Re: [lxc-devel] [PATCH] set non device cgroup items before the cgroup is entered

2013-05-15 Thread Serge Hallyn
Quoting Dwight Engen (dwight.en...@oracle.com): > This allows some special cgroup items such as memory.kmem.limit_in_bytes > to be successfully set, since they must be set before any task is put > into the cgroup. > > The devices cgroup is setup later giving the container a chance to mount > file

Re: [lxc-devel] [PATCH] doc/lxc.conf minor clarifications

2013-05-15 Thread Serge Hallyn
Quoting Dwight Engen (dwight.en...@oracle.com): > Signed-off-by: Dwight Engen Acked-by: Serge E. Hallyn > --- > doc/lxc.conf.sgml.in | 39 +++ > 1 file changed, 23 insertions(+), 16 deletions(-) > > diff --git a/doc/lxc.conf.sgml.in b/doc/lxc.conf.sgml.in >

[lxc-devel] [PATCH 1/1] cgroup: prevent DOS when a hierachy is mounted multiple times

2013-05-15 Thread Serge Hallyn
When starting a container, we walk through all cgroup mounts looking for a unique directory name we can use for this container. If the name we are trying is in use, we try another name. If it is not in use in the first mount we check, we need to check other hierarchies as it may exist there. But

Re: [lxc-devel] [RFC PATCH] lxc: add clone hook.

2013-05-15 Thread Serge Hallyn
Quoting Scott Moser (smo...@ubuntu.com): > On Wed, 15 May 2013, Serge Hallyn wrote: > > > > > Soon analogous create and destroy hooks will be added as well. > > > > > > I think I'd have preferred storing the command arguments in > > > LXC_CLONE_ARGS instead of directly in argv. Doing so would allo

Re: [lxc-devel] [PATCH] lxc-alpine: download statically compiled package manager if not available on host

2013-05-15 Thread Serge Hallyn
Quoting Kaarle Ritvanen (kaarle.ritva...@datakunkku.fi): ... > +wget="wget -O - $repository/x86" .. > +$wget/apk-tools-static-$apk_version.apk | \ > +tar -Oxz sbin/apk.static > $apk || return 1 > +chmod u+x $apk > + > +apk_opts="$apk_opts --allow-

Re: [lxc-devel] [PATCH] lxc-fedora-template: autodev, hostname, ARM archs, Raspberry Pi fixes

2013-05-15 Thread Serge Hallyn
Quoting Serge Hallyn (serge.hal...@ubuntu.com): > Thanks, Michael. > > Acked-by: Serge E. Hallyn applied -- AlienVault Unified Security Management (USM) platform delivers complete security visibility with the essential

Re: [lxc-devel] [PATCH v2] lxc-busybox: check when bind-mounting host libdirs

2013-05-15 Thread Serge Hallyn
Quoting Serge Hallyn (serge.hal...@ubuntu.com): > Quoting Bogdan Purcareata (bogdan.purcare...@freescale.com): > > The patch removes the behavior of automatically mounting /lib > > and /usr/lib, since this is duplicated a few lines below. It will > > also remove the risk of failing when one of thes

[lxc-devel] [PATCH] doc/lxc.conf minor clarifications

2013-05-15 Thread Dwight Engen
Signed-off-by: Dwight Engen --- doc/lxc.conf.sgml.in | 39 +++ 1 file changed, 23 insertions(+), 16 deletions(-) diff --git a/doc/lxc.conf.sgml.in b/doc/lxc.conf.sgml.in index 0a5a52a..509ca2d 100644 --- a/doc/lxc.conf.sgml.in +++ b/doc/lxc.conf.sgml.in @@ -65

[lxc-devel] [PATCH] set non device cgroup items before the cgroup is entered

2013-05-15 Thread Dwight Engen
This allows some special cgroup items such as memory.kmem.limit_in_bytes to be successfully set, since they must be set before any task is put into the cgroup. The devices cgroup is setup later giving the container a chance to mount file systems before the device it might want to mount from become

Re: [lxc-devel] [RFC PATCH 0/1] allow setting cgroup items before the cgroup is entered

2013-05-15 Thread Dwight Engen
On Wed, 15 May 2013 10:46:13 -0500 Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > On Tue, 14 May 2013 11:01:04 -0500 > > Serge Hallyn wrote: > > > > > Quoting Dwight Engen (dwight.en...@oracle.com): > > > > Hi, > > > > > > > > I tried to put lxc.cgroup.memory.kmem.li

Re: [lxc-devel] [RFC PATCH 0/1] allow setting cgroup items before the cgroup is entered

2013-05-15 Thread Dwight Engen
On Wed, 15 May 2013 10:46:13 -0500 Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > On Tue, 14 May 2013 11:01:04 -0500 > > Serge Hallyn wrote: > > > > > Quoting Dwight Engen (dwight.en...@oracle.com): > > > > Hi, > > > > > > > > I tried to put lxc.cgroup.memory.kmem.li

Re: [lxc-devel] [RFC PATCH 0/1] allow setting cgroup items before the cgroup is entered

2013-05-15 Thread Serge Hallyn
Quoting Dwight Engen (dwight.en...@oracle.com): > On Tue, 14 May 2013 11:01:04 -0500 > Serge Hallyn wrote: > > > Quoting Dwight Engen (dwight.en...@oracle.com): > > > Hi, > > > > > > I tried to put lxc.cgroup.memory.kmem.limit_in_bytes = 4194304 in a > > > config file to test forkbomb prevention

Re: [lxc-devel] [RFC PATCH 0/1] allow setting cgroup items before the cgroup is entered

2013-05-15 Thread Dwight Engen
On Tue, 14 May 2013 11:01:04 -0500 Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > Hi, > > > > I tried to put lxc.cgroup.memory.kmem.limit_in_bytes = 4194304 in a > > config file to test forkbomb prevention. The problem with this is > > that kmem.limit_in_bytes (per the

Re: [lxc-devel] create api

2013-05-15 Thread Serge Hallyn
Quoting Dwight Engen (dwight.en...@oracle.com): > On Wed, 15 May 2013 08:56:27 -0500 > Serge Hallyn wrote: > > > Quoting Dwight Engen (dwight.en...@oracle.com): > > > On Tue, 14 May 2013 14:13:45 -0500 > > > Serge Hallyn wrote: > > > > > > > Hi, > > > > > > > > I'd like to rewrite lxc-create t

Re: [lxc-devel] [RFC PATCH] lxc: add clone hook.

2013-05-15 Thread Serge Hallyn
Quoting Stéphane Graber (stgra...@ubuntu.com): > On 05/15/2013 10:23 AM, Serge Hallyn wrote: > > Add a clone hook called from api_clone. Pass arguments to it from > > lxc_clone.c. > > > > The clone update hook is called while the container's bdev is mounted. > > Information about the container is

Re: [lxc-devel] [PATCH] lxc-fedora-template: autodev, hostname, ARM archs, Raspberry Pi fixes

2013-05-15 Thread Serge Hallyn
Quoting Michael H. Warfield (m...@wittsend.com): > This took a lot longer for me to get around to it... Sorry. > > Patch to the lxc-fedora template. > > I didn't get any further comments from my earlier proposal, weeks ago, > and did get one addition based on comments about properly setting the

Re: [lxc-devel] create api

2013-05-15 Thread S . Çağlar Onur
Hi Serge, On Tue, May 14, 2013 at 3:13 PM, Serge Hallyn wrote: > Hi, > > I'd like to rewrite lxc-create to be c (calling out to the c templates > which continue to be scripts for the most part). Unfortunately right > now the lxcapi_create() just takes arguments to send to the lxc-create > scrip

Re: [lxc-devel] [RFC PATCH] lxc: add clone hook.

2013-05-15 Thread Stéphane Graber
On 05/15/2013 10:23 AM, Serge Hallyn wrote: > Add a clone hook called from api_clone. Pass arguments to it from > lxc_clone.c. > > The clone update hook is called while the container's bdev is mounted. > Information about the container is passed in through environment > variables LXC_ROOTFS_PATH,

[lxc-devel] [RFC PATCH] lxc: add clone hook.

2013-05-15 Thread Serge Hallyn
Add a clone hook called from api_clone. Pass arguments to it from lxc_clone.c. The clone update hook is called while the container's bdev is mounted. Information about the container is passed in through environment variables LXC_ROOTFS_PATH, LXC_NAME, The LXC_ROOTFS_MOUNT, and LXC_CONFIG_FILE. L

Re: [lxc-devel] create api

2013-05-15 Thread Dwight Engen
On Wed, 15 May 2013 08:56:27 -0500 Serge Hallyn wrote: > Quoting Dwight Engen (dwight.en...@oracle.com): > > On Tue, 14 May 2013 14:13:45 -0500 > > Serge Hallyn wrote: > > > > > Hi, > > > > > > I'd like to rewrite lxc-create to be c (calling out to the c > > > templates which continue to be sc

Re: [lxc-devel] [PATCH v2] lxc-busybox: check when bind-mounting host libdirs

2013-05-15 Thread Serge Hallyn
Quoting Bogdan Purcareata (bogdan.purcare...@freescale.com): > The patch removes the behavior of automatically mounting /lib > and /usr/lib, since this is duplicated a few lines below. It will > also remove the risk of failing when one of these entries are not > present on the host - e.g. on a 64bi

Re: [lxc-devel] create api

2013-05-15 Thread Serge Hallyn
Quoting Dwight Engen (dwight.en...@oracle.com): > On Tue, 14 May 2013 14:13:45 -0500 > Serge Hallyn wrote: > > > Hi, > > > > I'd like to rewrite lxc-create to be c (calling out to the c templates > > which continue to be scripts for the most part). Unfortunately right > > now the lxcapi_create(

[lxc-devel] [PATCH v2] lxc-busybox: check when bind-mounting host libdirs

2013-05-15 Thread Bogdan Purcareata
The patch removes the behavior of automatically mounting /lib and /usr/lib, since this is duplicated a few lines below. It will also remove the risk of failing when one of these entries are not present on the host - e.g. on a 64bit machine. Signed-off-by: Bogdan Purcareata --- templates/lxc-busy