GitHub | 4 Sep 20:21 2015

[lxc/lxc] 611118: coverity: avoid use of NULL c1

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 61111832cdfe6393034d93b3b022ecf14966fc61
      https://github.com/lxc/lxc/commit/61111832cdfe6393034d93b3b022ecf14966fc61
  Author: Serge Hallyn <serge.hallyn@...>
  Date:   2015-09-04 (Fri, 04 Sep 2015)

  Changed paths:
    M src/lxc/lxc_destroy.c

  Log Message:
  -----------
  coverity: avoid use of NULL c1

Signed-off-by: Serge Hallyn <serge.hallyn@...>

_______________________________________________
lxc-devel mailing list
lxc-devel <at> lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
GitHub | 4 Sep 20:15 2015

[lxc/lxc] 608e35: coverity: fix mount_entry_create_dir_file

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: 608e356771c86735d9ed502076a00f13f020e9dd
      https://github.com/lxc/lxc/commit/608e356771c86735d9ed502076a00f13f020e9dd
  Author: Serge Hallyn <serge.hallyn@...>
  Date:   2015-09-04 (Fri, 04 Sep 2015)

  Changed paths:
    M src/lxc/conf.c

  Log Message:
  -----------
  coverity: fix mount_entry_create_dir_file

First, fix use of uninitialized variable 'ret'.  Then, actually use
the value it returned in its caller.

Signed-off-by: Serge Hallyn <serge.hallyn@...>

_______________________________________________
lxc-devel mailing list
lxc-devel <at> lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
Serge Hallyn | 3 Sep 22:24 2015

[PATCH] Add a nesting.conf which can be included to support nesting containers (v2)

Newer kernels have added a new restriction:  if /proc or /sys on the
host has files or non-empty directories which are over-mounted, and
there is no /proc which fully visible, then it assumes there is a
"security" reason for this.  It prevents anyone in a non-initial user
namespace from creating a new proc or sysfs mount.

To work around this, this patch adds a new 'nesting.conf' which can be
lxc.include'd from a container configuration file.  It adds a
non-overmounted mount of /proc and /sys under /dev/.lxc, so that the
kernel can see that we're not trying to *hide* things like /proc/uptime.
and /sys/devices/virtual/net.  If the host adds this to the config file
for container w1, then container w1 will support unprivileged child
containers.

The nesting.conf file also sets the apparmor profile to the with-nesting
variant, since that is required anyway.  This actually means that
supporting nesting isn't really more work than it used to be, just
different.  Instead of adding

lxc.aa_profile = lxc-container-default-with-nesting

you now just need to

lxc.include = /usr/share/lxc/config/nesting.conf

(Look, fewer characters :)

Finally, in order to maintain the current apparmor protections on
proc and sys, we make /dev/.lxc/{proc,sys} non-read/writeable.
We don't need to be able to use them, we're just showing the
(Continue reading)

Serge Hallyn | 3 Sep 22:11 2015

[PATCH] Add a nesting.conf which can be included to support nesting containers

Newer kernels have added a new restriction:  if /proc or /sys on the
host has files or non-empty directories which are over-mounted, and
there is no /proc which fully visible, then it assumes there is a
"security" reason for this.  It prevents anyone in a non-initial user
namespace from creating a new proc or sysfs mount.

To work around this, this patch adds a new 'nesting.conf' which can be
lxc.include'd from a container configuration file.  It adds a
non-overmounted mount of /proc and /sys under /dev/.lxc, so that the
kernel can see that we're not trying to *hide* things like /proc/uptime.
and /sys/devices/virtual/net.  If the host adds this to the config file
for container w1, then container w1 will support unprivileged child
containers.

The nesting.conf file also sets the apparmor profile to the with-nesting
variant, since that is required anyway.  This actually means that
supporting nesting isn't really more work than it used to be, just
different.  Instead of adding

lxc.aa_profile = lxc-container-default-with-nesting

you now just need to

lxc.include = /usr/share/lxc/config/nesting.conf

(Look, fewer characters :)

Finally, in order to maintain the current apparmor protections on
proc and sys, we make /dev/.lxc/{proc,sys} non-read/writeable.
We don't need to be able to use them, we're just showing the
(Continue reading)

GitHub | 3 Sep 18:58 2015

[lxc/lxc] ce5782: Tear down network devices during container halt

  Branch: refs/heads/master
  Home:   https://github.com/lxc/lxc
  Commit: ce5782df8fa0fada0396ec69f5fe05745cb942be
      https://github.com/lxc/lxc/commit/ce5782df8fa0fada0396ec69f5fe05745cb942be
  Author: Major Hayden <major@...>
  Date:   2015-09-03 (Thu, 03 Sep 2015)

  Changed paths:
    M src/lxc/start.c

  Log Message:
  -----------
  Tear down network devices during container halt

On very busy systems, some virtual network devices won't be destroyed after a
container halts.  This patch uses the lxc_delete_network() method to ensure
that network devices attached to the container are destroyed when the
container halts.

Without the patch, some virtual network devices are left over on the system
and must be removed with `ip link del <device>`.  This caused containers
with lxc.network.veth.pair to not be able to start.  For containers using
randomly generated virtual network device names, the old devices will hang
around on the bridge with their original MAC address.

Signed-off-by: Major Hayden <major@...>

  Commit: 2c5bcd3a53a1772e74a8991b592a170fcd65702e
      https://github.com/lxc/lxc/commit/2c5bcd3a53a1772e74a8991b592a170fcd65702e
  Author: Stéphane Graber <stgraber@...>
(Continue reading)

Major Hayden | 1 Sep 14:37 2015
Picon

lxc-stop doesn't always clean up veth interfaces

Hey there,

I'm seeing a strange issue on Ubuntu 14.04 with LXC 1.0.7 and 1.1.3.  We run quite a few LXC containers on a host
and they all have at least two veth interfaces.  Each of those veth interfaces is on a separate bridge.  For
example, a container has an eth0 interface on bridge1 and has an eth1 interface on bridge2.

When we stop containers gently using `lxc-stop -n <container>`, we've found that veths aren't always
cleaned up.  Our hosts run 20+ containers and we're left with 2-5 dangling veth interfaces after stopping
all containers on the host.  Some of those veths will disappear after some time (usually 30-120 seconds)
but some will hang around until we forcefully delete them with `ip link del <interface>`.

However, if we stop the containers with `lxc-stop -k -n <container>`, the veths are *always* cleaned up properly.

The dangling veths have no IP address assigned to them, but the MAC address is still present.  I'm able to run
tcpdump on the dangling veths and I see traffic from the connected bridge.

So far, I've replicated this problem on Ubuntu 14.04 with LXC 1.0.7 and 1.1.3.  It shows up in kernels 3.13.0
and 3.16.x.  Is there something else I should be looking at to reduce this bug?

Thanks!

--
Major Hayden
_______________________________________________
lxc-devel mailing list
lxc-devel <at> lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
Sungbae Yoo | 1 Sep 12:12 2015

[PATCH] doc: Update Korean lxc-snapshot(1) for newname option

Update for commit dedd4f6

Signed-off-by: Sungbae Yoo <sungbae.yoo <at> samsung.com>
---
 doc/ko/lxc-snapshot.sgml.in | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/doc/ko/lxc-snapshot.sgml.in b/doc/ko/lxc-snapshot.sgml.in
index ac07970..ec7a628 100644
--- a/doc/ko/lxc-snapshot.sgml.in
+++ b/doc/ko/lxc-snapshot.sgml.in
 <at>  <at>  -72,7 +72,7  <at>  <at>  by Sungbae Yoo <sungbae.yoo at samsung.com>
       <command>lxc-snapshot</command>
       <arg choice="req">-n, --name <replaceable>name</replaceable></arg>
       <arg choice="req">-r, -restore <replaceable>snapshot-name</replaceable></arg>
-      <arg choice="opt"> <replaceable> newname</replaceable></arg>
+      <arg choice="opt">-N, --newname <replaceable>newname</replaceable></arg>
     </cmdsynopsis>
   </refsynopsisdiv>

 <at>  <at>  -164,14 +164,14  <at>  <at>  by Sungbae Yoo <sungbae.yoo at samsung.com>
 	  </varlistentry>

 	  <varlistentry>
-	    <term> <option>newname</option> </term>
+	    <term> <option>-N, --newname</option> </term>
 	   <listitem>
-	    <para>
-              <!--
-                  When restoring a snapshot, the last optional argument is the name to use for the restored container.  If no
(Continue reading)

Sungbae Yoo | 1 Sep 10:45 2015

[PATCH] doc: Add lxc.init_(uid|gid) in Korean lxc.container.conf(5)

update for commit dbca923

Signed-off-by: Sungbae Yoo <sungbae.yoo <at> samsung.com>
---
 doc/ko/lxc.container.conf.sgml.in | 48 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/doc/ko/lxc.container.conf.sgml.in b/doc/ko/lxc.container.conf.sgml.in
index ba015af..b305680 100644
--- a/doc/ko/lxc.container.conf.sgml.in
+++ b/doc/ko/lxc.container.conf.sgml.in
 <at>  <at>  -321,6 +321,54  <at>  <at>  by Sungbae Yoo <sungbae.yoo at samsung.com>
     </refsect2>

     <refsect2>
+      <title><!-- Init ID -->Init이 사용할 ID</title>
+      <para>
+        <!--
+        Sets the UID/GID to use for the init system, and subsequent command, executed by lxc-execute.
+        -->
+        lxc-execute가 실행하는 컨테이너의 init 및 명령어가 사용할 UID/GID를 지정한다.
+
+        <!--
+        These options are only used when lxc-execute is started in a private user namespace.
+        -->
+        이 옵션들은 lxc-execute가 사용자 네임스페이스 안에서 실행될 때만 적용된다.
+
+        <!--
+        Defaults to: UID(0), GID(0)
+        -->
(Continue reading)

Sungbae Yoo | 1 Sep 09:58 2015

[PATCH] doc: Update Korean lxc.cgroup.use in lxc.system.conf(5)

Update for commit 2d8632d

Signed-off-by: Sungbae Yoo <sungbae.yoo <at> samsung.com>
---
 doc/ko/lxc.system.conf.sgml.in | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/doc/ko/lxc.system.conf.sgml.in b/doc/ko/lxc.system.conf.sgml.in
index 3f9c7dd..ea8451e 100644
--- a/doc/ko/lxc.system.conf.sgml.in
+++ b/doc/ko/lxc.system.conf.sgml.in
 <at>  <at>  -119,11 +119,10  <at>  <at>  by Sungbae Yoo <sungbae.yoo at samsung.com>
             <para>
               <!--
               Comma separated list of cgroup controllers to setup.
-              Currently this configration will be ignored when LXC
-              uses cgmanager to manage cgroups.
+              If none is specified, all available controllers will be used.
               -->
               사용할 cgroup 컨트롤러의 쉼표(,)로 구분된 목록.
-              현재 LXC가 cgmanager를 사용하여 cgroup을 관리하고 있을 경우, 이 설정은 무시된다.
+              아무것도 지정하지 않았다면, 사용가능한 컨트롤러 전체를 사용될 것이다.
             </para>
           </listitem>
         </varlistentry>
--

-- 
1.9.1

_______________________________________________
lxc-devel mailing list
(Continue reading)

Sungbae Yoo | 1 Sep 09:56 2015

[PATCH] doc: Add the rename option to lxc-clone(1) in Korean manual

Update for commit 585f3c6

Signed-off-by: Sungbae Yoo <sungbae.yoo <at> samsung.com>
---
 doc/ko/lxc-clone.sgml.in | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/doc/ko/lxc-clone.sgml.in b/doc/ko/lxc-clone.sgml.in
index a9c3bd5..c5f6766 100644
--- a/doc/ko/lxc-clone.sgml.in
+++ b/doc/ko/lxc-clone.sgml.in
 <at>  <at>  -64,6 +64,7  <at>  <at>  by Sungbae Yoo <sungbae.yoo at samsung.com>
       <arg choice="opt">-L <replaceable>fssize</replaceable></arg>
       <arg choice="opt">-p <replaceable>lxcpath</replaceable></arg>
       <arg choice="opt">-P <replaceable>newlxcpath</replaceable></arg>
+      <arg choice="opt">-R </arg>
       <arg choice="req">-o <replaceable>orig</replaceable></arg>
       <arg choice="req">-n <replaceable>new</replaceable></arg>
       <arg choice="opt">-- hook arguments</arg>
 <at>  <at>  -78,6 +79,7  <at>  <at>  by Sungbae Yoo <sungbae.yoo at samsung.com>
       <arg choice="opt">-L <replaceable>fssize</replaceable></arg>
       <arg choice="opt">-p <replaceable>lxcpath</replaceable></arg>
       <arg choice="opt">-P <replaceable>newlxcpath</replaceable></arg>
+      <arg choice="opt">-R </arg>
       <arg choice="req">orig</arg>
       <arg choice="req">new</arg>
       <arg choice="opt">-- hook arguments</arg>
 <at>  <at>  -267,6 +269,22  <at>  <at>  by Sungbae Yoo <sungbae.yoo at samsung.com>

       <varlistentry>
(Continue reading)

Sungbae Yoo | 1 Sep 10:02 2015

[PATCH] doc: Add LXC-specific mount option in Korean lxc.container.conf(5)

Update for commit f5b67b3

Signed-off-by: Sungbae Yoo <sungbae.yoo <at> samsung.com>
---
 doc/ko/lxc.container.conf.sgml.in | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/doc/ko/lxc.container.conf.sgml.in b/doc/ko/lxc.container.conf.sgml.in
index 1781d33..ba015af 100644
--- a/doc/ko/lxc.container.conf.sgml.in
+++ b/doc/ko/lxc.container.conf.sgml.in
 <at>  <at>  -1021,6 +1021,16  <at>  <at>  proc proc proc nodev,noexec,nosuid 0 0
 	      fstab format.
               -->
               fstab의 형식으로, 한 줄당 마운트 포인트 하나를 지정한다.
+
+              <!--
+	      Moreover lxc add two options to mount.
+              <option>optional</option> don't fail if mount does not work.
+              <option>create=dir</option> or <option>create=file</option>
+              to create dir (or file) when the point will be mounted.
+              -->
+              또한 마운트 옵션에 아래 2가지 옵션을 추가적으로 사용할 수 있다. 이는 LXC
자체적으로 사용하는 옵션이다.
+              <option>optional</option>은 마운트를 못하더라도, 실패로 처리하지 않게 한다.
+              <option>create=dir</option>와 <option>create=file</option>는 마운트할 때,
디렉토리(dir) 또는 파일(file)을 생성한다.
 	    </para>
 	  </listitem>
 	</varlistentry>
(Continue reading)


Gmane