Hey everyone, So I spent some time this morning trying to figure out if setns to unprivileged containers was even possible.
The good news is that it is, the bad news is that setns back to the original namespace isn't allowed. So in practice, with this patch[0] I can get lxc-info to show information from an unprivileged containers like so: stgraber@castiana:~/Desktop$ lxc-info -n p1 Name: p1 State: RUNNING PID: 24704 lxc_container: Operation not permitted - failed to setns lxc_container: Operation not permitted - failed to setns IP: 10.0.3.124 IP: 10.0.4.1 IP: 2607:f2c0:f00f:2751:5c41:a8fd:1169:6041 IP: 2607:f2c0:f00f:2751:ac15:54ff:fed5:8b4a The problem obviously comes from those two error messages which say that setns back to the original namespace failed. I can't think of a nice way around this particular limitation nor am I convinced that there is any safe way to fix that at the kernel level. (CCing Eric in case there's something I missed) The obvious thing we could do is instead of doing the setns calls in process, instead fork a child, have it do the setns and send the result of the command back to the original caller. However doing that is likely going to take a bit more time than I have available right now, so if someone's interested, that'd be a great thing to have for 1.0. [0] http://paste.ubuntu.com/6787869/ -- Stéphane Graber Ubuntu developer http://www.ubuntu.com
signature.asc
Description: Digital signature
_______________________________________________ lxc-devel mailing list [email protected] http://lists.linuxcontainers.org/listinfo/lxc-devel
