Re: [systemd-devel] Users and system namespaces

2014-01-24 Thread Lennart Poettering
On Fri, 24.01.14 11:27, Ben Boeckel (maths...@gmail.com) wrote: > > On Fri, Jan 24, 2014 at 11:07:18 +0100, Lennart Poettering wrote: > > On Thu, 23.01.14 13:54, Ben Boeckel (maths...@gmail.com) wrote: > > > As I mused on LWN[1] recently, I was wondering whether it was possible > > > to have user

Re: [systemd-devel] Users and system namespaces

2014-01-24 Thread Ben Boeckel
On Fri, Jan 24, 2014 at 11:07:18 +0100, Lennart Poettering wrote: > On Thu, 23.01.14 13:54, Ben Boeckel (maths...@gmail.com) wrote: > > As I mused on LWN[1] recently, I was wondering whether it was possible > > to have user units be able to hook into namespaces (namely the > > PrivateNetwork= and P

Re: [systemd-devel] Users and system namespaces

2014-01-24 Thread Lennart Poettering
On Thu, 23.01.14 13:54, Ben Boeckel (maths...@gmail.com) wrote: > Hi, > > As I mused on LWN[1] recently, I was wondering whether it was possible > to have user units be able to hook into namespaces (namely the > PrivateNetwork= and PrivateTmp= from systemd.exec(5) and more if other > namespacing

Re: [systemd-devel] Users and system namespaces

2014-01-23 Thread Ben Boeckel
On Thu, Jan 23, 2014 at 13:21:30 -0800, David Timothy Strauss wrote: > I think the intention for your needs (a lot of namespace sharing for a > family of services) would be to run another systemd in a namespece > using something like systemd-nspawn, libvirt-lxc, LXC, a user session, > or similar. B

Re: [systemd-devel] Users and system namespaces

2014-01-23 Thread David Timothy Strauss
I think the intention for your needs (a lot of namespace sharing for a family of services) would be to run another systemd in a namespece using something like systemd-nspawn, libvirt-lxc, LXC, a user session, or similar. Basically, a systemd instance would run in the namespace itself. Is that a pro

Re: [systemd-devel] Users and system namespaces

2014-01-23 Thread Ben Boeckel
On Thu, Jan 23, 2014 at 11:43:52 -0800, David Timothy Strauss wrote: > To join a namespace, you'll need a file descriptor for the namespace > so you can run setns() [1]. It's possible to share a file descriptor > by keeping it open while forking (which is how socket activation > works) or passing i

Re: [systemd-devel] Users and system namespaces

2014-01-23 Thread David Timothy Strauss
To join a namespace, you'll need a file descriptor for the namespace so you can run setns() [1]. It's possible to share a file descriptor by keeping it open while forking (which is how socket activation works) or passing it over a Unix domain socket [2]. I know this doesn't really answer your ques

[systemd-devel] Users and system namespaces

2014-01-23 Thread Ben Boeckel
Hi, As I mused on LWN[1] recently, I was wondering whether it was possible to have user units be able to hook into namespaces (namely the PrivateNetwork= and PrivateTmp= from systemd.exec(5) and more if other namespacing options are added in the future). I'm assuming that is not possible now to u