[lxc-devel] [PATCH] Add mechanism for container to notify host about end of boot
This patch adds a simple notification system that allows the container to
notify the host (in particular, the lxc-start process) that the boot process
has been completed successfully. It also adds an additional status BOOTING
that lxc-info may return. This allows the administrator and scripts to
distinguish between a fully-running container and a container that is still
in the process of booting.
If nothing is added to the configuration file, the current behavior is not
changed, i.e. after lxc-start finishes the initialization, the container is
immediately put into the RUNNING state. This ensures backwards
compatibility.
If lxc.notification.type is set to 'fifo', after lxc-start initialization
the container is initially put into the state BOOTING. Also, the FIFO
/var/lib/lxc/%s/notification-fifo is created and bind-mounted into the
container, by default to /dev/lxc-notify, but this can be changed via the
lxc.notification.path configuration setting.
Inside the container one may execute 'echo RUNNING > /dev/lxc-notify' or an
equivalent command to notify lxc-start that the container has now booted.
Similarly, 'echo STOPPING > /dev/lxc-notify' will change the status to
STOPPING, which may be done on shutdown. Currently, only RUNNING and
STOPPING are allowed, other states are ignored.
This patch only provides the LXC part for the notification system, the
counterpart inside the container has to be provided separately. The
interface has been kept extremely simple to facilitate this.
The choice of the option lxc.notification.type, as opposed to
lxc.notification.enabled, is deliberate in order to make this extensible. If
at some point there is some kind of standardized system for these types of
notifications, it will be simple to just add a new value for the
lxc.notification.type option.
Signed-off-by: Christian Seiler
Cc: Serge Hallyn
Cc: Guido Jäkel
---
src/lxc/Makefile.am|1 +
src/lxc/conf.c |8 +
src/lxc/conf.h |3 +
src/lxc/confile.c | 34 +
src/lxc/notification.c | 349
src/lxc/notification.h | 50 +++
src/lxc/start.c| 22 +++-
src/lxc/start.h|1 +
src/lxc/state.c|1 +
src/lxc/state.h|3 +-
10 files changed, 468 insertions(+), 4 deletions(-)
create mode 100644 src/lxc/notification.c
create mode 100644 src/lxc/notification.h
diff --git a/src/lxc/Makefile.am b/src/lxc/Makefile.am
index 7d86ad6..d976bf7 100644
--- a/src/lxc/Makefile.am
+++ b/src/lxc/Makefile.am
@@ -32,6 +32,7 @@ liblxc_so_SOURCES = \
freezer.c \
checkpoint.c \
restart.c \
+ notification.h notification.c \
error.h error.c \
parse.c parse.h \
cgroup.c cgroup.h \
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 1450ca6..422b742 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -61,6 +61,7 @@
#include "log.h"
#include "lxc.h" /* for lxc_cgroup_set() */
#include "caps.h" /* for lxc_caps_last_cap() */
+#include "notification.h"
#if HAVE_APPARMOR
#include
@@ -2253,6 +2254,11 @@ int lxc_setup(const char *name, struct lxc_conf
*lxc_conf)
return -1;
}
+ if (lxc_notification_mount_hook(name, lxc_conf)) {
+ ERROR("failed to init notification mechanism for container
'%s'.", name);
+ return -1;
+ }
+
if (setup_cgroup(name, &lxc_conf->cgroup)) {
ERROR("failed to setup the cgroups for '%s'", name);
return -1;
@@ -2540,6 +2546,8 @@ void lxc_conf_free(struct lxc_conf *conf)
if (conf->aa_profile)
free(conf->aa_profile);
#endif
+ if (conf->notification_path)
+ free(conf->notification_path);
lxc_clear_config_caps(conf);
lxc_clear_cgroups(conf, "lxc.cgroup");
lxc_clear_hooks(conf);
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index dcf79fe..5ed67ec 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -31,6 +31,7 @@
#include
#include /* for lxc_handler */
+#include /* for notification types */
enum {
LXC_NET_EMPTY,
@@ -237,6 +238,8 @@ struct lxc_conf {
#endif
char *seccomp; // filename with the seccomp rules
int maincmd_fd;
+ lxc_notification_type_t notification_type;
+ char *notification_path;
};
int run_lxc_hooks(const char *name, char *hook, struct lxc_conf *conf);
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index 2d14e0f..f48b8c0 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -53,6 +53,8 @@ static int config_ttydir(const char *, char *, struct
lxc_conf *);
#if HAVE_APPARMOR
static int config_aa_profile(const char *, char *, struct lxc_conf *);
#endif
+static int config_notification_type(const char *, char *, struct lxc_conf *);
+static int config_notification_path(const char *, char *, struct lxc_conf *);
static int config_cgroup(const char *, char *, struct lxc_conf *);
static int con
Re: [lxc-devel] [PATCH] Add mechanism for container to notify host about end of boot
Quoting Christian Seiler (christ...@iwakd.de):
> This patch adds a simple notification system that allows the container to
> notify the host (in particular, the lxc-start process) that the boot process
> has been completed successfully. It also adds an additional status BOOTING
> that lxc-info may return. This allows the administrator and scripts to
> distinguish between a fully-running container and a container that is still
> in the process of booting.
>
> If nothing is added to the configuration file, the current behavior is not
> changed, i.e. after lxc-start finishes the initialization, the container is
> immediately put into the RUNNING state. This ensures backwards
> compatibility.
>
> If lxc.notification.type is set to 'fifo', after lxc-start initialization
> the container is initially put into the state BOOTING. Also, the FIFO
> /var/lib/lxc/%s/notification-fifo is created and bind-mounted into the
> container, by default to /dev/lxc-notify, but this can be changed via the
> lxc.notification.path configuration setting.
>
> Inside the container one may execute 'echo RUNNING > /dev/lxc-notify' or an
> equivalent command to notify lxc-start that the container has now booted.
> Similarly, 'echo STOPPING > /dev/lxc-notify' will change the status to
> STOPPING, which may be done on shutdown. Currently, only RUNNING and
> STOPPING are allowed, other states are ignored.
>
> This patch only provides the LXC part for the notification system, the
> counterpart inside the container has to be provided separately. The
> interface has been kept extremely simple to facilitate this.
>
> The choice of the option lxc.notification.type, as opposed to
> lxc.notification.enabled, is deliberate in order to make this extensible. If
> at some point there is some kind of standardized system for these types of
> notifications, it will be simple to just add a new value for the
> lxc.notification.type option.
>
It's an interesting idea. I kind of like it. We could trivially add
an upstart job to send the notification on runlevel 2 entry.
What do other people think?
> Signed-off-by: Christian Seiler
> Cc: Serge Hallyn
> Cc: Guido Jäkel
> ---
> src/lxc/Makefile.am|1 +
> src/lxc/conf.c |8 +
> src/lxc/conf.h |3 +
> src/lxc/confile.c | 34 +
> src/lxc/notification.c | 349
>
> src/lxc/notification.h | 50 +++
> src/lxc/start.c| 22 +++-
> src/lxc/start.h|1 +
> src/lxc/state.c|1 +
> src/lxc/state.h|3 +-
> 10 files changed, 468 insertions(+), 4 deletions(-)
> create mode 100644 src/lxc/notification.c
> create mode 100644 src/lxc/notification.h
>
> diff --git a/src/lxc/Makefile.am b/src/lxc/Makefile.am
> index 7d86ad6..d976bf7 100644
> --- a/src/lxc/Makefile.am
> +++ b/src/lxc/Makefile.am
> @@ -32,6 +32,7 @@ liblxc_so_SOURCES = \
> freezer.c \
> checkpoint.c \
> restart.c \
> + notification.h notification.c \
> error.h error.c \
> parse.c parse.h \
> cgroup.c cgroup.h \
> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
> index 1450ca6..422b742 100644
> --- a/src/lxc/conf.c
> +++ b/src/lxc/conf.c
> @@ -61,6 +61,7 @@
> #include "log.h"
> #include "lxc.h" /* for lxc_cgroup_set() */
> #include "caps.h" /* for lxc_caps_last_cap() */
> +#include "notification.h"
>
> #if HAVE_APPARMOR
> #include
> @@ -2253,6 +2254,11 @@ int lxc_setup(const char *name, struct lxc_conf
> *lxc_conf)
> return -1;
> }
>
> + if (lxc_notification_mount_hook(name, lxc_conf)) {
> + ERROR("failed to init notification mechanism for container
> '%s'.", name);
> + return -1;
> + }
> +
> if (setup_cgroup(name, &lxc_conf->cgroup)) {
> ERROR("failed to setup the cgroups for '%s'", name);
> return -1;
> @@ -2540,6 +2546,8 @@ void lxc_conf_free(struct lxc_conf *conf)
> if (conf->aa_profile)
> free(conf->aa_profile);
> #endif
> + if (conf->notification_path)
> + free(conf->notification_path);
> lxc_clear_config_caps(conf);
> lxc_clear_cgroups(conf, "lxc.cgroup");
> lxc_clear_hooks(conf);
> diff --git a/src/lxc/conf.h b/src/lxc/conf.h
> index dcf79fe..5ed67ec 100644
> --- a/src/lxc/conf.h
> +++ b/src/lxc/conf.h
> @@ -31,6 +31,7 @@
> #include
>
> #include /* for lxc_handler */
> +#include /* for notification types */
>
> enum {
> LXC_NET_EMPTY,
> @@ -237,6 +238,8 @@ struct lxc_conf {
> #endif
> char *seccomp; // filename with the seccomp rules
> int maincmd_fd;
> + lxc_notification_type_t notification_type;
> + char *notification_path;
> };
>
> int run_lxc_hooks(const char *name, char *hook, struct lxc_conf *conf);
> diff --git a/src/lxc/confile.c b/src/lxc/confile.c
> index 2d14e0f..f48b8c0 100644
> --- a/src/lxc/confile.c
> +++ b/src/lxc/confile.c
> @@ -53,6 +53,8 @@ stat
Re: [lxc-devel] [PATCH] Add mechanism for container to notify host about end of boot
On 12-09-13 03:18 PM, Serge Hallyn wrote:
> Quoting Christian Seiler (christ...@iwakd.de):
>> This patch adds a simple notification system that allows the container to
>> notify the host (in particular, the lxc-start process) that the boot process
>> has been completed successfully. It also adds an additional status BOOTING
>> that lxc-info may return. This allows the administrator and scripts to
>> distinguish between a fully-running container and a container that is still
>> in the process of booting.
>>
>> If nothing is added to the configuration file, the current behavior is not
>> changed, i.e. after lxc-start finishes the initialization, the container is
>> immediately put into the RUNNING state. This ensures backwards
>> compatibility.
>>
>> If lxc.notification.type is set to 'fifo', after lxc-start initialization
>> the container is initially put into the state BOOTING. Also, the FIFO
>> /var/lib/lxc/%s/notification-fifo is created and bind-mounted into the
>> container, by default to /dev/lxc-notify, but this can be changed via the
>> lxc.notification.path configuration setting.
>>
>> Inside the container one may execute 'echo RUNNING > /dev/lxc-notify' or an
>> equivalent command to notify lxc-start that the container has now booted.
>> Similarly, 'echo STOPPING > /dev/lxc-notify' will change the status to
>> STOPPING, which may be done on shutdown. Currently, only RUNNING and
>> STOPPING are allowed, other states are ignored.
>>
>> This patch only provides the LXC part for the notification system, the
>> counterpart inside the container has to be provided separately. The
>> interface has been kept extremely simple to facilitate this.
>>
>> The choice of the option lxc.notification.type, as opposed to
>> lxc.notification.enabled, is deliberate in order to make this extensible. If
>> at some point there is some kind of standardized system for these types of
>> notifications, it will be simple to just add a new value for the
>> lxc.notification.type option.
>>
>
> It's an interesting idea. I kind of like it. We could trivially add
> an upstart job to send the notification on runlevel 2 entry.
>
> What do other people think?
I like the idea but haven't looked at the implementation yet as the
patch is really quite large. Quickly scanning through I briefly noticed
that the copyright headers for the new files are wrong (refer to IBM and
Daniel instead of Christian).
I'm also wondering if we shouldn't try to keep the "protocol" a bit more
generic to eventually allow the container to send/receive more than just
its status?
I don't have any good example in mind at the moment on what else we may
want to communicate between the inside and outside of the container, but
if we're going to implement all the infrastructure for this, we might as
well make sure we can extend the protocol quite easily.
>> Signed-off-by: Christian Seiler
>> Cc: Serge Hallyn
>> Cc: Guido Jäkel
>> ---
>> src/lxc/Makefile.am|1 +
>> src/lxc/conf.c |8 +
>> src/lxc/conf.h |3 +
>> src/lxc/confile.c | 34 +
>> src/lxc/notification.c | 349
>>
>> src/lxc/notification.h | 50 +++
>> src/lxc/start.c| 22 +++-
>> src/lxc/start.h|1 +
>> src/lxc/state.c|1 +
>> src/lxc/state.h|3 +-
>> 10 files changed, 468 insertions(+), 4 deletions(-)
>> create mode 100644 src/lxc/notification.c
>> create mode 100644 src/lxc/notification.h
>>
>> diff --git a/src/lxc/Makefile.am b/src/lxc/Makefile.am
>> index 7d86ad6..d976bf7 100644
>> --- a/src/lxc/Makefile.am
>> +++ b/src/lxc/Makefile.am
>> @@ -32,6 +32,7 @@ liblxc_so_SOURCES = \
>> freezer.c \
>> checkpoint.c \
>> restart.c \
>> +notification.h notification.c \
>> error.h error.c \
>> parse.c parse.h \
>> cgroup.c cgroup.h \
>> diff --git a/src/lxc/conf.c b/src/lxc/conf.c
>> index 1450ca6..422b742 100644
>> --- a/src/lxc/conf.c
>> +++ b/src/lxc/conf.c
>> @@ -61,6 +61,7 @@
>> #include "log.h"
>> #include "lxc.h"/* for lxc_cgroup_set() */
>> #include "caps.h" /* for lxc_caps_last_cap() */
>> +#include "notification.h"
>>
>> #if HAVE_APPARMOR
>> #include
>> @@ -2253,6 +2254,11 @@ int lxc_setup(const char *name, struct lxc_conf
>> *lxc_conf)
>> return -1;
>> }
>>
>> +if (lxc_notification_mount_hook(name, lxc_conf)) {
>> +ERROR("failed to init notification mechanism for container
>> '%s'.", name);
>> +return -1;
>> +}
>> +
>> if (setup_cgroup(name, &lxc_conf->cgroup)) {
>> ERROR("failed to setup the cgroups for '%s'", name);
>> return -1;
>> @@ -2540,6 +2546,8 @@ void lxc_conf_free(struct lxc_conf *conf)
>> if (conf->aa_profile)
>> free(conf->aa_profile);
>> #endif
>> +if (conf->notification_path)
>> +free(conf->notification_path);
>> lxc_clear_config_caps(conf);
>> lxc_clea
Re: [lxc-devel] [PATCH] Add mechanism for container to notify host about end of boot
> I like the idea but haven't looked at the implementation yet as the > patch is really quite large. Quickly scanning through I briefly noticed > that the copyright headers for the new files are wrong (refer to IBM and > Daniel instead of Christian). I just copy&pasted them from the other files, most header files I saw contained the same copyright. Just tell me what exactly to put there and then I'll do that for the next version of the patch. > I'm also wondering if we shouldn't try to keep the "protocol" a bit more > generic to eventually allow the container to send/receive more than just > its status? If we want to have a back-channel, we'd need a socket, which makes just doing echo RUNNING > /dev/lxc-notify impossible, you'd need a special program for that. Having the template scripts dump an additional script or upstart job or systemd unit file or whatever in the container when creating it seems a lot easier than having to use a special program. On the other hand, it wouldn't be too complicated to have two special files lying around: One for simple status updates using the current text interface (easily scriptable, not much hassle to get basic status notification functionality right) and a socket that supports an extensible (binary?) protocol, which currently also only allows one to change the status. But because it's extensible, the interface would already be there. Christian -- Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ ___ Lxc-devel mailing list Lxc-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/lxc-devel
Re: [lxc-devel] [PATCH] Add mechanism for container to notify host about end of boot
On 12-09-13 05:26 PM, Christian Seiler wrote: >> I like the idea but haven't looked at the implementation yet as the >> patch is really quite large. Quickly scanning through I briefly noticed >> that the copyright headers for the new files are wrong (refer to IBM and >> Daniel instead of Christian). > > I just copy&pasted them from the other files, most header files I saw > contained the same copyright. Just tell me what exactly to put there and > then I'll do that for the next version of the patch. The license is fine (LGPL v2.1+), just drop the IBM part and replace Daniel Lezcano by your name. >> I'm also wondering if we shouldn't try to keep the "protocol" a bit more >> generic to eventually allow the container to send/receive more than just >> its status? > > If we want to have a back-channel, we'd need a socket, which makes just > doing echo RUNNING > /dev/lxc-notify impossible, you'd need a special > program for that. Having the template scripts dump an additional script > or upstart job or systemd unit file or whatever in the container when > creating it seems a lot easier than having to use a special program. Well, talking to a socket is really easy from the command line too: echo status STARTING | nc -U /dev/lxc_socket It's depending on netcat but netcat is part of all distros and even exists in busybox (in a stripped down version). > On the other hand, it wouldn't be too complicated to have two special > files lying around: One for simple status updates using the current text > interface (easily scriptable, not much hassle to get basic status > notification functionality right) and a socket that supports an > extensible (binary?) protocol, which currently also only allows one to > change the status. But because it's extensible, the interface would > already be there. > > Christian -- Stéphane Graber Ubuntu developer http://www.ubuntu.com signature.asc Description: OpenPGP digital signature -- Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/___ Lxc-devel mailing list Lxc-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/lxc-devel
[lxc-devel] Fwd: Re: [PATCH] Add mechanism for container to notify host about end of boot
forwarding to the list because I forgot to use reply-to-all - sorry.
--- Begin Message ---
>> If we want to have a back-channel, we'd need a socket, which makes just
>> doing echo RUNNING > /dev/lxc-notify impossible, you'd need a special
>> program for that. Having the template scripts dump an additional script
>> or upstart job or systemd unit file or whatever in the container when
>> creating it seems a lot easier than having to use a special program.
>
> Well, talking to a socket is really easy from the command line too:
> echo status STARTING | nc -U /dev/lxc_socket
>
> It's depending on netcat but netcat is part of all distros and even
> exists in busybox (in a stripped down version).
Unfortunately, I know of at least 4 different netcat implementations (my
count includes Busybox's implementation) and only one of those 4
different implementations supports -U and/or UNIX domain sockets, that
is the one from OpenBSD, which is NOT the standard one that is installed
with many distros, including Debian and Gentoo. I don't think one should
rely on that.
But I thought about it and came up with the following Perl "one-liner"
that should do the trick:
echo status RUNNING | perl -e \
'use IO::Socket;
$client = IO::Socket::UNIX->new(
Peer => "FILENAME",
Type => SOCK_STREAM,
Timeout => 10);
while (<>) { print $client $_; }'
So yeah, a socket would probably be the better choice, the question now
is what kind of protocol should be specified...
Christian
--- End Message ---
--
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/___
Lxc-devel mailing list
Lxc-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-devel
