Qiang Huang [Thu, 23 Jan 2014 06:56:54 +0000 (14:56 +0800)]
cgroupfs: need the full path to setup cpuset
Function file_exists() needs a absolute full path, but we are using
current_entire_path which is not. It will get the wrong result from
file_exists() and case Segmentation fault when we fopen a non-exist
file and try to fscanf from it.
Qiang Huang [Wed, 22 Jan 2014 04:11:38 +0000 (12:11 +0800)]
daemon: fix the wrong pid in daemon model
When you start a container in daemon model, you have at least
3 processes:
1. The command the user start (lxc-start -d)
2. The backgrounded fork of that command after start() is done
3. The container init process
In PID file, we need (2), but currently we are writing (1),
this is wrong because (1) exits as soon as the container is
started, it's complately useless.
So we write pid after daemonize, so that we'll always write
the right pid to PID file.
Stéphane Graber [Tue, 21 Jan 2014 17:16:04 +0000 (12:16 -0500)]
Remove lxc-version, lxc-ps and lxc-netstat
lxc-ps and lxc-netstat have an unfortunate tendency to break every so
often, produce mostly unreadable output and should be replaced by a
lxc-attach call in 99% of the cases.
In an effort to cleanup the lxc-* namespace, I think those two should
go, so this patch gets rid of them as well as any reference to them in
our documentation.
I also think that lxc-version should disappear as it's only a one line
shell script printing the version string, so having a whole command just
for that seems to be a bit of a waste.
Instead, this patch introduces a new --version common option which all
binaries will automatically inherit and that'll print LXC_VERSION on
stdout and exit 0.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Stéphane Graber [Tue, 21 Jan 2014 04:49:19 +0000 (23:49 -0500)]
Add bash auto completion
This adds a basic bash auto-completion profile.
It supports 3 things at this time:
- Auto-complete of container name (-n or -o)
- Auto-complete of template name (-t)
- Auto-complete of state names (-s)
It's configured in a way to be as little disruptive as possible, any
argument that's not explicitly handled by the profile will fallack to
bash's default completion.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Update Fedora and CentOS templates for common conf includes.
This updates the Fedora and CentOS templates to utilize a common
included config. This is largely based on the changes in the Oracle
template with some exceptions.
Dropping of setpcap (present in the Oracle template) is commented out in
the Fedora template. It seems to cause problems, such as large login
delays with Fedora 20 containers (but not Fedora 19 - strange).
The Fedora template is further modified to disable systemd-journald.service
as it is unnecessary in a container and causes serious problems when
running in a Fedora 20 container.
The Fedora template is also updated to default to Fedora 20 when running
on a non-Fedora host.
Regards,
Mike
Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>
S.Çağlar Onur [Tue, 21 Jan 2014 00:57:28 +0000 (19:57 -0500)]
make lxcapi_get_interfaces and lxcapi_get_ips unprivileged container aware
Based on Stéphane's suggestion, those two API methods now;
* fork a new process,
* switch to appropriate namespace(s),
* do what we want,
* return the data over a pipe to the parent which returns the result to the original caller.
S.Çağlar Onur [Tue, 21 Jan 2014 04:43:35 +0000 (23:43 -0500)]
remove no-longer neeeded check from lxcapi_attach_run_waitl
commit f4364484454c754ed905bfb85bd2727a0a5d0475 introduced attach
functionality to unprivileged containers so remove this check like
the rest of the attach functions.
Stéphane Graber [Mon, 20 Jan 2014 20:57:16 +0000 (15:57 -0500)]
utils: Drop trailing / in lxcpath
This fixes command line tools and functions which use
lxc_global_config_value o get lxcpath but don't strip the trailing /
leading to mismatching command path (as lxc_container_new does strip the
path).
As lxcpath is typically a const and so can't easily be changed by the
caller, add the trick directly into lxc_global_config_value (having to
juggle a bit in there too to avoid trying to alter a const).
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Stéphane Graber [Mon, 20 Jan 2014 20:26:15 +0000 (15:26 -0500)]
attach: Support unprivileged containers
This change makes lxc-attach and the matching API functions work
properly with unprivileged containers.
The trick needed to make that possible was to always start with the
userns when attaching and also relocate the cgroup management code so
that the intermediate process is moved to the cgroup before attaching to
the container's namespace as doing so later would fail due to missing
permissions.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
S.Çağlar Onur [Sun, 19 Jan 2014 20:28:05 +0000 (15:28 -0500)]
handle unprivileged user calls more gracefully (v3)
Return an error if the function is not supposed to be called by an unprivileged user.
Otherwise those calls fail in the middle of their execution with different reasons.
changes since v2:
- am_unpriv is now a simple geteuid check,
- API functions are now providing error messages,
- lxc-info, lxc-attach are now checking geteuidi,
- lxc-ls is now calling get_ips only if the container is running
Qiang Huang [Sat, 18 Jan 2014 06:59:58 +0000 (14:59 +0800)]
lxc-start: fix the container leak when daemonize
When start container with daemon model, we'll have a new daemon
process in lxcapi_start, whose c->numthreads is 2, inherited
from his father. Even his father return to main(), the
lxc_container_put won't affect son's numthreads.
So when daemon stops, he should return to main and do
lxc_container_put again, rather than exit and leave the
container alone.
Stéphane Graber [Thu, 16 Jan 2014 19:13:14 +0000 (14:13 -0500)]
init: Add upstart jobs and some more changes (v3)
This adds the 3 upstart jobs that we've had in Ubuntu for a while:
- lxc.conf: Main upstart job, triggers lxc-net.conf based on config
- lxc-instance.conf: Triggered by lxc.conf for each auto-started container
- lxc-net.conf: Triggered by lxc.conf, sets up lxcbr0, NAT, mangling, ...
In addition, there are two extra config files in /etc/default:
- lxc: Allows setting some values like http proxying, disabling autostart, ...
- lxc-net: Network configuration for the lxcbr0 bridge
This change also disables the sysv script for all distros but Oracle as
the current script won't work on either Ubuntu nor Debian and I suspect
quite a few more distros, so it's not nearly as distro-agnostic as we
thought.
For Debian, only install the upstart jobs and systemd unit.
For Ubuntu, only install the upstart jobs.
This change also moves all the init related stuff to config/init/
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Serge Hallyn [Thu, 16 Jan 2014 20:44:48 +0000 (14:44 -0600)]
cgmanager: fix obvious braindeadnesses
1. don't return bools for int-return functions
2. copy the filename to controller before using it
3. use full filename not just the key to pass to cgmanager
Stéphane Graber [Thu, 16 Jan 2014 18:37:32 +0000 (13:37 -0500)]
python3: Don't fail in list_containers on ValueError
ValueError typically means that the user doesn't have permissions to
access the directory. Raising an exception there isn't consistent with
other error behaviour of list_containers which simple returns an empty
tuple.
So simply catch the exception and ignore it. An error message is already
printed by LXC itself anyway.
Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Serge Hallyn [Thu, 16 Jan 2014 14:41:44 +0000 (08:41 -0600)]
shut up freezer_state
Not being able to get freezer state is perfectly valid - if the
container does not exist. The old version of freezer_state
only reported an error on actually reading the cgroup file,
but not on not finding a cgroup file. Leave it to the caller
to report the error if it is important, since we don't actually
know any useful info here anyway.
Serge Hallyn [Wed, 15 Jan 2014 19:40:53 +0000 (13:40 -0600)]
stop cmd callback: unfreeze by path only
in particular, regular unfreeze uses the cmd api to request the cgroup
of the container. If we are already in the lxc-start monitor, we can't
use the cmd api.
(I knew when I started this would be a problem but then as it didn't
reliably crash, I forgot to handle it)
Serge Hallyn [Tue, 14 Jan 2014 22:41:36 +0000 (16:41 -0600)]
Initial support for cgmanager
This patch splits out most of the cgroupfs-specific code, so that
cgroup-manager versions can be plugged in. The case I did
not handle is cgroup_enter at lxc_attach. I'm hoping that case can
be greatly simplified, but will worry about it after fleshing out the
cgroup manager handlers.
This also simplify the freezer functions.
This seems to not regress my common tests when running without
cgmanager, but I'd like to do a bit more testing before pushing.
However I was hoping to get some more eyes on this so am sending it
out now.
Chris Glass [Wed, 15 Jan 2014 15:37:46 +0000 (16:37 +0100)]
Fix small mistake with squid-deb-proxy hook
I unfortunately realized that I did not push the latest version of the
file. This fixes an issue in the case where we want to create the proxy
file in the container (not nested).
Signed-off-by: Chris Glass <tribaal@gmail.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>
projects / mirror_lxc.git / log