Re: [lxc-devel] cgroup management daemon

2013-11-26 Thread Serge E. Hallyn
armol wrote: > > I think most of our usecases have only wanted to know about the parent, but > > I can see people wanting to go further. Would it be much different to > > support both? I feel like it'll be simpler to support all if we go that > > route. > > &

Re: [lxc-devel] cgroup management daemon

2013-11-26 Thread Serge E. Hallyn
Quoting Tim Hockin (thoc...@google.com): > lmctfy literally supports ".." as a container name :) So is ../.. ever used, or does noone every do anything beyond ..? -- Rapidly troubleshoot problems before they affect your b

Re: [lxc-devel] cgroup management daemon

2013-11-26 Thread Serge E. Hallyn
Quoting Tim Hockin (thoc...@google.com): > On Mon, Nov 25, 2013 at 9:47 PM, Serge E. Hallyn wrote: > > Quoting Tim Hockin (thoc...@google.com): ... > >> > . A client (requestor 'r') can make cgroup requests over > >> > /sys/fs/cgroup/ma

Re: [lxc-devel] cgroup management daemon

2013-11-26 Thread Serge E. Hallyn
Quoting Victor Marmol (vmar...@google.com): > On Tue, Nov 26, 2013 at 8:12 AM, Serge E. Hallyn wrote: > > > Quoting Tim Hockin (thoc...@google.com): > > > What are the requirements/goals around performance and concurrency? > > > Do you expect this to be a single-th

Re: [lxc-devel] cgroup management daemon

2013-11-26 Thread Serge E. Hallyn
Quoting Tim Hockin (thoc...@google.com): > At the start of this discussion, some months ago, we offered to > co-devel this with Lennart et al. They did not seem keen on the idea. > > If they have an established DBUS protocol spec, see http://www.freedesktop.org/wiki/Software/systemd/ControlGroup

Re: [lxc-devel] cgroup management daemon

2013-11-26 Thread Serge E. Hallyn
Quoting Tim Hockin (thoc...@google.com): > What are the requirements/goals around performance and concurrency? > Do you expect this to be a single-threaded thing, or can we handle > some number of concurrent operations? Do you expect to use threads of > processes? The cgmanager should be pretty d

Re: [lxc-devel] cgroup management daemon

2013-11-25 Thread Serge E. Hallyn
Quoting Tim Hockin (thoc...@google.com): > Thanks for this! I think it helps a lot to discuss now, rather than > over nearly-done code. > > On Mon, Nov 25, 2013 at 2:43 PM, Serge E. Hallyn wrote: > > Additionally, Tejun has specified that we do not want users to be > >

[lxc-devel] cgroup management daemon

2013-11-25 Thread Serge E. Hallyn
Hi, as i've mentioned several times, I want to write a standalone cgroup management daemon. Basic requirements are that it be a standalone program; that a single instance running on the host be usable from containers nested at any depth; that it not allow escaping ones assigned limits; that it no

Re: [lxc-devel] Device Namespaces

2013-10-01 Thread Serge E. Hallyn
Quoting Andy Lutomirski (l...@amacapital.net): > On Tue, Oct 1, 2013 at 7:19 AM, Janne Karhunen > wrote: > > On Thu, Sep 26, 2013 at 8:33 AM, Greg Kroah-Hartman > > wrote: > > > >>> - We can relay a call of /sbin/hotplug from outside of a container > >>> to inside of a container based on polic

Re: [lxc-devel] Detecting if you are running in a container

2011-10-12 Thread Serge E. Hallyn
Quoting da...@lang.hm (da...@lang.hm): > On Tue, 11 Oct 2011, Eric W. Biederman wrote: > > >da...@lang.hm writes: > > > >>On Tue, 11 Oct 2011, Eric W. Biederman wrote: > >> > >>>Theodore Tso writes: > >>> > On Oct 11, 2011, at 2:42 AM, Eric W. Biederman wrote: > > >>>I admit for a lot of

Re: [lxc-devel] [Lxc-users] PAM-module for adhoc creation of container

2011-09-02 Thread Serge E. Hallyn
Quoting "Axel Schöner" (axel.schoe...@gmx.de): > Hello, > > i need some feedback and suggestions for this project. If there are > similar solutions please let me know. > > I want to build a solution for creating and starting a container on user > login > (via ssh or shell). The user should be

Re: [lxc-devel] [Lxc-users] Latest test results - Was: cgroups: support cgroups mounted in multiple places (v3)

2011-07-03 Thread Serge E. Hallyn
Quoting Michael H. Warfield (m...@wittsend.com): > On Sat, 2011-07-02 at 15:13 -0500, Serge Hallyn wrote: > > Quoting Michael H. Warfield (m...@wittsend.com): > > ... > > > F15 systemd: Passed. > > > F12 single mount: Passed. > > > F13 single mount: Passed. > > > F14 single mount: Passed. > >

[lxc-devel] regular lxc development call?

2010-12-13 Thread Serge E. Hallyn
Hi, at UDS-N we had a session on 'fine-tuning containers'. The focus was things we can do in the next few months to improve containers. The meeting proeedings can be found at https://wiki.ubuntu.com/UDSProceedings/N/CloudInfrastructure#Make%20LXC%20ready%20for%20production We have a few work it

Re: [lxc-devel] [Lxc-users] regular lxc development call?

2010-12-13 Thread Serge E. Hallyn
Quoting Daniel Lezcano (daniel.lezc...@free.fr): > On 12/02/2010 03:21 PM, Serge E. Hallyn wrote: > >Quoting Daniel Lezcano (daniel.lezc...@free.fr): > >>On 11/30/2010 04:06 AM, Serge E. Hallyn wrote: > >>>Quoting Daniel Lezcano (daniel.lezc...@free.fr): > >

Re: [lxc-devel] regular lxc development call?

2010-12-13 Thread Serge E. Hallyn
Quoting Daniel Lezcano (daniel.lezc...@free.fr): > On 11/29/2010 03:53 PM, Serge E. Hallyn wrote: > > Hi, > > > > at UDS-N we had a session on 'fine-tuning containers'. The focus was > > things we can do in the next few months to improve containers. The &

Re: [lxc-devel] [Lxc-users] regular lxc development call?

2010-12-13 Thread Serge E. Hallyn
Quoting Daniel Lezcano (daniel.lezc...@free.fr): > On 11/30/2010 04:06 AM, Serge E. Hallyn wrote: > > Quoting Daniel Lezcano (daniel.lezc...@free.fr): > > Looks like we'll be starting small anyway, so let's just try skype. Anyone > > interested in joinin

Re: [lxc-devel] [Lxc-users] template-script for ubuntu [lucid] containers

2010-09-08 Thread Serge E. Hallyn
Quoting user virtual (virtual...@gmail.com): > Hi Serge > > Sorry for the missing link: > http://virtualusr.wordpress.com/2010/09/07/flying-linux-containers-on-xen-4-0-on-pv-ubuntu-10-04-lucid/ > > There was no networking setup and making one blocked upstart for me. Hm, you're using lxc-ubuntu b

Re: [lxc-devel] [Lxc-users] template-script for ubuntu [lucid] containers

2010-09-08 Thread Serge E. Hallyn
Quoting user virtual (virtual...@gmail.com): > Hi guys > > You might consider including upstream some of my patches to Wilhelms > lxc-ubuntu script. I was forced to make them to make things work for me. > > I've spent too much of my time making this work. You can download install > demo scripts w

Re: [lxc-devel] security considerations when running lxc as non-root

2010-07-02 Thread Serge E. Hallyn
Quoting Ferenc Wagner (wf...@niif.hu): > Daniel Lezcano writes: > > > The lxc tools can be run as non-root with all the needed capabilities > > set by lxc-setcap via the file capabilities. The command run by lxc > > won't have these privileges of course. > > I've always regarded such setups as a

Re: [lxc-devel] security considerations when running lxc as non-root

2010-07-02 Thread Serge E. Hallyn
Quoting Greg Kurz (gk...@fr.ibm.com): > On Thu, 2010-07-01 at 10:58 -0500, Serge E. Hallyn wrote: > > 3. instead of keeping caps in pP and raising in pE when needed, > > a more privilege-separated approach could be used, where you > > have small privileged helpers wh

Re: [lxc-devel] security considerations when running lxc as non-root

2010-07-01 Thread Serge E. Hallyn
Haven't looked closely enough yet, but a few comments: 1. mount/umount make up a lot of the privileged calls, and at some point these will hopefully be supported unprivileged (at least for bind mounts). 2. one nice bonus of this is that we can easily spot where priv is expected to be used 3. ins

Re: [lxc-devel] [Lxc-users] lxc-0.7.1 released

2010-06-28 Thread Serge E. Hallyn
Quoting Daniel Lezcano (daniel.lezc...@free.fr): > Hi All, > > Notes: > == > > Bug fixes only. > > > ChangeLog: > == > > Ciprian Dorin, Craciun (1): >lxc to apply mount options for bind mounts > > Daniel Lezcano (6): >fix sshd template >fix bad free when re

Re: [lxc-devel] [Lxc-users] Using initctl inside a container with upstart?

2010-05-18 Thread Serge E. Hallyn
Quoting Wilhelm (wilhelm.me...@fh-kl.de): > Hi all, > > is it safe to use initctl in a container using upstart (as ubuntu lucid)? > > Especially, upstart-init uses an abstract unix-socket: > > connect(3, {sa_family=AF_FILE, path=@"/com/ubuntu/upstart"}, 22) = 0 > > Is this socket separated from

Re: [lxc-devel] Containerized syslog

2010-05-17 Thread Serge E. Hallyn
Quoting Matt Helsley (matth...@us.ibm.com): > On Wed, May 12, 2010 at 11:15:05PM +0200, Daniel Lezcano wrote: > > Jean-Philippe Menil wrote: > > > Hi, > > > > > > I'm playing with containers under debian (squeeze, 2.6.33.3) with the > > > lxc tools. > > > I'm really happy about all the features (a

Re: [lxc-devel] [PATCH 1/1] lxc-ps: Nit - Avoid blank CONTAINER column

2010-02-11 Thread Serge E. Hallyn
Quoting Michel Normand (norm...@fr.ibm.com): > Le jeudi 11 février 2010 à 11:08 +0100, Michel Normand a écrit : > > Le mercredi 10 février 2010 à 20:25 -0800, Sukadev Bhattiprolu a écrit : > > > From: Sukadev Bhattiprolu > > > Date: Wed, 10 Feb 2010 20:09:17 -0800 > > > Subject: [PATCH 1/1] lxc-ps