Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* Enable get_cgroup_mount to search for mount points satisfying multiple ↵Christian Seiler2012-02-231-1/+30
| | | | | | | | | | | | | subsystems at once lxc-attach functionality reads /proc/init_pid/cgroup to determine the cgroup of the container for a given subsystem. However, since subsystems may be mounted together, we want to be on the safe side and be sure that we really find the correct mount point, so we allow get_cgroup_mount to check for *all* the subsystems; the subsystem parameter may now be a comma-separated list. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Add missing double-include #ifndef/#define/#endif to confile.hChristian Seiler2012-02-231-0/+5
| | | | Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Add missing 'extern' keyword to functions defined in cgroup.hChristian Seiler2012-02-231-5/+5
| | | | Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Accept numeric values for capabilities to dropChristian Seiler2012-02-231-0/+17
| | | | | | | | lxc.cap.drop now also accepts numeric values for capabilities. This allows the user to specify capabilities LXC doesn't know about yet or capabilities that were not part of the kernel headers LXC was compiled against. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Add CAP_SYSLOG and CAP_WAKE_ALARM to list of capabilitiesChristian Seiler2012-02-231-0/+6
| | | | Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Add function to determine CAP_LAST_CAP of the current kernel dynamicallyChristian Seiler2012-02-232-0/+48
| | | | | | | | | | | The function lxc_caps_last_cap() determines CAP_LAST_CAP of the current kernel dynamically. It first tries to read /proc/sys/kernel/cap_last_cap. If that fails, because the kernel does not support this interface yet, it loops through all capabilities and tries to determine whether the current capability is part of the bounding set. The first capability for which prctl() fails is considered to be CAP_LAST_CAP. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* correctly install signal handler for lxc-initJian Xiao2012-02-231-3/+19
| | | | | | | | | This patch is to correct the manipulation of signal masks when installing signal handlers for lxc-init. Signed-off-by: Jian Xiao <jian@linux.vnet.ibm.com> Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* remove redundent LXC_TTY_HANDLERJian Xiao2012-02-232-36/+2
| | | | | | | | All the signals (except fatal ones) are redirected to signalfd at lxc_init, so the LXC_TTY_HANDLERs are redundant. This patch removes them. Signed-off-by: Jian Xiao <jian@linux.vnet.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* limit rm to rootfs, avoiding nuking of any bind mounts fromandrea rota2012-01-051-1/+1
| | | | | | the host Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc: add Bugs section to lxc-monitor(1)Greg Kurz2012-01-051-0/+12
| | | | | | | | This lxc-monitor limitation deserves some lines in the manpage, until something is done to allow several monitors to run concurrently. Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc: line buffered output for lxc-monitorGreg Kurz2012-01-051-0/+2
| | | | | | | | | | | A typical usage is to start lxc-monitor in popen() and parse the ouput. Unfortunately, glibc defaults to block buffering for pipes and you may have to wait several lines before anything is written to stdout... this prevent the use of lxc-monitor to implement automatons. Let's go line buffered ! Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* ubuntu template: use -updates and -security (v3)Serge Hallyn2012-01-051-2/+29
| | | | | | | | | | | | | | | | | | | Particularly for LTS releases, which many people will want to use in their containers, it is not wise to not use release-security and release-updates. Furthermore the fix allowing ssh to allow the container to shut down is in lucid-updates only. With this patch, after debootstrapping a container, we add -updates and -security to sources.list and do an upgrade under chroot. Unfortunately we need to do this because debootstrap doesn't know how to. Changelog: Nov 14: as Stéphane Graber suggested, make sure no daemons start on the host while doing dist-upgrade from chroot. Nov 15: use security.ubuntu.com, not mirror. (stgraber) Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Fix ia64 cloneDaniel Lezcano2012-01-051-2/+2
| | | | | | Fix the stack address for ia64. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Fix network cleanup on errorDaniel Lezcano2012-01-052-6/+11
| | | | | | | Network cleanup does not cleanup correctly the virtual interfaces in case of an error. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* give explicit error when the cgroup are not foundDaniel Lezcano2012-01-051-1/+7
| | | | | | | | | When the cgroup is not mounted, we silently exit without giving some clues to the user with what is happening. Give some info and an explicit error. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* fix indentation of the previous patchDaniel Lezcano2012-01-051-3/+8
| | | | Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Set high byte of mac addresses for host veth devices to 0xfeChristian Seiler2012-01-051-0/+40
| | | | | | | | | | | | | | | | | | When used in conjunction with a bridge, veth devices with random addresses may change the mac address of the bridge itself if the mac address of the interface newly added is numerically lower than the previous mac address of the bridge. This is documented kernel behavior. To avoid changing the host's mac address back and forth when starting and/or stopping containers, this patch ensures that the high byte of the mac address of the veth interface visible from the host side is set to 0xfe. A similar logic is also implemented in libvirt. Fixes SF bug #3411497 See also: <http://thread.gmane.org/gmane.linux.kernel.containers.lxc.general/2709> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
* Revert "lxc: use -iquote instead of -I"Daniel Lezcano2011-11-181-6/+1
| | | | This reverts commit a2dea4ea209a8fcf6837668bbe59f350931d1c07.
* Ubuntu template: some tweaksStéphane Graber2011-11-101-1/+4
| | | | | | | Allow mknod (fixing udev upgrades) and drop mac_override and mac_admin from lxc.cap.drop as apparmor has/will have support for namespaces Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc: use -iquote instead of -IGreg Kurz2011-11-101-1/+6
| | | | | | | | | To avoid name collisions between local and system header files. For example, if you try to include the <pty.h> system file, you end up including the one from lxc... Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc: fix erroneous includesGreg Kurz2011-11-108-12/+19
| | | | | | | The "" notation is preferrable if the header file is local. Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* add lxc-archlinux templateAlexander Vladimirov2011-11-104-1/+466
| | | | | | Hi, here's the patch which adds Arch linux container template Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* fix lxc-destroyDaniel Lezcano2011-11-101-0/+1
| | | | | | Add missing 'localstatedir' directory definition. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc-fedora.in: Fix fetching of the fedora-release rpmTuomas Suutari2011-10-281-2/+24
| | | | | | | | | | | | | The hardcoded URL seems to be broken and 404 error was not checked. Now the mirror is selected from mirrorlist (instead of hardcoding to funet.fi) and fetch errors are checked. Also added a retry loop (with 3 tries) to find a working mirror, since some of the mirrors are not OK. Signed-off-by: Tuomas Suutari <tuomas.suutari@gmail.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc-fedora.in: Use i386 instead of i686Tuomas Suutari2011-10-281-0/+4
| | | | | | | | | There is no i686 variant of Fedora, but Ubuntu seems to return i686 from the arch command. Signed-off-by: Tuomas Suutari <tuomas.suutari@gmail.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc-fedora.in: Add missing default release variableTuomas Suutari2011-10-281-0/+1
| | | | | | | | | The text says that 14 is default, but release=14 was not set anywhere in the script. Signed-off-by: Tuomas Suutari <tuomas.suutari@gmail.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* templates: update openSUSE template for openSUSE 12.1Frederic Crozat2011-10-281-27/+48
| | | | | | | | rely on "build" package, to ensure chroot can be created with distribution older than 12.1 Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Drop resolvconf from oneiric container package listSerge E. Hallyn2011-10-251-1/+1
| | | | | | | | | | It prevents containers from getting a good resolv.conf without doing ifdown eth0; ifup eth0. (see pad.lv/880020) Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* extend the struct lxc_argumentsCedric Le Goater2011-10-242-0/+4
| | | | | | | | | This patch adds a private argument to extend the struct lxc_arguments. This is useful to develop custom lxc commands outside mainline lxc. Signed-off-by: Cedric Le Goater <clg@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc: introduce lxc_execute()Greg Kurz2011-10-246-46/+107
| | | | | | | | | | | | | | | | This patch allows to create application containers with liblxc.so directly. Some code cleanups on the way: - separate ops for lxc_execute() and lxc_start(): the factorisation is wrong here as we may have specific things to do if we're running an application container. It deserves separate ops. - lxc_arguments_dup() is merged in the pre-exec operation: this is a first use for the execute op introduced just above. It's better to build the arguments to execvp() where they're really used. Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> Cc: Cedric Le Goater <clg@fr.ibm.com>
* handle kernel 3.x in lxc-checkconfigFrederic Crozat2011-10-241-4/+13
| | | | | | Make sure to correctly detect kernel 3.x for file capabilities. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* alt linux templateAlexey Shabalin2011-10-241-19/+94
| | | | | | | Updates. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --
* lxc-ubuntu: stop early if a bad user is specified in -b optionSerge E. Hallyn2011-10-241-5/+13
| | | | | | | | | Otherwise we end up with a bad container fstab and a container that won't boot. See https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/879052 Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Don't list containers w/ active console sessions multiple timesRainer Weikusat2011-10-241-1/+1
| | | | | | | | | | | | | | The lxc-ls shell script uses netstat -xa to get a listing of AF_UNIX sockets it then parses in order to determine the names of presently running containers. This is wrong because it will list the listening socket and all sockets created by accepting connections on that. This causes the script to display the names of containers with active lxc-console sessions 1 + n times, n being the number of active console sessions. The patch below fixes this by using netstat -xl instead which only displays the listening sockets. Signed-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* ubuntu template: allow containers to create tap devicesSerge E. Hallyn2011-10-241-0/+2
| | | | | | | Thought I had sent this before, but I don't find it anywhere. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Accurately detect whether a system supports clone_childrenSerge E. Hallyn2011-10-241-1/+6
| | | | | | | | | | | If multiple cgroups are mounted under /sys/fs/cgroup, then the original check ends up looking for /sys/fs/cgroup/cgroup.clone_children, which does not exist because that is just a tmpfs. So make sure to check an actual cgroupfs. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Let sshd template work on ubuntu systems.Serge E. Hallyn2011-10-242-2/+4
| | | | | | | | | | /dev/shm is a symlink to /run/shm, so we need /run/shm to exist in the container rootfs. Also, /dev/mqueue does not exist on the host, and can't be created by the container. But we don't really need it so ignore that. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* ubuntu template: disallow cap_sys_module (by popular demand)Serge E. Hallyn2011-10-241-0/+1
| | | | | | | | | This isn't particularly reassuring, and will be moot with user namespaces, but as people are asking for it, turn off sys_module. While we're at it, turn off mac_admin and mac_override. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* lxc-clone: fix dhclient.conf send hostname commandSerge E. Hallyn2011-10-241-1/+1
| | | | | | | | End the command with ';', which is needed, and put the hostname in quotes (which doesn't really seem needed, but shown in man page). Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* fix more broken paths in lxc-*.in scriptsGreg Kurz2011-10-242-0/+2
| | | | | | | | | There are still some sequels from commit: 1c41ddcb4af633ac906f1d7c9ef1dc7d121d7850 Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* fix broken lxc-*.in scriptsGreg Kurz2011-09-203-2/+7
| | | | | | | | | | | | | | | Commit 92c7f6295518decd3989b2790d758888551e7d9a broke the following scipts: - lxc-setcap - lxc-setuid - lxc-create This patch adds the missing variables to be substitued by the configure script. Cheers. Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* Set the utsname on the debian templateTzafrir Cohen2011-09-131-2/+3
| | | | | Signed-off-by: Tzafrir Cohen <tzafrir@cohens.org.il> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* only warn for inherited file descriptorsGreg Kurz2011-09-131-17/+3
| | | | | | | | | | | | | | As discussed in thread: http://sourceforge.net/mailarchive/forum.php?thread_name=4E5618C3.5060507%40free.fr&forum_name=lxc-devel We think it's better for now to only warn the user about a fd leaking into the container. Also remove the call to readlink() as it isn't really useful now: since the container will start anyway, the user can look into /proc/../fd or use lsof or whatever. Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* fixes for rpmbuildGreg Kurz2011-09-134-22/+40
| | | | | | | | | | | | | | | | | | | | | | This patch fixes some makefile/specfile issues when running rpmbuild with the distributed lxc specfile: - fixes usage of installation directories for config files, rootfs, templates and lxc-init so that they're calculated at make time instead of configure time. Thanks to this, all installed items go under $RPM_BUILD_ROOT when running rpmbuild - introduce --disable-rpath option to configure to avoid check-rpaths errors when building non-root. - introduce a lxc-libs package in the default spec file to allow concurrent installation of 32 bit and 64 bit libraries. v2: - fix circular reference in lxc.pc - ship lxc.pc with lxc-devel Signed-off-by: Greg Kurz <gkurz@fr.ibm.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* remove the check for container path as it's done in lxc-createInformatiQ2011-09-011-5/+0
| | | | | Signed-off-by: InformatiQ <rhanna@informatiq.org> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* if after freezing the container the snapshot/rsync fails, unfreeze before ↵InformatiQ2011-08-311-2/+12
| | | | | | | | exiting Signed-off-by: InformatiQ <rhanna@informatiq.org> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
* *add the new opts to help() *set container_running=falseInformatiQ2011-08-311-2/+4
| | | | | | Signed-off-by: InformatiQ <rhanna@informatiq.org> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
* * allow cloning of non-snapshot lvm devicesInformatiQ2011-08-311-22/+74
| | | | | | Signed-off-by: InformatiQ <rhanna@informatiq.org> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
* lxc-fedora.inRamez Hanna2011-08-311-7/+21
| | | | | | | * if not running on fedora host amd -R is not set, use fedora 14 as default * trap SIGHUP SIGINT SIGTERM, and cleanup before exiting Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
* fix for missing EOF and fstab contentsRamez Hanna2011-08-311-5/+5
| | | | | | | | templates/lxc-fedora.in | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>