Re: [Lxc-users] RH and clones 6.2, LXC, SElinux and multiple DEVPTS instances

2012-03-07 Thread Mauras Olivier
from the fstab in the /etc directory of the containers, everything magically worked. BR, --ilf On Tue, 2012-03-06 at 10:54 +0100, Mauras Olivier wrote: Hello, I've finally successfully migrated my SMACK setup over SElinux to isolate my containers - Thanks to the folks on #selinux@freenode

[Lxc-users] RH and clones 6.2, LXC, SElinux and multiple DEVPTS instances

2012-03-06 Thread Mauras Olivier
Hello, I've finally successfully migrated my SMACK setup over SElinux to isolate my containers - Thanks to the folks on #selinux@freenode - on a Scientific Linux 6.2 host. (I may share my policy with some details if some of you are interested) So far so good, after loads of hits and misses almost

Re: [Lxc-users] RH and clones 6.2, LXC, SElinux and multiple DEVPTS instances

2012-03-06 Thread Mauras Olivier
this issue a week ago with some of my SL6.2 containers on a fedora 16 host. After removing everything /dev/pts related from the fstab in the /etc directory of the containers, everything magically worked. BR, --ilf On Tue, 2012-03-06 at 10:54 +0100, Mauras Olivier wrote: Hello, I've

Re: [Lxc-users] RH and clones 6.2, LXC, SElinux and multiple DEVPTS instances

2012-03-06 Thread Mauras Olivier
a week ago with some of my SL6.2 containers on a fedora 16 host. After removing everything /dev/pts related from the fstab in the /etc directory of the containers, everything magically worked. BR, --ilf On Tue, 2012-03-06 at 10:54 +0100, Mauras Olivier wrote: Hello, I've

Re: [Lxc-users] RH and clones 6.2, LXC, SElinux and multiple DEVPTS instances

2012-03-06 Thread Mauras Olivier
On Tue, Mar 6, 2012 at 12:13 PM, Ramez Hanna rha...@informatiq.org wrote: On Tue, Mar 6, 2012 at 1:07 PM, Mauras Olivier oliver.mau...@gmail.com wrote: On Tue, Mar 6, 2012 at 11:12 AM, Ramez Hanna rha...@informatiq.org wrote: On Tue, Mar 6, 2012 at 12:06 PM, Iliyan Stoyanov i

Re: [Lxc-users] RH and clones 6.2, LXC, SElinux and multiple DEVPTS instances

2012-03-06 Thread Mauras Olivier
On Tue, Mar 6, 2012 at 1:19 PM, Mauras Olivier oliver.mau...@gmail.comwrote: On Tue, Mar 6, 2012 at 12:13 PM, Ramez Hanna rha...@informatiq.orgwrote: On Tue, Mar 6, 2012 at 1:07 PM, Mauras Olivier oliver.mau...@gmail.com wrote: On Tue, Mar 6, 2012 at 11:12 AM, Ramez Hanna rha

[Lxc-users] [MySQL] Weird performances problem between containers on a same host

2011-08-10 Thread Mauras Olivier
Hello, I have several containers running on a host - ~10 One of them is running a MySQL database. Several of the others are running php code under apache that fetch datas from the database. Host is using eth0, while my containers are on a bridge using eth1, and configured in macvlan bridge mode.

Re: [Lxc-users] Mitigating LXC Container Evasion?

2011-08-03 Thread Mauras Olivier
the documentation if you need to fine tune network accesses. Cheers, Olivier On Wed, Aug 3, 2011 at 7:36 PM, Andre Nathan an...@digirati.com.br wrote: Hi Olivier On Tue, 2011-08-02 at 12:13 +0200, Mauras Olivier wrote: Here's a practical example: # smack_label.py -w -r /srv/lxc/lxc1 lxc1 # echo lxc1

Re: [Lxc-users] Mitigating LXC Container Evasion?

2011-08-02 Thread Mauras Olivier
myself clear enough, Olivier On Mon, Aug 1, 2011 at 2:27 PM, Andre Nathan an...@digirati.com.br wrote: Hi Olivier On Sun, 2011-07-31 at 16:42 +0200, Mauras Olivier wrote: Furthermore system has SMACK enabled - Simplified Mandatory Access Control - a label based MAC. Each LXC container has

Re: [Lxc-users] Mitigating LXC Container Evasion?

2011-07-31 Thread Mauras Olivier
Hello Matthew, Here's an example in on of my containers: root@nasty:~# ps ax PID TTY STAT TIME COMMAND 1 ?Ss 0:13 init [3] 44 ?Ss 0:02 /usr/sbin/syslogd 141 ?Ss 0:00 /usr/sbin/sshd 144 ?S 0:01 /usr/sbin/crond -l6 149 ?

Re: [Lxc-users] LXC on ESXi (help)

2011-05-17 Thread Mauras Olivier
Hello David, As you can see you only force the MAC adress _inside_ the container, on the host the MAC for the veth is out of the bounds for ESX it doesn't seem to like that - At least that's my guess cause i have not been able to make it work correctly with this configuration. First thing to

Re: [Lxc-users] LXC on ESXi (help)

2011-05-17 Thread Mauras Olivier
I tried this way either, but there's two blocking problems with that - At least for me: - Can't use this feature on 2.6.32 kernels - Have to reboot to had a new interface to setup a new container - Yeah the say you want to add up a 11th container ;) Olivier On Tue, May 17, 2011 at 5:36 PM, Ulli

Re: [Lxc-users] Fwd: Container inside an ESX VM

2011-04-27 Thread Mauras Olivier
On Tue, Apr 26, 2011 at 6:03 PM, Mauras Olivier oliver.mau...@gmail.comwrote: On Sat, Apr 23, 2011 at 12:40 PM, Mauras Olivier oliver.mau...@gmail.comwrote: Hi Geordy, Thanks for your reply. The first one is actually already set here. I asked ESX folks to create me my own vswitch

Re: [Lxc-users] Fwd: Container inside an ESX VM

2011-04-26 Thread Mauras Olivier
On Sat, Apr 23, 2011 at 12:40 PM, Mauras Olivier oliver.mau...@gmail.comwrote: Hi Geordy, Thanks for your reply. The first one is actually already set here. I asked ESX folks to create me my own vswitch with promisc mode enabled. I saw the second one coming, but didn't think that could make

Re: [Lxc-users] Fwd: Container inside an ESX VM

2011-04-18 Thread Mauras Olivier
Thanks, help is really appreciated. Cheers, Olivier On Sun, Apr 17, 2011 at 8:39 AM, Geordy Korte gko...@gmail.com wrote: Hi, Thought about it some more and i think it might be an advanced esx feature that restricts this. Basically a couple of adv features block spoofing and mac changes

Re: [Lxc-users] Fwd: Container inside an ESX VM

2011-04-18 Thread Mauras Olivier
later interface get shut down and kernel panic... That's all for today :D On Mon, Apr 18, 2011 at 11:47 AM, Mauras Olivier oliver.mau...@gmail.comwrote: Thanks, help is really appreciated. Cheers, Olivier On Sun, Apr 17, 2011 at 8:39 AM, Geordy Korte gko...@gmail.com wrote: Hi

Re: [Lxc-users] Fwd: Container inside an ESX VM

2011-04-16 Thread Mauras Olivier
On Sat, Apr 16, 2011 at 3:45 PM, Serge Hallyn serge.hal...@canonical.comwrote: As you see in this example, before issuing the network restart, my veth MAC was already higher than the eth0 MAC but the guest hadn't a working network connection. Thanks for the info. After restarting

[Lxc-users] Container inside an ESX VM

2011-04-15 Thread Mauras Olivier
Hello, I'm struggling for two days now with some completely weird network behaviours. My host is a virtual machine hosted on an ESX farm. I planned to deploy several containers on it to achieve various tasks. Host is running Scientific Linux 6 with default kernel (2.6.32), and my container is an

[Lxc-users] ESX VM host and network issues

2011-04-14 Thread Mauras Olivier
Hello, I'm struggling for two days now with some completely weird network behaviours. My host is a virtual machine hosted on an ESX farm. I planned to deploy several containers on it to achieve various tasks. Host is running Scientific Linux 6 with default kernel (2.6.32), and my container is an