Commit Graph

46 Commits

Author SHA1 Message Date
Stéphane Graber
6b3ec35ed9
upstart; Enable lxc-net by default
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2014-02-19 13:46:46 -05:00
Eivind Uggedal
60838413eb gentoo: fix typo in config cross-reference comment
Signed-off-by: Eivind Uggedal <eivind@uggedal.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-02-18 14:22:41 -05:00
Stéphane Graber
a262569cbf
upstart: Fix wrong stderr redirect
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2014-02-18 11:31:48 -05:00
Stéphane Graber
061ba5d071 Add --with-runtime-path to configure
This allows older distros to override /run with whatever their own path
is, mostly useful for old RedHat and possibly Android.

Reported-by: Robert Vogelgesang <vogel@users.sourceforge.net>
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-02-11 18:57:57 -05:00
Serge Hallyn
c08a0b7c4e cgmanager: container-base apparmor abstraction: allow mount move
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2014-02-03 15:17:43 -06:00
Stéphane Graber
b2a3f33ec1 upstart: Make sure FORWARD is allowed for containers
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-01-31 09:14:35 +00:00
Stéphane Graber
705bfae0d8 gentoo: Add basic userns config
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2014-01-28 09:57:46 +00:00
gza
1609f0fbe1 gentoo: fix comments about hardened
Signed-off-by: gza <github.guillaume@zitta.fr>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-01-28 09:57:42 +00:00
gza
cae3584efc gentoo: template rework
Now splited config 2 settings available
* common
** featureful oriented settings
* moresecure
** security oriented

Signed-off-by: gza <github.guillaume@zitta.fr>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-01-28 09:57:39 +00:00
Stéphane Graber
0306de4f28 Add bash auto completion
This adds a basic bash auto-completion profile.

It supports 3 things at this time:
 - Auto-complete of container name (-n or -o)
 - Auto-complete of template name (-t)
 - Auto-complete of state names (-s)

It's configured in a way to be as little disruptive as possible, any
argument that's not explicitly handled by the profile will fallack to
bash's default completion.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-01-22 12:23:08 -05:00
Stéphane Graber
21384986d2
Unset lxc.devttydir for userns CentOS
Without this, the container entirely fails to start.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2014-01-22 11:38:59 -05:00
Michael H. Warfield
1ecee40b7d Update Fedora and CentOS templates for common conf includes.
This updates the Fedora and CentOS templates to utilize a common
included config.  This is largely based on the changes in the Oracle
template with some exceptions.

Dropping of setpcap (present in the Oracle template) is commented out in
the Fedora template.  It seems to cause problems, such as large login
delays with Fedora 20 containers (but not Fedora 19 - strange).

The Fedora template is further modified to disable systemd-journald.service
as it is unnecessary in a container and causes serious problems when
running in a Fedora 20 container.

The Fedora template is also updated to default to Fedora 20 when running
on a non-Fedora host.

Regards,
Mike

Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-01-21 20:25:55 -05:00
Stéphane Graber
87c7e080c8 init: Simplify Makefile somehow
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-01-16 17:49:29 -05:00
Stéphane Graber
8da250dad4 apparmor: Add profiles
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-01-16 17:49:23 -05:00
Stéphane Graber
dc0682900a init: Add upstart jobs and some more changes (v3)
This adds the 3 upstart jobs that we've had in Ubuntu for a while:
 - lxc.conf: Main upstart job, triggers lxc-net.conf based on config
 - lxc-instance.conf: Triggered by lxc.conf for each auto-started container
 - lxc-net.conf: Triggered by lxc.conf, sets up lxcbr0, NAT, mangling, ...

In addition, there are two extra config files in /etc/default:
 - lxc: Allows setting some values like http proxying, disabling autostart, ...
 - lxc-net: Network configuration for the lxcbr0 bridge

This change also disables the sysv script for all distros but Oracle as
the current script won't work on either Ubuntu nor Debian and I suspect
quite a few more distros, so it's not nearly as distro-agnostic as we
thought.

For Debian, only install the upstart jobs and systemd unit.
For Ubuntu, only install the upstart jobs.

This change also moves all the init related stuff to config/init/

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-01-16 17:18:38 -05:00
Stéphane Graber
00fe5e1d19 debian: Switch to config includes
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-01-15 15:57:31 -05:00
Stéphane Graber
0ce2946360 oracle: Fix running template unprivileged
Without this /dev/console won't exist and upstart will fail to start any
job marking as "console output" including the rather important rcS.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-01-15 13:34:08 -05:00
Dwight Engen
9e69977fa6 oracle template: convert to common.conf style
Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-01-15 12:28:55 -05:00
Chris Glass
f4e8a91861 Added a commented squid-deb-proxy hook to ubuntu
Added a commented squid-deb-proxy hook to the common ubuntu config file
as suggested when merging the squid-deb-proxy-client hook.

Signed-off-by: Chris Glass <tribaal@gmail.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-01-15 10:06:04 -05:00
Stéphane Graber
d16079b6cb
ubuntu: Set default hwaddr to match template
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2014-01-14 16:54:07 -05:00
Stéphane Graber
cb13115193
Add minimal userns config for plamo
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2014-01-13 17:06:01 -05:00
KATOH Yasufumi
bf3e09c00e plamo: Update template to use lxc.include and add plamo.common.conf
Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2014-01-13 09:14:04 -06:00
Stéphane Graber
71d3a6590f download: Initial template
This adds a new template called "download". It's a fairly simple
template with a minimal set of dependency which will grab any pre-built
image available on https://images.linuxcontainers.org
Note that the serverside is still work in progress (missing SSL support).

Access is done over https by default with a warning being emitted if
fallback to http was required (may be needed for testing, when behind
proxy and with private servers). All index files and tarballs are
gpg-signed with the default pubkeyid contained in the template itself.

The main benefit of this template is to be entirely
distribution-agnostic, any template that can be integrated with the
server build infrastructure will then work on any LXC machine when using
the download template. This template is also compatible with user
namespaces and will hopefully help widden the number of distros that may
work in unprivileged LXC.

This commit also bundles a small change to the template configs to have
the ubuntu template (used by the download template) to work with
unprivileged LXC.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2014-01-12 19:21:49 -05:00
S.Çağlar Onur
babbea4b30 check pthread_atfork and thread-local storage
Add pthread_atfork check to configure.ac and uses it when necessary,
Introduces tls.m4 macro for checking thread-local storage support, Puts
values array into thread-local storage
(lxc_global_config_value@src/lxc/utils.c), Removes
static_lock/static_unlock from LXC code.

Lastly, it introduces a warning for bionic users about multithreaded
usage of LXC.

(requires 64b1be2903 to be reverted first)

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2014-01-06 09:46:32 -05:00
Stéphane Graber
6472dcc2c9
ubuntu: Add comment about the mounting profile
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-12-09 17:05:26 -05:00
S.Çağlar Onur
d392844188 ubuntu: add comments about running unconfined or nested containers
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-12-09 15:06:59 -05:00
Stéphane Graber
f2a95ee1bf Move some common Ubuntu config
This introduces a new /usr/share/lxc/config directory containing common
configuration snippets.

The two Ubuntu templates are then simplified to just include the
relevant entries avoiding a whole lot of hardcoded cgroup, capabilities
and mount points configuration.

An extra comment is also added at the top of all generated configuration
files telling the user to look at lxc.conf(5) for more information.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2013-12-06 11:21:46 -05:00
Serge Hallyn
3a647d582d configure/makefile: rename default_conf to distro_conf
configure/makefile: rename default_conf to distro_conf, since it is a per-distro
default.  Then we'll be able to use the symbol LXC_DEFAULT_CONF in the code to
refer to the installed file.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-05-31 11:14:26 -05:00
Dwight Engen
bb9702b539 Rename /etc/lxc/lxc.conf to /etc/lxc/default.conf.
This will soon be followed by the introduction of a "real" system wide
/etc/lxc/lxc.conf storing global LXC settings.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
2013-02-06 10:20:29 -05:00
Stéphane Graber
eba7df9ee0 templates: Make generated config consistent
This updates all the templates and the configuration files to consistently
use "key = value" everywhere.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
2012-12-06 00:02:40 -05:00
Stéphane Graber
f79d43bbe7 Remove all trailing whitespaces.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2012-11-26 12:08:13 -05:00
Stéphane Graber
eeb6cb8305 Fix autogen failing because of clean/distclean overrides
A previous patch added a clean/distclean target to config/Makefile.am.
This conflicts with automake's own target.

This change replaces those by a clean-local and distclean-local target.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2012-11-12 14:33:55 -05:00
Dwight Engen
f0e592fc66 Add distro config file /etc/lxc/lxc.conf
[PATCH] Clean the lxc.conf file

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2012-11-12 13:18:32 -05:00
Dwight Engen
6f75ba0bda Add distro config file /etc/lxc/lxc.conf
This allows a distro to put the distro specific default network
configuration (for example bridge device, link type), or other lxc
configuration in the case that -f is not passed by the user to
lxc-create, in which case lxc-create will use the distro conf file as
the basis for the containers config.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2012-11-12 13:18:32 -05:00
David Ward
910bb4fa53 use syscall numbers from Linux kernel headers
__NR_setns is defined in the Linux kernel headers in linux/unistd.h.
The full Linux kernel sources are not necessary for compilation.

Signed-off-by: David Ward <david.ward@ll.mit.edu>
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
2012-05-04 00:50:15 +02:00
Daniel Lezcano
495d6f0b06 fix sparc architecture for autoconf
Reported-by : Denny Schierz <linuxmail@4lin.net>
Signed-off-by: Daniel Lezcano <daniel.lezcano@free.fr>
2012-02-26 10:56:38 +01:00
Kevin Cernekee
c75083d7f3 Add MIPS as a supported architecture
The issue is similar to what was fixed in commit e7eb632c for ARM:
the "configure" script errors out because it is unable to set
LINUX_SRCARCH.  Fix is to add MIPS to the list.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
2012-02-26 00:49:48 +01:00
Serge Hallyn
e7eb632cb4 Add arm as a supported srcarch
Otherwise building on armel fails with

checking for linux SRCARCH... configure: error: architecture arm-unknown-linux-gnueabi not supported

See https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/745884 for details.

Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
2011-07-25 00:22:50 +02:00
Clement Calmels
0f1c997258 generate setns syscall number
Signed-off-by: Clement Calmels <clement.calmels@fr.ibm.com>
Signed-off-by: Cedric Le Goater <clg@fr.ibm.com>
2011-02-01 12:54:17 +01:00
Michel Normand
a040ec723e remove remaining .cvsignore files
Signed-off-by: Michel Normand <michel.mno@free.fr>
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
2010-05-31 11:56:47 +02:00
dlezcano
cf445de362 Check the kernel feature
From: Daniel Lezcano <daniel.lezcano@free.fr>

The virtual devices are automatically destroyed when the network namespace
dies for the kernel version >= 2.6.29. Until this version the network devices
have to be destroyed by lxc. This modification checks the version of the
kernel to make lxc to destroy the network devices or not.

Signed-off-by: Daniel Lezcano <daniel.lezcano@free.fr>
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
2009-01-25 23:29:24 +00:00
dlezcano
eec659c0eb Ignore files copied by libtool
From: Daniel Lezcano <dlezcano@fr.ibm.com>

Ignore files copied by libtool

Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
2009-01-05 19:17:02 +00:00
dlezcano
d3e00ade76 Remove files provided by libtool and automake
From: Daniel Lezcano <dlezcano@fr.ibm.com>

Remove the files which are provided by libtool and automake.
libtoolize has been added to 'bootstrap' command.

Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
2009-01-05 12:08:14 +00:00
dlezcano
a340b3fc00 Add more to cvsignore
From: Michel Normand <michel_mno@laposte.net>

Add more files to .cvsignore, especially the new created files.

Signed-off-by: Michel Normand <michel_mno@laposte.net>
Signed-off-by: Daniel Lezcano <daniel.lezcano@free.fr>
2008-12-13 12:32:11 +00:00
dlezcano
7ad641d5bf Expand the configure directory
From: Daniel Lezcano <dlezcano@fr.ibm.com>

Expand the configure variable specifying the directories in order to use
them directly in the scripts.

Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
2008-12-01 11:50:43 +00:00
dlezcano
5e97c3fcce Initial revision 2008-08-06 14:32:29 +00:00