Re: [lxc-users] Cannot setup thread local storage unknown error

2014-01-07 Thread Serge Hallyn
Quoting Vivek Singh (vivek.si...@gmail.com): To make seccomp.full file I coppied all syscall numbers from unistd.h . If I remove seccomp.full file from lxc.conf it works fine . But with seccomp.full in lxc config it fails Are 253, 254, and 255 in your seccomp.full file? Does strace show you

Re: [lxc-users] Creating a container as non root

2014-01-09 Thread Serge Hallyn
Quoting Michael H. Warfield (m...@wittsend.com): On Thu, 2014-01-09 at 08:08 +0200, Kevin Wilson wrote: Hello, I believe that creating a container as non root user should be straight-forward. Sigh... I'm afraid not... Funny, Serge and I just had a couple of comments in exchange

Re: [lxc-users] Full network device access in the container

2014-01-16 Thread Serge Hallyn
That depends on what else is listed there. If it's only rootfs, proc and sys, then sure. Quoting Piotr R (tytu...@gmail.com): Does that mean that /etc/fstab within the container should be modified/removed? Piotr On Thu, Jan 16, 2014 at 3:55 PM, Serge Hallyn serge.hal

Re: [lxc-users] shared mount and umount propogation.

2014-02-04 Thread Serge Hallyn
Quoting Vijay Viswanathan (vijay.vi...@gmail.com): Hi Is there an option where shared mount works and restrict propogation of unmounts ? This the sequence to reproduce the issue. 1) make /mnt share mount 2) mount a usb stick on it /dev/sdc - /mnt/usb [here mount shows :

Re: [lxc-users] Is calling external mount-binding scripts supported with Ubuntu's upstart scripts?

2014-02-11 Thread Serge Hallyn
Quoting Adam Ryczkowski (adam.ryczkow...@statystyka.net): On Ubuntu, LXC has a nice feature, that allows to execute the script automatically upon boot, if the link to the configuration file is present on /etc/lxc/auto. Unfortunately I need to call a mount-binding script on host before, so

Re: [lxc-users] shared mount and umount propogation.

2014-02-11 Thread Serge Hallyn
/mnt what ever container1 mounts in /mnt is visible on container2 found a thread where entry in fstab matters? Thanks. On Tue, Feb 4, 2014 at 11:36 AM, Serge Hallyn serge.hal...@ubuntu.comwrote: Quoting Vijay Viswanathan (vijay.vi...@gmail.com): Hi Is there an option where

Re: [lxc-users] Usind fstab inside the container?

2014-02-12 Thread Serge Hallyn
Quoting Flo (florian.engelm...@gmail.com): Hi, I try to mount a glusterfs volume on LXC startup. Adding to /etc/fstab: 192.168.219.171:/homes /export/home glusterfs defaults,_netdev 0 0 does mount the volume if I run mount -a but not on startup. This sounds like an issue with your

Re: [lxc-users] Use rootfs images to avoid lxc-create

2014-02-12 Thread Serge Hallyn
Quoting Robin Monjo (robin.mo...@applidget.com): Hello, Thank you for the answers. My problem is when I untar my rootfs. Got lots of errors such as: tar: ./rootfs/dev/mixer: Cannot mknod: Operation not permitted tar: ./rootfs/dev/ram5: Cannot mknod: Operation not permitted tar:

Re: [lxc-users] Centos: how to specify static ip address to container

2014-02-14 Thread Serge Hallyn
Quoting Michael H. Warfield (m...@wittsend.com): On Fri, 2014-02-14 at 11:06 +0800, Mingjiang Shi wrote: Hi Michael, Thanks for answering my question. There was no such file /var/lib/libvirt/dnsmasq/default.conf, so I created one. However, it still doesn't work after killing the existing

Re: [lxc-users] General question about limits and kernel parameters

2014-02-17 Thread Serge Hallyn
Quoting Flo (florian.engelm...@gmail.com): Hi, I've got a general question about limits and kernel parameters. Limits are process based so I am able to set them inside of an LXC but do I have to set those limits also on the host itself? eg. If I want the user (only known in the LXC)

Re: [lxc-users] Setting up containers with multiple logical volumes

2014-02-17 Thread Serge Hallyn
Quoting Joshua Schaeffer (jschaeffer0...@gmail.com): I still can't get this to work, I'm sure I'm missing something simple or obvious. To recap, I'm trying to use an LVM logical volume for my container's /var and /tmp partitions. Since I've been unable to get this to work, I've just

Re: [lxc-users] lxc state driver is not active

2014-02-17 Thread Serge Hallyn
Quoting Tom Taylor (t...@tommyt.co.uk): So I've followed this tutorial on a vanilla CentOS 6.5 (x64) hardware install ... http://wiki.centos.org/HowTos/LXC-on-CentOS6 I'm getting the following error when trying to intialise the container ... # virt-install --connect lxc:/// --name dns

Re: [lxc-users] Setting up containers with multiple logical volumes

2014-02-17 Thread Serge Hallyn
Quoting Joshua Schaeffer (jschaeffer0...@gmail.com): Yes it failed to start: 1. lxc-create -n testme1 -t debian 2. root@reaver:~# cat /var/lib/lxc/testme1/config | grep lxc.mount.entry lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0 lxc.mount.entry = sysfs sys sysfs

Re: [lxc-users] Setting up containers with multiple logical volumes

2014-02-17 Thread Serge Hallyn
Quoting Serge Hallyn (serge.hal...@ubuntu.com): Quoting Joshua Schaeffer (jschaeffer0...@gmail.com): Yes it failed to start: 1. lxc-create -n testme1 -t debian 2. root@reaver:~# cat /var/lib/lxc/testme1/config | grep lxc.mount.entry lxc.mount.entry = proc proc proc nodev,noexec

Re: [lxc-users] cgmanager+lxc-attach

2014-02-21 Thread Serge Hallyn
Quoting Tamas Papp (tom...@martos.bme.hu): On 02/21/2014 05:49 PM, Serge Hallyn wrote: Sorry, I'm afraid not :( But so move_pid is what is failing... which means the create and chown calls have already succeeded. If you can tell me that today, with latest uptodate packages from ppa

Re: [lxc-users] cgmanager+lxc-attach

2014-02-24 Thread Serge Hallyn
Quoting Tamas Papp (tom...@martos.bme.hu): On 02/22/2014 06:25 AM, Serge Hallyn wrote: Ok, thanks Tamas - this is a bug in how the cgproxy starts up on an older kernel. As a workaround until I get it fixed, you can sudo stop cgproxy sudo stop cgmanager sudo rm -rf /sys/fs/cgroup

Re: [lxc-users] lxc-attach shows hosts root fs instead of containers'

2014-02-25 Thread Serge Hallyn
Quoting Florian Klink (flo...@flokli.de): Hi Wojtek, thanks for your answer! I built a kernel with the same config, but with CONFIG_USER_NS set to y. lxc-checkconfig now also reports user namespace as enabled. But when I run lxc-attach, I still see the root file system of the

Re: [lxc-users] Best practice for sharing folder between lxc-guests?

2014-02-27 Thread Serge Hallyn
Quoting Guido Jäkel (g.jae...@dnb.de): Dear Andreas, Dear Friedemann, you should not need the whole path and in my opinion you should not use it because then you don't need to change it if the container root will change later. But the mount point inside the container rootfs must exist.

Re: [lxc-users] cgmanager+lxc-attach

2014-03-03 Thread Serge Hallyn
Quoting Tamas Papp (tom...@martos.bme.hu): On 02/24/2014 04:00 PM, Tamas Papp wrote: On 02/24/2014 03:36 PM, Serge Hallyn wrote: Quoting Tamas Papp (tom...@martos.bme.hu): On 02/22/2014 06:25 AM, Serge Hallyn wrote: Ok, thanks Tamas - this is a bug in how the cgproxy starts up

Re: [lxc-users] open files limit

2014-03-04 Thread Serge Hallyn
Quoting Tamas Papp (tom...@martos.bme.hu): hi All, What is the status of open files thing? I see too many open files in a container, but everything works properly outside of the container but sysctl fs.file-nr shows values from the host. Therefore I'm a bit confused now. fs.file-nr is

Re: [lxc-users] Fail to convert LXC container configuration into a domain XML fragment

2014-03-06 Thread Serge Hallyn
Quoting Du Jun (dj199...@gmail.com): Hi, all, I used lxc-tools to create a linux container. I am trying to transfrom LXC container configuration into a domain XML fragment using the following command: *$ virsh -c lxc:/// domxml-from-native lxc /var/lib/lxc/my_conatiner/config* However, I

Re: [lxc-users] Fail to convert LXC container configuration into a domain XML fragment

2014-03-06 Thread Serge Hallyn
Quoting Daniel P. Berrange (berra...@redhat.com): On Thu, Mar 06, 2014 at 08:31:16AM -0600, Serge Hallyn wrote: Quoting Du Jun (dj199...@gmail.com): Hi, all, I used lxc-tools to create a linux container. I am trying to transfrom LXC container configuration into a domain XML fragment

Re: [lxc-users] shared mount and umount propogation.

2014-03-06 Thread Serge Hallyn
Quoting Vijay Viswanathan (vijay.vi...@gmail.com): isnt --make-rbind and -rbind the same ? anyways, I think understood the rslave concept. You want me make a slave mount (e.g., /mnt ) of some original share mount ( e.g., /media ) and expose only /mnt in the lxc conf right ? But the

Re: [lxc-users] shared mount and umount propogation.

2014-03-07 Thread Serge Hallyn
Quoting Craig Ruff (cr...@ucar.edu): On Thu, Mar 06, 2014 at 12:03:53PM -0600, Serge Hallyn wrote: That should now be fixed in git, as all of / gets mounted MS_SLAVE if / is found to be shared. Now if only /media is shared and not /, I suppose that's a different case. I am seeing

Re: [lxc-users] shared mount and umount propogation.

2014-03-10 Thread Serge Hallyn
Quoting Craig Ruff (cr...@ucar.edu): Oops, made a major typo. I meant to say I had to do a mount --make-rslave / to get things to behave. Ah, that makes a lot more sense :) So we just need a function to walk all the mounts and convert them. thanks, -serge

Re: [lxc-users] lxc-users Digest, Vol 13, Issue 3

2014-03-11 Thread Serge Hallyn
I'm waiting to see if someone has some scripts at the ready for you, but in general you'll need to (a) add a rule on VMA to accept traffic destined for 10.0.3.0/24 over eth0, and (b) add a route on vmB to send 10.0.3.0/24 traffic through vmA. Which means you won't be able to have a 10.0.3.0/24

Re: [lxc-users] Kernel lockups when running lxc-start (J?kel)

2014-03-12 Thread Serge Hallyn
So does the same thing happen if you don't have the /var/lib/lxc/container bind mount, and instead do lxc-start -P /desk1 -n container ? does 'grep shared /proc/self/mountinfo' show anything? Quoting Dao Quang Minh (dqmin...@gmail.com): Hi, We run a ( sort of ) unconventional FS layout

Re: [lxc-users] Kernel lockups when running lxc-start

2014-03-12 Thread Serge Hallyn
if that helps. Daniel. On Wed, Mar 12, 2014 at 10:46 PM, Serge Hallyn serge.hal...@ubuntu.comwrote: Quoting Dao Quang Minh (dqmin...@gmail.com): Hi all, We encounter a bug today when one of our systems enter soft-lockup when we try to start a container. Unfortunately at that point

Re: [lxc-users] Custom Template Path When Invoking lxc-create

2014-03-12 Thread Serge Hallyn
Quoting Sarah Collison (sa...@clingclangclick.com): Is there an environmental variable or command line option to select a custom directory for lxc-… template files? I’d like to make changes to the default for my distribution, but do not want these changes overwritten with a new version. Is

Re: [lxc-users] lxc-destroy fails somehow

2014-03-14 Thread Serge Hallyn
Quoting Nels Nelson (nels.n.nel...@gmail.com): On Wed, Mar 12, 2014 at 5:16 PM, Serge Hallyn serge.hal...@ubuntu.comwrote: You gave lxc-start '-P /var/lib/lxc/test'. For lxc-create, you did not give that option, but you gave a custom config file. Greetings, Serge,- My understanding

Re: [lxc-users] lxc-destroy fails somehow

2014-03-14 Thread Serge Hallyn
Quoting Nels Nelson (nels.n.nel...@gmail.com): On Fri, Mar 14, 2014 at 11:30 AM, Serge Hallyn serge.hal...@ubuntu.comwrote: The path specified with -P is the path *under* which containers sit. Ah ha. Of course. Thank you! Have you tried the buxybox template? Yes

Re: [lxc-users] lxc-destroy fails somehow

2014-03-14 Thread Serge Hallyn
Quoting Nels Nelson (nels.n.nel...@gmail.com): On Fri, Mar 14, 2014 at 1:07 PM, Serge Hallyn serge.hal...@ubuntu.comwrote: Yes, but you need the statically linked version, sudo apt-get install busybox-static you can verify whether it is dynamically linked using ldd

Re: [lxc-users] Creating Fedora and Ubuntu containers from inside a container fails (LXC 1.0)

2014-03-17 Thread Serge Hallyn
Quoting Kevin Wilson (wkev...@gmail.com): Michael, Thanks for your answer. I would appreciate if you will explicitly tell what should I do exactly, as I want to try it: how do I create the needed two loopback devices for creating a fedora container inside a fedora container ? Note the

Re: [lxc-users] cpu, memory and IO statistics measuring from inside a container

2014-03-17 Thread Serge Hallyn
Quoting Fabio Kung (fabio.k...@gmail.com): On Fri, Mar 14, 2014 at 08:52:46AM +1300, Gavin Grieve [DATACOM] wrote: It sounds like something that should exist so if it doesn't yet, I'm quite keen to put some time into it. Coincidence or not, we (at Heroku) have been exploring this area

Re: [lxc-users] Attach a lxc container to an existing cgroup ?

2014-03-19 Thread Serge Hallyn
Quoting Sébastien Kurtzemann (fai...@kurtzemann.fr): Hi all, My idea is to create a parent cgroup which defined customer's ressources like cpu, mem, ... For example I've a cgroup called customer1 on the subsystem cpuset on which I pin the first cpu (cpuset.cpus = 1) In this parent cgroup

Re: [lxc-users] Attach a lxc container to an existing cgroup ?

2014-03-21 Thread Serge Hallyn
Quoting Jäkel, Guido (g.jae...@dnb.de): Dear Sebastian, as to my knowledge, with the current version of LXC you might use more than one configuration file and in addition, there's a file include option in the configuration parser. And even with an older, you may simulate this by a little

Re: [lxc-users] Attach a lxc container to an existing cgroup ?

2014-03-21 Thread Serge Hallyn
Quoting Guido Jäkel (g.jae...@dnb.de): On 2014-03-21 15:24, Serge Hallyn wrote: [...]. But you may write a little script that will re-read the lxc configuration and update the definded cgroup entries. @Serge: Such an lxc-reconfigure command may be something to add to the lxc package

Re: [lxc-users] Apparmor profile boken

2014-03-21 Thread Serge Hallyn
If this is a stock ubuntu 14.04 system, please do file a bug asap against apparmor. If possible, using 'ubuntu-bug apparmor' from one of the failing hosts (maybe global04). I haven't seen this myself, but it sure looks bad. Quoting Flo (florian.engelm...@gmail.com): Hi, after patching 6

Re: [lxc-users] lxc-attach error: failed to clone(0x8000): Invalid argument

2014-03-24 Thread Serge Hallyn
Quoting Nels Nelson (nels.n.nel...@gmail.com): I've managed to create and start a container with a custom template, here: https://gist.github.com/nelsnelson/9746073 However, attempting to attach to that container results in this error: # lxc-attach -n test -- echo hello world

Re: [lxc-users] Why can proc not be remounted read-only inside a container?

2014-03-24 Thread Serge Hallyn
Quoting Aaron Staley (asta...@berkeley.edu): Resurrecting this thread. I've tried again on a new machine running Ubuntu 13.10 with lxc 1.0.0~alpha1 and I am still getting the same problem. I can remount /proc rw, but not ro. I've disabled apparmor (via

Re: [lxc-users] after stopping container, mountpoint is still there

2014-03-25 Thread Serge Hallyn
Quoting Florian Klink (flo...@flokli.de): Hi, I have the problem that filesystems mounted with lxc.hook.pre-mount stay mounted the whole time, even after the container is stopped. According to my understandinding, mountpoints mounted by these hook scripts will be private to the container

Re: [lxc-users] [PATCH] check whether rootfs is shared before running hooks

2014-03-26 Thread Serge Hallyn
Quoting Florian Klink (flo...@flokli.de): this expands c597baa8f9 and 2c6f3fc932. It can't happen here as this will affect the host. So yes, the pre-start hooks by definition cannot happen in the container's ns (lxc.container.conf says it happens in the host's namespace). Perhaps the very top

Re: [lxc-users] [PATCH] check whether rootfs is shared before running pre-mount hooks

2014-03-27 Thread Serge Hallyn
Quoting Florian Klink (flo...@flokli.de): this expands c597baa8f9 and 2c6f3fc932. --- Thanks, this looks right. Two things though: 1. The whole block from lines 1509,1519 should probably be moved to there instead. Mind you the detect_ramfs_rootfs() does not apparently do the right thing, but

Re: [lxc-users] Do nested containers require that unprivileged container creation be supported?

2014-04-07 Thread Serge Hallyn
Quoting Nels Nelson (nels.n.nel...@gmail.com): Greetings gentleusers and gentledevelopers,- Okay, so the Fedora 20 discussion aside, please consider this: # lxc-create -n outer -t minimal # lxc-start -n outer -- bash bash: cannot set terminal process group (-1): Inappropriate ioctl for

Re: [lxc-users] PAM auth-user problem in containers

2014-04-07 Thread Serge Hallyn
Quoting István Király (lak...@d250.hu): Hello List, .. I have a couple of Fedora containers on a Fedora host. Everything was working fine for a while but suddenly, users can not login. - I set password for a certain-user. - I log in as another-user su certain-user password: I enter the

Re: [lxc-users] PAM auth-user problem in containers

2014-04-07 Thread Serge Hallyn
Quoting István Király (lak...@d250.hu): I updated the kernel, still no go. Try downgrading to 3.12. ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users

Re: [lxc-users] Screen corruption when starting Ubuntu container

2014-04-08 Thread Serge Hallyn
Quoting Torste Aikio (zok...@gmail.com): Hello, I'm trying out LXC containers on my desktop computer running Arch Linux. When I start a container with Ubuntu my screen flashes black and in some blinking artifacts appear to left-top corner which persist even after I I think udevadm trigger

Re: [lxc-users] Failure to start a container with 'lxc.seccomp' option set

2014-04-28 Thread Serge Hallyn
Quoting Nels Nelson (nels.n.nel...@gmail.com): Greetings, Serge,- Here is the additional information that you requested: https://gist.github.com/nelsnelson/11298117 Thanks for looking into this for me. Ok, thanks. That looks exactly as I'd expect: lxc-start 1398611507.445 DEBUG

Re: [lxc-users] Failure to start a container with 'lxc.seccomp' option set

2014-04-28 Thread Serge Hallyn
Quoting Nels Nelson (nels.n.nel...@gmail.com): Greetings, Serge,- I went ahead and tested out a blacklist, using the same lxc instance. I modified the /var/lib/lxc/test/config to specify the new seccomp policy file: lxc.seccomp = /tmp/blacklist However, now the lxc instance

Re: [lxc-users] Failure to start a container with 'lxc.seccomp' option set

2014-04-28 Thread Serge Hallyn
Quoting Nels Nelson (nels.n.nel...@gmail.com): On Mon, Apr 28, 2014 at 1:30 PM, Serge Hallyn serge.hal...@ubuntu.comwrote: Try doing sed -i 's/mknod/mknod errno 0/' /tmp/blacklist and see if it now loads. (errno 0 means it won't allow the mknod, but will return success as though

Re: [lxc-users] sysctl -p no longer allowed in container

2014-04-29 Thread Serge Hallyn
/syslog show an apparmor denial for it? what does strace show? ubuntu 14.04 apparmor. Thanks! - Dan On Tue, Apr 29, 2014 at 12:17 PM, Dan Kegel d...@kegel.com wrote: Think I should file a bug? (And against what?) - Dan On Tue, Apr 29, 2014 at 12:15 PM, Serge Hallyn serge.hal

Re: [lxc-users] Error on nested LXC-ibvirt container

2014-04-30 Thread Serge Hallyn
Quoting CDR (vene...@gmail.com): Dear Friends I defined a new network for libvirtd, after the default network gave me the same error: virsh net-start nat error: Failed to start network nat error: Unable to set bridge nat0 forward_delay: Read-only file system Do you have apparmor enabled?

Re: [lxc-users] Unable to boot unprivileged container

2014-05-05 Thread Serge Hallyn
Quoting Robert Pendell (shi...@elite-systems.org): Here is the information as you requested. lxc-start -n container -l info -o outfile lxc-start 1399295274.692 INFO lxc_start_ui - using rcfile /home/shinji/.local/share/lxc/utest/config lxc-start 1399295274.692 INFO

Re: [lxc-users] LXC with X, specifically KDE v. VM

2014-05-06 Thread Serge Hallyn
Quoting Fajar A. Nugraha (l...@fajar.net): On Tue, May 6, 2014 at 8:40 PM, Michael H. Warfield m...@wittsend.comwrote: One gotcha. I haven't tried this in the last year or so but, at one point, NX was broken on Ubuntu due to dependency failures in some multimedia packages and libraries

Re: [lxc-users] Unavailable loop devices

2014-05-06 Thread Serge Hallyn
Nak. Not until we hear more from Seth about his devloop or namespaced devtmpfs. Although a commented-out pair of lines with an explanation above it would be ok. Quoting CDR (vene...@gmail.com): Dear Mike It does work indeed. I suggest that the developers add these two lines to the sample

Re: [lxc-users] Unprivileged containers do not auto-start

2014-05-06 Thread Serge Hallyn
Quoting Robert Pendell (shi...@elite-systems.org): On Tue, May 6, 2014 at 5:01 PM, Serge Hallyn serge.hal...@ubuntu.com wrote: Quoting Robert Pendell (shi...@elite-systems.org): OS: Ubuntu 14.04 LTS x86_64 Kernel: Host-Supplied 3.14.1 Provider: Linode Host Virtualization: Xen

Re: [lxc-users] Fedora 20 template on LVM not working

2014-05-08 Thread Serge Hallyn
Could you try applying this patch to the fedora template and show us the result? From 2b7717f410b824bd960e3a3ef2c85ea739dc5678 Mon Sep 17 00:00:00 2001 From: Serge Hallyn serge.hal...@ubuntu.com Date: Thu, 8 May 2014 22:53:47 -0500 Subject: [PATCH 1/1] debug rootfspath in fedora Signed-off

Re: [lxc-users] Unprivileged containers do not auto-start

2014-05-09 Thread Serge Hallyn
Quoting Robert Pendell (shi...@elite-systems.org): On Thu, May 8, 2014 at 11:35 PM, Serge Hallyn serge.hal...@ubuntu.com wrote: Quoting Robert Pendell (shi...@elite-systems.org): On Thu, May 8, 2014 at 12:48 PM, Robert Pendell shi...@elite-systems.org wrote: On Tue, May 6, 2014 at 6:16

Re: [lxc-users] Memory limit fails in Ubuntu Server

2014-05-09 Thread Serge Hallyn
Quoting CDR (vene...@gmail.com): I just tested and in fact, the memory restriction does not work. a) set a 5G limit for the container b) started the container c) gave 16 G memory to mysql But did it actually fill up the memory? What is memory.max_usage_in_bytes showing? D) restarted mysql

Re: [lxc-users] Ubuntu Server LXC networking Problem

2014-05-09 Thread Serge Hallyn
Quoting CDR (vene...@gmail.com): Does anybody know where in Canonical I may get support for LXC bridged-NAT networking? If the box is multihomed, it does not work.Although only one of the NICs has an IP address, it simply cannot route packets to the network. You may ping the default gateway,

Re: [lxc-users] using LXC opensrc

2014-05-09 Thread Serge Hallyn
Quoting Rama Srinivas (ramasrini...@gmail.com): Hi , How to use this library. As per Readme , builiding the library and tools is OK. But How to build tests ? You need to add --enable-tests to the configure flags for tests to build. Also in the lxccontainer.c file , lxcapi_create is

Re: [lxc-users] NUMA and LXC

2014-05-09 Thread Serge Hallyn
lxc.cgroup.cpuset.mems = 1 Quoting CDR (vene...@gmail.com): I think we need to add a configuration to the global lxc.conf whereas any given container may run only on one NUMA node, and if that is not possible, it should not even start. The performance for a container that is contained, so

Re: [lxc-users] NUMA and LXC

2014-05-09 Thread Serge Hallyn
the handle on LXC On Fri, May 9, 2014 at 12:46 PM, Serge Hallyn serge.hal...@ubuntu.com wrote: lxc.cgroup.cpuset.mems = 1 Quoting CDR (vene...@gmail.com): I think we need to add a configuration to the global lxc.conf whereas any given container may run only on one NUMA node

Re: [lxc-users] Howto/Tutorial wanted: Running an application inside a container

2014-05-10 Thread Serge Hallyn
Quoting Johannes Kastl (m...@ojkastl.de): -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi everyone, I thought running a single application inside a container was one of the main advantages of lxc over 'full'virtualization like KVM. But it seems I fail to find a nice tutorial how to do

Re: [lxc-users] Question about Ubuntu Server

2014-05-11 Thread Serge Hallyn
Quoting Fajar A. Nugraha (l...@fajar.net): On Mon, May 12, 2014 at 5:26 AM, CDR vene...@gmail.com wrote: let me try that setup. I am a few hours from installing Fedora 20, but, hey, I hate to give up. If you simply need a GUI, the EASIEST method by far is to: - install xubuntu-desktop on

Re: [lxc-users] lxc-1.0.3: lxc-start gets stuck

2014-05-13 Thread Serge Hallyn
Quoting Harald Dunkel (harald.dun...@aixigo.de): Hi folks, Using the HEAD of the stable-1.0 branch: Sometimes lxc-start gets stuck. I haven't found a reliable way to reproduce this (yet), but it seems to be related to starting and stopping a lot of almost identical LXCs in parallel

Re: [lxc-users] Starting Stoping groups of containers

2014-05-14 Thread Serge Hallyn
Quoting Marcel Sánchez Toledano (marcelsanch...@gmail.com): Hi again, I have created some containers with the this option in the config file: lxc.group = scenario1 But I can't find the way to stop, start or destroy all the containers at the same time by group. Is this possible? Or I

Re: [lxc-users] running various (mismatching) distributions in lxc

2014-05-14 Thread Serge Hallyn
Quoting Tomas Vondra (t...@fuzzy.cz): Hi all, lxc-newbie here. I'm learning about lxc for a few days, and one of the things that caught my eye is the possibility to run various mismatching distributions. For example Gentoo container on a CentOS host, and so on. The docs I found (e.g. the

Re: [lxc-users] Fedora container thinks it is not running

2014-05-15 Thread Serge Hallyn
Quoting Michael H. Warfield (m...@wittsend.com): On Thu, 2014-05-15 at 22:04 +0700, Fajar A. Nugraha wrote: On Thu, May 15, 2014 at 9:06 PM, Michael H. Warfield m...@wittsend.com wrote: On Thu, 2014-05-15 at 04:40 -0400, CDR wrote: The container is started,

Re: [lxc-users] cloning could be improved

2014-05-16 Thread Serge Hallyn
Quoting CDR (vene...@gmail.com): The cloning app should intelligently change the mount points to match the new container's directory. For example, this is the original mount lxc.mount.entry = /usr/src /var/lib/lxc/container-35/rootfs/usr/src none bind 0 0 The config entry should be:

Re: [lxc-users] multi unprivileged containers running tomcat7

2014-05-18 Thread Serge Hallyn
Quoting Morten Steffensen (mst...@emercos.com): Hello, I am trying to run multi unprivileged containers each with tomcat7. I have made one container and cloned it. When starting the second container i get command get_cgroup failed to receive response. If i stop the first, I can successfully

Re: [lxc-users] multi unprivileged containers running tomcat7

2014-05-19 Thread Serge Hallyn
Quoting Morten Steffensen (mst...@emercos.com): This is how i created the containers: Aha, thanks. host: ubuntu 14.04 minimal rootapt-get install lxc rootgroupadd lxc-adm (groupid 1000) rootadduser --gid 1000 --home /home/lxcuser lxcuser rootecho lxcuser veth lxcbr0 2 | tee -a

Re: [lxc-users] We need a lxc-top utility

2014-05-21 Thread Serge Hallyn
Quoting CDR (vene...@gmail.com): Wrong, that RPM was in Fedora, in Ubuntu I connected to a repository. But lxc-top is not there. How do I get that utility? sudo apt-get install lua-lxc Yeah that really should be more discoverable... ___ lxc-users

Re: [lxc-users] venet like networking in LXC possible ?

2014-05-22 Thread Serge Hallyn
Quoting Marc MAURICE (marc.maur...@objectif-libre.com): Hi, thanks a lot for your answers. well ... nothing outside the server should even know about the container's MAC address. Because if the network setup is the same as mine, then the provider's router would route all traffic for the

Re: [lxc-users] We need a lxc-top utility

2014-05-22 Thread Serge Hallyn
+, Serge Hallyn wrote: Quoting CDR (vene...@gmail.com): Wrong, that RPM was in Fedora, in Ubuntu I connected to a repository. But lxc-top is not there. How do I get that utility? sudo apt-get install lua-lxc Yeah that really should be more discoverable... Note

Re: [lxc-users] Unprivileged container file permissions

2014-05-24 Thread Serge Hallyn
Quoting Mahmood (mahm...@circleci.com): Hi, I'm trying to use unprivileged containers that are inaccessible by other user in a shared environment. Setting container path to 550 seems to block lxc-start. What are the minimal permissions that I need to set on the directory so lxc-start can

Re: [lxc-users] apparmor profile for systemd containers (WAS: Fedora container thinks it is not running)

2014-05-28 Thread Serge Hallyn
Quoting Fajar A. Nugraha (l...@fajar.net): (changed subject to match content) On Tue, May 27, 2014 at 11:10 PM, Michael H. Warfield m...@wittsend.com wrote: On Tue, 2014-05-27 at 15:33 +0700, Fajar A. Nugraha wrote: On further test, this seems enough ### # cat

Re: [lxc-users] apparmor profile for systemd containers (WAS: Fedora container thinks it is not running)

2014-05-28 Thread Serge Hallyn
Quoting Fajar A. Nugraha (l...@fajar.net): On Thu, May 29, 2014 at 5:08 AM, Serge Hallyn serge.hal...@ubuntu.comwrote: would systemd be happy with it being mounted by lxc using an lxc.mount.entry? I think that would be preferable to relaxing the apparmor policy. i.e. lxc.mount.entry

Re: [lxc-users] apparmor profile for systemd containers (WAS: Fedora container thinks it is not running)

2014-05-29 Thread Serge Hallyn
Quoting Fajar A. Nugraha (l...@fajar.net): On Thu, May 29, 2014 at 10:58 AM, Serge Hallyn serge.hal...@ubuntu.comwrote: Quoting Fajar A. Nugraha (l...@fajar.net): On Thu, May 29, 2014 at 5:08 AM, Serge Hallyn serge.hal...@ubuntu.com wrote: would systemd be happy with it being mounted

Re: [lxc-users] apparmor profile for systemd containers (WAS: Fedora container thinks it is not running)

2014-05-29 Thread Serge Hallyn
Quoting Christian Seiler (christ...@iwakd.de): Hi, ### lxc-start output 30systemd[1]: Starting Root Slice. 27systemd[1]: Caught SEGV, dumped core as pid 12. 30systemd[1]: Freezing execution. ### Hm, that's unfortunate. I thought lxc.mount.auto = cgroup:mixed with cgfs would

Re: [lxc-users] zombie process blocks stopping of container

2014-06-03 Thread Serge Hallyn
Quoting Stéphane Graber (stgra...@ubuntu.com): On Tue, Jun 03, 2014 at 04:56:03PM +0200, Tamas Papp wrote: On 06/03/2014 04:50 PM, Stéphane Graber wrote: lxc-stop will send SIGPWR (or the equivalent signal) to the container, wait 30s then SIGKILL init. lxc-stop -k will skip the SIGPWR

Re: [lxc-users] Possible race condition in kernel, capset() fails randomly

2014-06-03 Thread Serge Hallyn
Quoting Vladimir Pouzanov (farcal...@gmail.com): This bug happens with docker, but I don't see any traction on my issue over there so trying to escalate further. The original bug report is here: https://github.com/dotcloud/docker/issues/4556, here are all the interesting details. I'm

Re: [lxc-users] Possible race condition in kernel, capset() fails randomly

2014-06-03 Thread Serge Hallyn
://gist.github.com/farcaller/6fd5b23952675aed894d it doesn't seem to run ./dockerinit in case of failure. On Tue, Jun 3, 2014 at 8:14 PM, Serge Hallyn serge.hal...@ubuntu.com wrote: Quoting Vladimir Pouzanov (farcal...@gmail.com): This bug happens with docker, but I don't see any traction on my

Re: [lxc-users] About creating a BTRFS file instead of a BTRFS partition

2014-06-04 Thread Serge Hallyn
Quoting Marcel Sánchez Toledano (marcelsanch...@gmail.com): Partially yes. Thanks for that. Maybe is a bit offtopic, but.. Do you know any manual or website where I can found information about creating a image file with BRTFS? I have tried with no luck... If you want a loopback file, you

Re: [lxc-users] About creating a BTRFS file instead of a BTRFS partition

2014-06-04 Thread Serge Hallyn
/create-linux-loopback-file-system-on-disk-file/, but with btrfs instead of ext3) and then: lxc-create -n template -t ubuntu -B btrfs and specifing in lxc.rootfs the path mnt/vfs, for example. Is that correct? *Marcel Sánchez Toledano* 2014-06-04 15:15 GMT+02:00 Serge Hallyn

Re: [lxc-users] Unprivileged container and multiple/external users

2014-06-04 Thread Serge Hallyn
Quoting Andre Nathan (an...@digirati.com.br): Hello I'm currently running in production a pre-1.0 LXC version. These run a minimum number of processes as root and a bunch of processes running as a normal user (eg. apache, cron, syslog-ng). Most container directories are bind-mounted from

Re: [lxc-users] getting started; how to add a block device to my container

2014-06-11 Thread Serge Hallyn
Quoting Steven Howe (howe.ste...@gmail.com): I have tried adding lxc.cgroup.device.allow = b 8:17 rwm to the config file, but that doesn't work. What do you mean by doesn't work? Are you not allowed to create the device node? (mknod /dev/sdb1 b 8 17) Also the time in the

Re: [lxc-users] FUSE in an unprivileged container

2014-06-12 Thread Serge Hallyn
Quoting Ivan Ogai (i...@wikical.com): Hi, in an unprivileged container set up following the instructions at https://www.stgraber.org/2014/01/17/lxc-1-0-unprivileged-containers and having Ubuntu 14.04 as host, I'm trying to install the Wuala client (a software which mounts a remote directory

[lxc-users] userns tutorial

2014-06-12 Thread Serge Hallyn
Hey everyone, sorry for the short notice, should have thought of this before. I will be doing a bit of a walk-through on user namespaces in a bit over 30 minutes, at http://summit.ubuntu.com/uos-1406/meeting/22274/lxc-user-namespace-tutorial/ You can always watch it later, but if you join

Re: [lxc-users] veth networking and bridges in namespaces

2014-06-16 Thread Serge Hallyn
Quoting Michael Drüing (mich...@drueing.de): Hi, I’m trying to use lxc to simulate networks with dynamips. To do that I create one bridge device for each network I want to simulate, and I have a template which sets up a dynamips container and connects it to these bridge devices However,

Re: [lxc-users] The purpose of init.lxc.static

2014-06-18 Thread Serge Hallyn
Quoting Stéphane Graber (stgra...@ubuntu.com): On Wed, Jun 18, 2014 at 12:19:14AM -0400, Leonid Isaev wrote: Hi, I couldn't find anything in the mailing lists and the commit message (in commit 2d4b3e3) is rather terse. So, I wonder in which scenarios and why init.lxc.static is

Re: [lxc-users] setting persistant IP address based on domain.

2014-06-20 Thread Serge Hallyn
Quoting Serge Hallyn (serge.hal...@ubuntu.com): Quoting Shidan (shi...@gmail.com): In the ubuntu docs (https://help.ubuntu.com/lts/serverguide/lxc.html), it says that to set a persistant IP address for containers you can add the following to /etc/lxc/dnsmasq.conf dhcp-host=lxcmail

Re: [lxc-users] Unprivileged container and multiple/external users

2014-06-25 Thread Serge Hallyn
Quoting Andre Nathan (an...@digirati.com.br): Serge, On 06/04/2014 05:54 PM, Serge Hallyn wrote: Quoting Andre Nathan (an...@digirati.com.br): Is there any way around that? Maybe some mount option to map the mount point's UID and GID to something different inside the container? Not yet

Re: [lxc-users] NATed container routing

2014-06-25 Thread Serge Hallyn
Quoting Raymond Jender (ray...@yahoo.com): I made a mistake in explaining my routing issue. I have since added another container.  Each of the two containers can ping each other.  Each of the containers can ping the host. The host can ping either container. The containers can ping other

Re: [lxc-users] Difference in using network namespace via ip command and lxc

2014-06-27 Thread Serge Hallyn
Quoting Ajith Adapa (ajith.ad...@gmail.com): Hi, I am quite new to network namespaces and just making my hands dirty using ip command to create network namespaces. As per the man page for ip command By convention a named network namespace is an object at

Re: [lxc-users] Difference in using network namespace via ip command and lxc

2014-06-30 Thread Serge Hallyn
a namespace without binding it to a process then ? On Fri, Jun 27, 2014 at 10:49 PM, Serge Hallyn serge.hal...@ubuntu.com wrote: Quoting Ajith Adapa (ajith.ad...@gmail.com): Hi, I am quite new to network namespaces and just making my hands dirty using ip command to create network

Re: [lxc-users] lxc-start failing in Fedora 20

2014-06-30 Thread Serge Hallyn
Quoting Michael H. Warfield (m...@wittsend.com): On Sat, 2014-06-28 at 20:12 +0530, Ajith Adapa wrote: Thanks @Michael I am running lxc 1.0.3 version in rawhide. Ah. Ok... Understand that lxc-autostart is not fully functional in 1.0.3 and will not autoboot containers on host boot.

Re: [lxc-users] adding lxc containers to local DNS

2014-07-02 Thread Serge Hallyn
Quoting Bill Smith (william.m.sm...@gmail.com): On Centos and/or Ubuntu, is there a way to configure the host's DNS so that the containers mapped in dnsmasq.leases are resolvable by nslookup? I know I could get there by assigning static IPs and adding them to /etc/hosts. I'm wondering

Re: [lxc-users] Setting user environment for unprivileged containers

2014-07-03 Thread Serge Hallyn
Quoting Christoph Willing (chris.will...@iinet.net.au): I'm trying to make unprivileged containers work nicely on Slackware - with some success. After some updates (kernel config, latest shadow, latest lxc, install cgmanager) I worked through steps at

Re: [lxc-users] zfs snapshot point

2014-07-07 Thread Serge Hallyn
Quoting Chris Burroughs (chris.burrou...@gmail.com): Currently when using lxc-snapshot the snapshot point is the rootfs dataset. (so something like /lxc/foo/rootfs) I'm trying to understand why the dataset doesn't also include the config file (so /lxc/foo/). Isn't that file also needed to

  1   2   3   4   5   6   >