On Fri, Jul 26, 2013 at 05:16:16PM +0200, Kay Sievers wrote: > On Fri, Jul 26, 2013 at 5:09 PM, Rob Spanton <rspan...@zepler.net> wrote: > > I would like to run some processes inside a container that interact with > > udev. Ideally udev would be within the same container as those > > processes, as then I could also have udev rules that started other > > things within that container too... > > > > However, as far as I can tell, it's not possible to run udev within a > > container -- is this correct? Is there a magical workaround that I > > haven't found!? > > There is no real support to run udev inside a container. It might be > possible to hack around that, but it's nothing that seems convincing > so far. We just run containers without any udev setup, but with a > minimal pre-setup /dev.
Furthermore, in the absence of any "devices" namespace in the kernel, it would be a security flaw to allow a process inside the container (whether udevd or something else) the permission to mknod. So you must always pre-populate /dev and remove CAP_MKNOD instead of running udev, if you want any security. Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :| _______________________________________________ systemd-devel mailing list systemd-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/systemd-devel
