debian: Add buster as a valid release

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Merge pull request #1729 from brauner/2017-08-03/ensure_cgroup_cleanup_before_restart

start: ensure cgroups are cleaned up

start: ensure cgroups are cleaned up

When a container is marked as being in STOPPED state it is possible for another
thread to start it again even though not all cleanup operations for that
container have finished. This is not a problem for most things like sockets and
friends which are unique to the container. It is however a problem for cgroups
which are named after that container in that we cause our cgroup driver to
waste cpu cycles finding a new cgroup name.

Closes  #1726.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1727 from brauner/2017-08-02/fix_travis

travis: fix builds

Merge pull request #1705 from brauner/2017-07-15/fix_clone

storage: rework storage drivers

travis: fix builds

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1725 from brauner/2017-08-01/handle_pre_mounted_dev

conf: NOTICE() on mounts on container's /dev

userns.conf: remove obsolete bind-mounts

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: NOTICE() on mounts on container's /dev

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: rework lxc_deslashify()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: lxc_fill_autodev()

non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: switch to has_fs_type()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: add has_fs_type() + is_fs_type()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: mount_autodev()

non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: lxchook_names

non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: mount_entry()

non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: cull_mntent_opt()

non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: mount_entry_create_dir_file()

bugfixes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

android: include custom mntent

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: mount_entry_on_generic()

non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: mount_entry_on_systemfs()

non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: mount_entry_on_absolute_rootfs()

non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: setup_mount_entries()

non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: make_anonymous_mount_file()

non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: setup_mount()

non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: mount_file_entries()

non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1723 from brauner/2017-07-31/remove_utmp_watch

start: remove utmp watch

Merge pull request #1722 from brauner/2017-07-31/devpts_use_max_mount_option

devpts: use max=<count> option on mount

Merge pull request #1724 from GamerSource/opensuse-template-improvements-v2

Opensuse template improvements

overlay: correctly restore from snapshot

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

devpts: use max=<count> option on mount

This will only work with kernels >= 3.4

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: remove utmp watch

Closes #1616.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

templates/opensuse: support leap 42.3

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

templates/opensuse: getty.target.wants does not always exists

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

templates/opensuse: fix tumbleweed software selection

tumbleweed needs a newer version for a few packages, namely:
* liblua5_3
* bncurses6
* breadline7

As Leap it also has no dhcpd, but udhcp which gets pulled in already.
Further iproute2 and net-tools need manual instalation.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

templates/opensuse: tumbleweed has no update repo

As tumbleweed is a rolling release it has not update repository.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

overlay: simplify logic

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

overlay: correctly handle dependency tracking

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: rework lxc_deslashify()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

aufs: mark deprecated

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

rsync: remove obsolete helpers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tree-wide: struct bdev -> struct lxc_storage

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage: rename files "bdev" -> "storage"

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

overlay: rework overlay storage driver

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

zfs: rework zfs storage driver

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage: add rbd, zfs as block devices

When users create an unprivileged container as root they can use block devices.
However, we then need to perform a specific mount protocol in start.c which
requires that these block devices are correctly reported as block devices. So
let's do that.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage: make detect method return bool

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

rbd: rework rbd storage driver

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

rbd: rbd non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

loop: rework loop storage driver

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

btrfs: switch to new rsync helpers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage: switch to new rsync functions

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

rsync: add new rsync functions

We will fade out the old helpers soon.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bdev: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

dir: improvements

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

dir: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage: rework lvm backend

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage: add arg to create_snapshot()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

btrfs: switch to btrfs_create_{clone,snapshot}()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage: add create_{clone,snapshot}()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

btrfs: simplify

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

btrfs: simplify

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

btrfs: only chown_mapped_root() if not btrfs

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

btrfs: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

btrfs: enable unprivileged snapshots

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

btrfs: export btrfs_snapshot_wrapper()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

btrfs: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

tools: remove empty snap directory

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

overlay: simplify and adapt to "overlay"

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lvm: non-functional changes

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

btrfs: simplify + bugfix

Closes #1698.
Closes #1703.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: use snprintf()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

storage: default to orig type on identical paths

otherwise default to "dir"

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1721 from brauner/2017-07-30/fix_saved_config_handling

network parser fixes

test: test for invalid network key

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1720 from hallyn/2017-07-29/cg

Fix some bugs in #1719

lxccontainer: clear whole indexed networks

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

confile: use deindexed network keys

When we are passed a network key like "lxc.net.[i].ipv4.address" we need to
make sure that we pass the deindexed key "lxc.net.ipv4.address" to the
{get,clr,set} methods otherwise we'll end up in an endless loop.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Fix some bugs in #1719

In particular, any text (like a #comment) following the mode
would end up in our mode line.

Signed-off-by: Serge Hallyn <serge@hallyn.com>

Merge pull request #1719 from hallyn/2017-07-28/cg

Fix up c8bf519d to fit our coding style

Fix up c8bf519d to fit our coding style

Also reduce the number of mallocs.

Signed-off-by: Serge Hallyn <serge@hallyn.com>

Merge pull request #1708 from aeris/master

Allow full path in lxc.devices.allow

Merge pull request #1717 from hallyn/harri1

Use "rsync -SHaAX" to copy the cached rootfs into place

Use "rsync -SHaAX" to copy the cached rootfs into place

(updated by Serge to also handle hte new lxc-fedora{-legacy{.in
templates)

Signed-off-by: Harald Dunkel <harri@afaics.de>
Signed-off-by: Serge Hallyn <serge@hallyn.com>
Acked-by: Serge Hallyn <serge@hallyn.com>

Merge pull request #1716 from brauner/2017-07-28/bugfix

lvm: fix check

lvm: fix check

Signed-off-by: Thomas Hipp <thipp@suse.de>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1715 from brauner/2017-07-27/fix_gcc7_bug

lvm: check whether lxc.bdev.lvm.vg is empty

cgroups: use tight scoping

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lvm: check whether lxc.bdev.lvm.vg is set

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1714 from brauner/2017-07-27/fix_gcc7_bug

cgroups: workaround gcc-7 bug

cgroups: workaround gcc-7 bug

Also: LOL

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1713 from brauner/2017-07-26/hybrid_cgroup_support

cgroups: handle hybrid cgroup layouts

cgroups: handle hybrid cgroup layouts

Closes #1669.
Closes #1678.
Relates to https://github.com/systemd/systemd/issues/6408.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: move helpers from cgfsng.c to utils.{c,h}

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Allow full path in lxc.devices.allow

Some devices like LVM or cryptsetup entries have no stable major/minor, changing between host reboots.
In this case, hardcoded numbers are not usable in config file and there is currently no way to use hook with lxc-device to do the link at guest startup :

    * `pre-start`/`autodev` hook runs in host context but has the guest in stopped state and so lxc-device not usable
    * `start` hook is in running state but runs in guest context and so lxc-device not available

This patch converts fullpath in lxc.devices.allow to current major/minor numbers to address those changing numbers.

Signed-off-by: aeris <aeris@imirhil.fr>

Merge pull request #1606 from brauner/2017-06-01/lxc_setup_after_cgroup_unshare

call lxc_setup() after unshare(CLONE_NEWCGROUP)

start: lxc_setup() after unshare(CLONE_NEWCGROUP)

When the running kernel supports cgroup namespaces and users want to manually
set up cgroups via lxc.hook.mount before the init binary starts the cgroup
namespace needs to be already unshared. Otherwise the view on the cgroup mounts
is wrong. This commit places the call to lxc_setup() after the
LXC_SYNC_POST_CGROUP barrier.

Before this commit, the tty fds we allocate from a fresh devpts instance in the
container's namespaces before the init binary starts were referring to the
host's cgroup namespace since lxc_setup() was called before
unshare(CLONE_NEWCGROUP). Although not a security risk at this point since
setns() restricts its calls to /proc/<self>/ns files it's still better to do it
*after* the cgroup namespace has been unshared.

Adding a Suggested-by line for the lxc.mount.hook fix for Quentin.

Closes #1597.

Suggested-by: Quentin Dufour <quentin@dufour.tk>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #1706 from lifeng68/do_remount

Fix issue #1702, do remount with the MS_REMOUNT flag when mounts with MS_RDONLY

 Using 'add-required_remount_flags' function to add required flags

Signed-off-by: Li Feng <lifeng68@huawei.com>