On Wed, Aug 21, 2013 at 9:22 AM, Gao feng <gaof...@cn.fujitsu.com> wrote: > On 08/21/2013 03:06 PM, Eric W. Biederman wrote:
>> I suspect libvirt should simply not share /run or any other normally >> writable directory with the host. Sharing /run /var/run or even /tmp >> seems extremely dubious if you want some kind of containment, and >> without strange things spilling through. Right, /run or /var cannot be shared. It's not only about sockets, many other things will also go really wrong that way. > right now I only take note of the unix socket /run/systemd/private, > but there may have many similar unix sockets, they can exist in any > path. the strange problems will still happen. > > anyway, I will send a patch to setup a fresh tmpfs for the /run directory of > container first. This is what systemd-nspawn does for a container setup: http://cgit.freedesktop.org/systemd/systemd/tree/src/nspawn/nspawn.c#n350 Kay ------------------------------------------------------------------------------ Introducing Performance Central, a new site from SourceForge and AppDynamics. Performance Central is your source for news, insights, analysis and resources for efficient Application Performance Management. Visit us today! http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk _______________________________________________ Lxc-devel mailing list Lxc-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/lxc-devel
