move<br>
> more towards snap we will then have a better security system (AppArmor,<br>
> SecComp, better app separation, etc) in place to remove trust for each app<br>
> and get rid eventually of that container which purpose as indicated is to<br>
> ease the transition and get some of the features we want from Ubuntu Core<br>
> in an early release, if we do get this to work.<br>
<br>
If your intent is to run specifically **operating system**, then there's no way<br>
around a virtual machine.<br>
<br>
Containers is NOT the right choice for your task.<br>
<br>
<br>
-- <br>
With best regards,<br>
Andrey Repin<br>
Monday, June 15, 2020 17:47:30<br>
<br>
Sorry for my terrible english...<br>
<br>
_______________________________________________<br>
lxc-users mailing list<br>
lxc-users@lists.linuxcontainers.org<br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users">http://lists.linuxcontainers.org/listinfo/lxc-users</a>
<br>
</div>
</span></font></div>
</body>
</html>