summaryrefslogtreecommitdiff
path: root/src/nspawn
Commit message (Collapse)AuthorAge
* nspawn: only warn about audit when booting the containerDave Reisner2013-05-10
| | | | | The audit subsystem isn't relevant when nspawn is only being used as a chroot.
* nspawn: Include netlink headers rather than using #ifdefColin Walters2013-05-09
| | | | | | This is a better fix than e13e1fad8b231e187bd5de3ce668411bdcd3ac1a for failing to compile without audit that 77b6e19458f37cfde127ec6aa9494c0ac45ad890 introduced.
* Fix previous commit for !HAVE_AUDITColin Walters2013-05-09
|
* audit: since audit is apparently never going to be fixed for containers tell ↵Lennart Poettering2013-05-10
| | | | | | | | | the user what's going on Let's try to be helpful to the user and give him a hint what he can do to make nspawn work with normal OS containers. https://bugzilla.redhat.com/show_bug.cgi?id=893751
* hostname: only suppress setting of pretty hostname if it is non-equal to the ↵Lennart Poettering2013-05-07
| | | | | | static hostname and if the static hostname is set, too https://bugzilla.redhat.com/show_bug.cgi?id=957814
* build-sys: support builds without EAs againLennart Poettering2013-05-07
|
* nspawn: explain that we look for /etc/os-release in the container directoryLennart Poettering2013-05-06
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=64014
* nspawn: inherit the exit status of containerDave Reisner2013-05-02
| | | | | If we get as far as successfully starting the container, nspawn should inherit the exit status of the child container process as its own.
* cgls: add --machine/-MZbigniew Jędrzejewski-Szmek2013-05-01
| | | | | cg_get_machine_path is modified to include the escaped machine name + ".nspawn" if the machine argument is nonnull.
* units: add an easy-to-use unit template file systemd-nspawn@.service for ↵Lennart Poettering2013-04-30
| | | | running containers as system services
* id128: when taking user input for a 128bit ID, validate syntaxLennart Poettering2013-04-30
| | | | Also, always accept both our simple hexdump syntax and UUID syntax.
* nspawn: add -M option to optstringEvangelos Foutras2013-04-29
| | | | | This was missed in commit 7027ff61a34a12487712b382a061c654acc3a679 and means that the --machine option would work but not its shorthand, -M.
* cgroup: make sure all our cgroup objects have a suffix and are properly escapedLennart Poettering2013-04-22
| | | | | | | | | | | | | | Session objects will now get the .session suffix, user objects the .user suffix, nspawn containers the .nspawn suffix. This also changes the user cgroups to be named after the numeric UID rather than the username, since this allows us the parse these paths standalone without requiring access to the cgroup file system. This also changes the mapping of instanced units to cgroups. Instead of mapping foo@bar.service to the cgroup path /user/foo@.service/bar we will now map it to /user/foo@.service/foo@bar.service, in order to ensure that all our objects are properly suffixed in the tree.
* nspawn: suffix the nspawn cgroups with ".nspawn"Lennart Poettering2013-04-22
| | | | | | | | | | | As discussed with Dan Berrange it's a good idea to suffix all objects in the cgroup tree with ".something", so that when the system is partitioned using a resource management tool we can drop objects of different types into the same partition directory without generate namespace conflicts. We'l add this to the Pax Control Group document as soon as write access to the fdo wiki is restored.
* nspawn: always use cg_get_path() to determine fs path for a cgroupLennart Poettering2013-04-22
|
* systemd,nspawn: use extended attributes to store metadataZbigniew Jędrzejewski-Szmek2013-04-21
| | | | | | | | | | | | All attributes are stored as text, since root_directory is already text, and it seems easier to have all of them in text format. Attributes are written in the trusted. namespace, because the kernel currently does not allow user. attributes on cgroups. This is a PITA, and CAP_SYS_ADMIN is required to *read* the attributes. Alas. A second pipe is opened for the child to signal the parent that the cgroup hierarchy has been set up.
* nspawn: create empty /etc/resolv.conf if necessaryZbigniew Jędrzejewski-Szmek2013-04-18
| | | | | | | | | | | | nspawn will overmount resolv.conf if it exists. Since e.g. default install with yum doesn't create /etc/resolv.conf, a container created with yum will not have network. This seems undesirable, and since we overmount the file anyway, let's create it too. Also, mounting a read-write /etc/resolv.conf in the container is treated as a failure, since it makes it possible to modify hosts /etc/resolv.conf from inside the container.
* move _cleanup_ attribute in front of the typeHarald Hoyer2013-04-18
| | | | http://lists.freedesktop.org/archives/systemd-devel/2013-April/010510.html
* path-util: unify code for detecting OS treesLennart Poettering2013-04-16
| | | | | This also makes sure we always detect an OS tree the same way, by checking for /etc/os-release.
* nspawn: introduce the new /machine/ tree in the cgroup tree and move ↵Lennart Poettering2013-04-16
| | | | | | | | | | | | | | containers there Containers will now carry a label (normally derived from the root directory name, but configurable by the user), and the container's root cgroup is /machine/<label>. This label is called "machine name", and can cover both containers and VMs (as soon as libvirt also makes use of /machine/). libsystemd-login can be used to query the machine name from a process. This patch also includes numerous clean-ups for the cgroup code.
* Use initalization instead of explicit zeroingZbigniew Jędrzejewski-Szmek2013-04-05
| | | | | | | | | | | | | | | | | | | | | | | Before, we would initialize many fields twice: first by filling the structure with zeros, and then a second time with the real values. We can let the compiler do the job for us, avoiding one copy. A downside of this patch is that text gets slightly bigger. This is because all zero() calls are effectively inlined: $ size build/.libs/systemd text data bss dec hex filename before 897737 107300 2560 1007597 f5fed build/.libs/systemd after 897873 107300 2560 1007733 f6075 build/.libs/systemd … actually less than 1‰. A few asserts that the parameter is not null had to be removed. I don't think this changes much, because first, it is quite unlikely for the assert to fail, and second, an immediate SEGV is almost as good as an assert.
* util: rename write_one_line_file() to write_string_file()Lennart Poettering2013-04-03
| | | | | You can write much more than just one line with this call (and we frequently do), so let's correct the naming.
* nspawn, machine-id-setup: warn if read-only mount call failsZbigniew Jędrzejewski-Szmek2013-03-31
| | | | They are not crucial, but they shouldn't fail.
* nspawn: don't make assumptions about the size of pid_tLennart Poettering2013-03-15
|
* nspawn: create a separate devpts namespace for nspawn containersLennart Poettering2013-03-07
|
* nspawn: environment would be truncated with TERM unsetZbigniew Jędrzejewski-Szmek2013-02-27
|
* nspawn: add --bind= and --bind-ro= to bind mount host paths into the containerLennart Poettering2013-02-25
|
* Revert "nspawn: catch config mistake of specifying -b and args"Michal Schmidt2013-02-25
| | | | | | | | | This reverts commit cb96a2c69a312fb089fef4501650f4fc40a1420b. It is not a mistake to pass args when -b is specified. They will simply be passed on to the container's init. The manpage needs fixing, that's true.
* nspawn: catch config mistake of specifying -b and argsZbigniew Jędrzejewski-Szmek2013-02-24
|
* nspawn: fail if unable to close pipeZbigniew Jędrzejewski-Szmek2013-02-14
|
* nspawn: print PID and show how to enter the namespaceZbigniew Jędrzejewski-Szmek2013-02-14
| | | | | | | | | | | systemd-nspawn will now print the PID of the child. An example showing how to enter the container is added to the man page. Support for nsenter without an explicit command was added in https://github.com/karelzak/util-linux/commit/5758069 (post v2.22.2). So this example requires both a new kernel and the latest util-linux.
* honor SELinux labels, when creating and writing config filesHarald Hoyer2013-02-14
| | | | | | | Also split out some fileio functions to fileio.c and provide a SELinux aware pendant in fileio-label.c see https://bugzilla.redhat.com/show_bug.cgi?id=881577
* nspawn: assume stdout is always writable if it does not support epollMichal Schmidt2013-01-26
| | | | | | | stdout can be redirected to a regular file. Regular files don't support epoll. nspawn failed with: "Failed to register fds in epoll: Operation not permitted". If stdout does not support epoll, assume it's always writable.
* nspawn: add audit caps to default set to keepLennart Poettering2013-01-18
| | | | | | | | | | | | | Due to the brokeness of much of the userspace audit code we cannot really start too many systems without the audit caps set. To make nspawn easier to use just add the audit caps by default. To boot up containers successfully the kernel's auditing needs to be turned off still (use "audit=0" on the kernel command line), but at least no manual caps have to be passed anymore. In the long run auditing will be fixed for containers and ve virtualized properly at which time it should be safe to enable these caps anyway.
* nspawn: add --versionZbigniew Jędrzejewski-Szmek2013-01-11
|
* nspawn: try to orderly shutdown container when receiving SIGTERMLennart Poettering2012-12-22
|
* nspawn: allow passing socket activation fds through nspawnLennart Poettering2012-12-22
|
* nspawn: allow nspawn to be invoked without ttyLennart Poettering2012-12-22
| | | | | This allows invoking nspawn containers as systemd services, to create a minimal, light-weight OS container solution for servers.
* nspawn: reset supplementary and main group id before entering nspawnLennart Poettering2012-11-22
|
* nspawn: use automatic cleanup and provide debug infoZbigniew Jędrzejewski-Szmek2012-10-02
| | | | The documentation for --link-journal is also reworded.
* log: fix repeated invocation of vsnprintf()/vaprintf() in log_struct()Lennart Poettering2012-09-24
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=55213
* nspawn: document why we don't check resolv.conf mount errorsLennart Poettering2012-09-21
|
* nspawn: we can't overmount /etc/localtime anymore since it's usually a ↵Lennart Poettering2012-09-21
| | | | | | symlink now Create the right symlink if possible for /etc/localtime
* nspawn: fix memleak introduced with automatic cleanupZbigniew Jędrzejewski-Szmek2012-09-16
| | | | | 6b2d0e8 introduced a memleak instead of fixing one. Fix both.
* nspawn: use automatic cleanup for umaskZbigniew Jędrzejewski-Szmek2012-09-16
|
* nspawn: _cleanup_free_ moreZbigniew Jędrzejewski-Szmek2012-09-16
|
* nspawn: use automatic cleanupZbigniew Jędrzejewski-Szmek2012-09-16
| | | | This one actually clears up a (totally harmless) memleak.
* nspawn: mount tmpfs on /dev/shmZbigniew Jędrzejewski-Szmek2012-09-16
| | | | | | | | | | | Most things seem to function fine without /dev/shm, but it is expected to be there (quoting linux/Documentation/filesystems/tmpfs.txt: glibc 2.2 and above expects tmpfs to be mounted at /dev/shm for POSIX shared memory (shm_open, shm_unlink)). Since /tmp/ is already mounted as tmpfs, it would be enough to mkdir /tmp/shm and chmod it. Mounting it separately has the advantage that it can be easily remounted to change the quota.
* nspawn: handle poweroff/reboot nicely in containersLennart Poettering2012-09-05
|
* nspawn: don't provide /dev/rtc0 in the containerLennart Poettering2012-09-05
| | | | | Since RTCs are hardware devices and are very much shared resources we should avoid to provide them in each container.
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-14 21:27:21 +0000