[Touch-packages] [Bug 1843490] Re: lxc.cgroup.devices.allow prevents unprivileged container from starting

2019-09-22 Thread linas
So is there a workaround? In my case, I'm trying to access an OpenCL gpu from a userland container. I was assuming that the below might be enough. lxc.mount.entry = /dev/dri/card1 dev/dri/card1 none bind,optional,create=file lxc.mount.entry = /dev/dri/renderD128 dev/dri/renderD128 none

[Touch-packages] [Bug 1843490] Re: lxc.cgroup.devices.allow prevents unprivileged container from starting

2019-09-10 Thread Stéphane Graber
"lxc.cgroup.devices" is meaningless for unprivileged containers as those can never create those devices anyway, so they'll only ever have access to whatever devices lxc provides and nothing more. All our own default configs specifically do not set that cgroup controller for unprivileged