** Changed in: nova-lxd (Ubuntu Xenial)
Status: New => Triaged
** Changed in: nova-lxd (Ubuntu Yakkety)
Status: New => Triaged
** Changed in: nova-lxd (Ubuntu Zesty)
Status: New => Triaged
** Changed in: nova-lxd
Status: In Progress => Fix Released
** Changed in: charm-lxd
Status: Fix Committed => Fix Released
** Changed in: cloud-archive/mitaka
Status: Fix Committed => Triaged
** Changed in: cloud-archive/newton
Status: Fix Committed => Triaged
** Changed in: cloud-archive/ocata
Status: New => Triaged
** Description changed:
- LXD 2.0.6 supports use of distinct sub-uid/gid for each running
- container; nova-lxd has support for this upstream in all stable and
- master branches so we should update nova-lxd in >= Xenial to support
- this feature.
+ [Impact]
+ By default, all LXD containers will run with the same subuid/subgid range,
which means that if a single container is compromised, all containers on the
same host are potentially compromised as well.
+
+ [Test Case]
+ deploy a nova-lxd based openstack cloud
+ boot multiple instances
+ they all share the same uid/gid mapping within a host
+
+ boot multiple instances with a flavor property of lxd:isolated
+ all containers have different uid/gid mappings within a host
+
+ [Regression Potential]
+ Minimal in nova-lxd itself; we're just adding an additional extra-spec and
tweaking the container profile if the underlying LXD daemon supports the
isolation feature.
+
+ [Original Bug Report]
+ LXD 2.0.6 supports use of distinct sub-uid/gid for each running container;
nova-lxd has support for this upstream in all stable and master branches so we
should update nova-lxd in >= Xenial to support this feature.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1648056
Title:
Support LXD multiple sub-uid mapping
To manage notifications about this bug go to:
https://bugs.launchpad.net/charm-lxd/+bug/1648056/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
