Re: [lxc-devel] [Lxc-users] Using initctl inside a container with upstart?

2010-05-18 Thread Serge E. Hallyn
Quoting Wilhelm (wilhelm.me...@fh-kl.de): Hi all, is it safe to use initctl in a container using upstart (as ubuntu lucid)? Especially, upstart-init uses an abstract unix-socket: connect(3, {sa_family=AF_FILE, path=@/com/ubuntu/upstart}, 22) = 0 Is this socket separated from the

Re: [lxc-devel] [Lxc-users] lxc-0.7.1 released

2010-06-28 Thread Serge E. Hallyn
Quoting Daniel Lezcano (daniel.lezc...@free.fr): Hi All, Notes: == Bug fixes only. ChangeLog: == Ciprian Dorin, Craciun (1): lxc to apply mount options for bind mounts Daniel Lezcano (6): fix sshd template fix bad free when reading the

Re: [lxc-devel] security considerations when running lxc as non-root

2010-07-02 Thread Serge E. Hallyn
Quoting Greg Kurz (gk...@fr.ibm.com): On Thu, 2010-07-01 at 10:58 -0500, Serge E. Hallyn wrote: 3. instead of keeping caps in pP and raising in pE when needed, a more privilege-separated approach could be used, where you have small privileged helpers which are called by the unprivileged

Re: [lxc-devel] security considerations when running lxc as non-root

2010-07-02 Thread Serge E. Hallyn
Quoting Ferenc Wagner (wf...@niif.hu): Daniel Lezcano daniel.lezc...@free.fr writes: The lxc tools can be run as non-root with all the needed capabilities set by lxc-setcap via the file capabilities. The command run by lxc won't have these privileges of course. I've always regarded

Re: [lxc-devel] [Lxc-users] template-script for ubuntu [lucid] containers

2010-09-08 Thread Serge E. Hallyn
Quoting user virtual (virtual...@gmail.com): Hi guys You might consider including upstream some of my patches to Wilhelms lxc-ubuntu script. I was forced to make them to make things work for me. I've spent too much of my time making this work. You can download install demo scripts with

Re: [lxc-devel] [Lxc-users] template-script for ubuntu [lucid] containers

2010-09-08 Thread Serge E. Hallyn
Quoting user virtual (virtual...@gmail.com): Hi Serge Sorry for the missing link: http://virtualusr.wordpress.com/2010/09/07/flying-linux-containers-on-xen-4-0-on-pv-ubuntu-10-04-lucid/ There was no networking setup and making one blocked upstart for me. Hm, you're using lxc-ubuntu by

Re: [lxc-devel] [Lxc-users] regular lxc development call?

2010-12-13 Thread Serge E. Hallyn
Quoting Daniel Lezcano (daniel.lezc...@free.fr): On 11/30/2010 04:06 AM, Serge E. Hallyn wrote: Quoting Daniel Lezcano (daniel.lezc...@free.fr): Looks like we'll be starting small anyway, so let's just try skype. Anyone interested in joining, please send me your skype id. What

Re: [lxc-devel] regular lxc development call?

2010-12-13 Thread Serge E. Hallyn
Quoting Daniel Lezcano (daniel.lezc...@free.fr): On 11/29/2010 03:53 PM, Serge E. Hallyn wrote: Hi, at UDS-N we had a session on 'fine-tuning containers'. The focus was things we can do in the next few months to improve containers. The meeting proeedings can be found at https

Re: [lxc-devel] [Lxc-users] Latest test results - Was: cgroups: support cgroups mounted in multiple places (v3)

2011-07-03 Thread Serge E. Hallyn
Quoting Michael H. Warfield (m...@wittsend.com): On Sat, 2011-07-02 at 15:13 -0500, Serge Hallyn wrote: Quoting Michael H. Warfield (m...@wittsend.com): ... F15 systemd: Passed. F12 single mount: Passed. F13 single mount: Passed. F14 single mount: Passed. F14 libcgroup:

Re: [lxc-devel] [Lxc-users] PAM-module for adhoc creation of container

2011-09-02 Thread Serge E. Hallyn
Quoting Axel Schöner (axel.schoe...@gmx.de): Hello, i need some feedback and suggestions for this project. If there are similar solutions please let me know. I want to build a solution for creating and starting a container on user login (via ssh or shell). The user should be

Re: [lxc-devel] Device Namespaces

2013-10-01 Thread Serge E. Hallyn
Quoting Andy Lutomirski (l...@amacapital.net): On Tue, Oct 1, 2013 at 7:19 AM, Janne Karhunen janne.karhu...@gmail.com wrote: On Thu, Sep 26, 2013 at 8:33 AM, Greg Kroah-Hartman gre...@linuxfoundation.org wrote: - We can relay a call of /sbin/hotplug from outside of a container to

[lxc-devel] cgroup management daemon

2013-11-25 Thread Serge E. Hallyn
Hi, as i've mentioned several times, I want to write a standalone cgroup management daemon. Basic requirements are that it be a standalone program; that a single instance running on the host be usable from containers nested at any depth; that it not allow escaping ones assigned limits; that it

Re: [lxc-devel] cgroup management daemon

2013-11-25 Thread Serge E. Hallyn
Quoting Tim Hockin (thoc...@google.com): Thanks for this! I think it helps a lot to discuss now, rather than over nearly-done code. On Mon, Nov 25, 2013 at 2:43 PM, Serge E. Hallyn se...@hallyn.com wrote: Additionally, Tejun has specified that we do not want users to be too closely tied

Re: [lxc-devel] cgroup management daemon

2013-11-26 Thread Serge E. Hallyn
Quoting Tim Hockin (thoc...@google.com): What are the requirements/goals around performance and concurrency? Do you expect this to be a single-threaded thing, or can we handle some number of concurrent operations? Do you expect to use threads of processes? The cgmanager should be pretty

Re: [lxc-devel] cgroup management daemon

2013-11-26 Thread Serge E. Hallyn
Quoting Tim Hockin (thoc...@google.com): At the start of this discussion, some months ago, we offered to co-devel this with Lennart et al. They did not seem keen on the idea. If they have an established DBUS protocol spec, see

Re: [lxc-devel] cgroup management daemon

2013-11-26 Thread Serge E. Hallyn
Quoting Tim Hockin (thoc...@google.com): On Mon, Nov 25, 2013 at 9:47 PM, Serge E. Hallyn se...@hallyn.com wrote: Quoting Tim Hockin (thoc...@google.com): ... . A client (requestor 'r') can make cgroup requests over /sys/fs/cgroup/manager using dbus calls. Detailed privilege

Re: [lxc-devel] cgroup management daemon

2013-11-26 Thread Serge E. Hallyn
Quoting Tim Hockin (thoc...@google.com): lmctfy literally supports .. as a container name :) So is ../.. ever used, or does noone every do anything beyond ..? -- Rapidly troubleshoot problems before they affect your

Re: [lxc-devel] cgroup management daemon

2013-11-26 Thread Serge E. Hallyn
can see people wanting to go further. Would it be much different to support both? I feel like it'll be simpler to support all if we go that route. On Tue, Nov 26, 2013 at 1:28 PM, Serge E. Hallyn se...@hallyn.com wrote: Quoting Tim Hockin (thoc...@google.com): lmctfy literally