Let's unhide lxc_config_define_add, lxc_config_define_load and
lxc_config_define_free helpers. These functions are safe enough
to be used by external tools. Semantic is also clear.
Reason is that we have lxc-start/lxc-execute tools which
use these symbols. Right now it works, because we just
link a whole liblxc statically to each lxc-* tool...
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
The purpose of it is to tell us if we are compiling
liblxc or lxc test/tool/command.
This thing is needed to exclude unnecessary functions
from being compiled-in in the resulting executables
like lxc-start, lxc-attach, etc.
The problem is that lxc tools (lxc-start, lxc-stop, etc)
depend not only on the liblxc as a shared library, but also
require some non-exported symbols or helpers from liblxc
internals. So, we have to link these executables with some liblxc
object files directly which results in the dependency hell,
because linking one .c file from liblxc may end up having to
link with another one (what contains some dependency) and so on.
By using IN_LIBLXC in the liblxc internals we can selectively
omit some functions from being compiled in such cases.
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
This commit addresses an issue in the OCI template where lxc-create
fails if OCI-cache directory for blob caching is not on the same mount
as the destination OCI directory. lxc-create bails when skopeo tries to
create a hard-link across the two and fails.
For example, if /var/lib/lxc is a bind mountpoint of a random directory
and skopeo fails to hard-link across /var/cache/lxc and /var/lib/lxc
This commit introduces a check where if both directories are on not the
same mount points, it disables blob caching in skopeo and continues.
Serge Hallyn [Fri, 2 Feb 2024 16:41:11 +0000 (10:41 -0600)]
lxc-test-usernic: drop cgroup handling
This stuff is not needed in a modern systemd based system, and in fact
breaks. It would probably be better to detect such a system so that a
non-systemd box can still run this test. But I'm not sure what would be
reliable.
tree-wide: use container_uses_namespace() in less trivial cases
In our current codebase we have a logical pattern:
list_empty(&handler->conf->id_map)
*IF AND ONLY IF*
container does NOT use user namespace
Which is perfectly correct nowadays, but once we (hopefully)
get an "isolated user namespaces" stuff ready it won't be the case.
It will be perfectly fine to have a user namespace with empty
/proc/*/{u,g}id_map files. Nowadays it's also possible,
but this kind of a configuration close to useless and nobody
actually uses it.
No functional changes intended.
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Will be useful in future support for an isolated
user namespaces [1]. I have already played with
that locally and found that in the LXC codebase
we have a bunch of different ways to ensure if
a container uses user namespaces or not.
This commit contains a trivial conversion from
an open-coded version of the container_uses_namespace()
helper to an actual use of the helper.
Cole Miller [Fri, 15 Jul 2022 17:52:52 +0000 (13:52 -0400)]
Disable IPv6 link-local addresses for bridged veth
When creating a bridged veth tunnel, disable assignment of IPv6
link-local addresses on the host's end by writing 1 to
/proc/sys/net/ipv6/conf/NAME/disable_ipv6, if it exists.
Scott Moser [Tue, 22 Aug 2023 18:07:36 +0000 (14:07 -0400)]
Fix start api call to split quoted strings in execute or init command.
If a user of the container.start api call provided NULL for the argv
argument, then lxc would load either 'lxc.execute.cmd' or
'lxc.init.cmd' configuration items as the command.
lxc would just split the string on spaces and end up executing array:
['touch', 'file"', 'one"', '"file', '2"']
This differs from the experience with the `lxc-start` command which
would use lxc_string_split_quoted and execute:
['touch', 'file one', 'file 2']
Note that as described in lxc_string_split_quoted, commands that include
nested quotes and possibly other characters are still a problem. In
those cases, the caller of 'start' can provide an argv array.
get_hierarchy: dont WARN about no usable controller
If I start a container with loglevel WARN, and (on a pretty
stock ubuntu) do lxc-info -n $c, I get
lxc-start media 20230706233337.765 WARN cgfsng - cgroups/cgfsng.c:get_hierarchy:142 - There is no useable cpuacct controller
lxc-start media 20230706233337.765 WARN cgfsng - cgroups/cgfsng.c:get_hierarchy:142 - There is no useable blkio controller
I don't think that's worth WARNing about, so change it to
INFO.
Levent Komurcu [Mon, 26 Jun 2023 07:23:30 +0000 (09:23 +0200)]
Add libarchive tar support for lxc download
This patch fixes unpacking images when the system provided tar is libarchive (bsd-tar). bsd-tar doesn't support 'exclude' flags (--anchored) like gnu-tar does. Instead each exclude path is prepended with ^ to simulate behavior of --anchored when bsd tar is detected.
lxccontainer: extend lxccontainer API with set_timeout
lxccontainer set_timeout method allows to set LXC client
timeout for waiting monitor response.
Right now, it's implemented using the SO_RCVTIMEO client
socket option. (But it's the implementation detail that
can be changed in the future.)
This commit doesn't change behavior, because it's just
adds a new option and setter, but not changes any existing
LXC commands implementation. It's also extends internal API
function lxc_cmd with lxc_cmd_timeout.
Issue #4257
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Let's disable IORING_POLL_ADD_MULTI to workaround an issue
with false-positive POLLIN events in CQ.
In my local setup I managed to fix an issue without this
by making terminal FDs non-blocking, but during full
testsuite execution in Jenkins it was found that issue
still persists. So, let's add this ugly workaround too.
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Let's prevent freezes on read(2) by making a terminal FDs non-blocking.
It was discovered that there is an issue with io_uring mainloop when
multishot poll (IORING_POLL_ADD_MULTI) mode is enabled. Sometimes
false-positive poll events are put into a CQ. It makes further read(2)
stuck forever and blocks all mainloop processing for an infinite time.
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
projects / thirdparty / lxc.git / log
