proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-15 13:47:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

container start: unshare cgns when possible

Browse Source 
We'll probably want to make this configurable with a
lxc.cgroupns = [1|0], but for now just always do it.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

---
Changelog 20160104: only try to unshare if /proc/self/ns/cgroup exists.
This commit is contained in:
Serge Hallyn 2015-11-09 17:55:54 -06:00
parent 8b5fb7f3d8
commit 12983ba458
4 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/lxc/namespace.h
View File

@ -34,6 +34,9 @@
#ifndef CLONE_NEWNS #ifndef CLONE_NEWNS
# define CLONE_NEWNS 0x00020000 # define CLONE_NEWNS 0x00020000
#endif #endif
#ifndef CLONE_NEWCGROUP
# define CLONE_NEWCGROUP 0x02000000
#endif
#ifndef CLONE_NEWUTS #ifndef CLONE_NEWUTS
# define CLONE_NEWUTS 0x04000000 # define CLONE_NEWUTS 0x04000000
#endif #endif

5
src/lxc/start.c
View File

@ -842,6 +842,11 @@ static int do_start(void *data)
if (handler->backgrounded && null_stdfds() < 0) if (handler->backgrounded && null_stdfds() < 0)
goto out_warn_father; goto out_warn_father;
if (cgns_supported() && unshare(CLONE_NEWCGROUP) != 0) {
SYSERROR("Failed to unshare cgroup namespace");
goto out_warn_father;
}
/* after this call, we are in error because this /* after this call, we are in error because this
* ops should not return as it execs */ * ops should not return as it execs */
handler->ops->start(handler, handler->data); handler->ops->start(handler, handler->data);

5
src/lxc/utils.c
View File

@ -1185,6 +1185,11 @@ bool file_exists(const char *f)
return stat(f, &statbuf) == 0; return stat(f, &statbuf) == 0;
} }
bool cgns_supported(void)
{
return file_exists("/proc/self/ns/cgroup");
}
/* historically lxc-init has been under /usr/lib/lxc and under /* historically lxc-init has been under /usr/lib/lxc and under
* /usr/lib/$ARCH/lxc. It now lives as $prefix/sbin/init.lxc. * /usr/lib/$ARCH/lxc. It now lives as $prefix/sbin/init.lxc.
*/ */

1
src/lxc/utils.h
View File

@ -273,6 +273,7 @@ int detect_shared_rootfs(void);
int detect_ramfs_rootfs(void); int detect_ramfs_rootfs(void);
char *on_path(char *cmd, const char *rootfs); char *on_path(char *cmd, const char *rootfs);
bool file_exists(const char *f); bool file_exists(const char *f);
bool cgns_supported(void);
char *choose_init(const char *rootfs); char *choose_init(const char *rootfs);
int print_to_file(const char *file, const char *content); int print_to_file(const char *file, const char *content);
bool switch_to_ns(pid_t pid, const char *ns); bool switch_to_ns(pid_t pid, const char *ns);