Deprecate lxc-checkpoint, lxc-kill and lxc-restart

Checkpoint/restart isn't currently supported, so let's not carry those
binaries around until we have proper CRIU support in the API.

lxc-kill is redundant with lxc-stop -k and has been known to confuse user.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
plamo: Improve template

* make simple
* change default download site to http://ftp.ring.gr.jp

Signed-off-by: TAMUKI Shoichi <tamuki@linet.gr.jp>
Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-start: fix the container leak when daemonize

When start container with daemon model, we'll have a new daemon
process in lxcapi_start, whose c->numthreads is 2, inherited
from his father. Even his father return to main(), the
lxc_container_put won't affect son's numthreads.

So when daemon stops, he should return to main and do
lxc_container_put again, rather than exit and leave the
container alone.

Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
cgmanager: &existed for remove+create now returns -1 on failure

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Revert "lxc-start: fix the container leak when daemonize"

This reverts commit c3f0f139e155f53c83e0a81f14094e9d0f40e8e9.

Done as Serge Hallyn's request:
 Nacked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
doc: Remove the description of lxc-kill in Japanese lxc-execute(1)

Update for commit 33ddfc2adef00e3571137ef60d20de328e32d299

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Add Japanese lxc-usernsexec(1) and fix typo English lxc-usernsexec(1)

Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
cgmanager: implement setting of cgroup limits

Also replace a wrong free of nih-allocated variable with nih_free.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
handle unprivileged user calls more gracefully (v3)

Return an error if the function is not supposed to be called by an unprivileged user.
Otherwise those calls fail in the middle of their execution with different reasons.

changes since v2:
- am_unpriv is now a simple geteuid check,
- API functions are now providing error messages,
- lxc-info, lxc-attach are now checking geteuidi,
- lxc-ls is now calling get_ips only if the container is running

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Don't forget network prefix information

Include the IPv4/IPv6 prefix if it's set.

Signed-off-by: Robert Vogelgesang <vogel@users.sourceforge.net>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
lxc-ubuntu-cloud: Default to trying released channel

This adds a fallback to the daily channel if an image couldn't be found
in the released one.

Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Add missing doxygen tag

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
attach: Support unprivileged containers

This change makes lxc-attach and the matching API functions work
properly with unprivileged containers.

The trick needed to make that possible was to always start with the
userns when attaching and also relocate the cgroup management code so
that the intermediate process is moved to the cgroup before attaching to
the container's namespace as doing so later would fail due to missing
permissions.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
utils: Drop trailing / in lxcpath

This fixes command line tools and functions which use
lxc_global_config_value o get lxcpath but don't strip the trailing /
leading to mismatching command path (as lxc_container_new does strip the
path).

As lxcpath is typically a const and so can't easily be changed by the
caller, add the trick directly into lxc_global_config_value (having to
juggle a bit in there too to avoid trying to alter a const).

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Move lxc-user-nic and lxc-monitord to libexec

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
remove no-longer neeeded check from lxcapi_attach_run_waitl

commit f4364484454c754ed905bfb85bd2727a0a5d0475 introduced attach
functionality to unprivileged containers so remove this check like
the rest of the attach functions.

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
plamo: Improve template

Allow to specify additional packages

Signed-off-by: TAMUKI Shoichi <tamuki@linet.gr.jp>
Signed-off-by: KATOH Yasufumi <karma@jazz.email.ne.jp>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
make lxcapi_get_interfaces and lxcapi_get_ips unprivileged container aware

Based on Stéphane's suggestion, those two API methods now;

* fork a new process,
* switch to appropriate namespace(s),
* do what we want,
* return the data over a pipe to the parent which returns the result to the original caller.

For the whole thread please see;

 https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-January/007362.html

This patch also makes lxc-ls and lxc-info call those functions.

I'm adding Stéphane as an author here since both the idea as well as
the initial setns code come from him.

Author: S.Çağlar Onur <caglar@10ur.org>
Author: Stéphane Graber <stgraber@ubuntu.com>
Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Update Fedora and CentOS templates for common conf includes.

This updates the Fedora and CentOS templates to utilize a common
included config.  This is largely based on the changes in the Oracle
template with some exceptions.

Dropping of setpcap (present in the Oracle template) is commented out in
the Fedora template.  It seems to cause problems, such as large login
delays with Fedora 20 containers (but not Fedora 19 - strange).

The Fedora template is further modified to disable systemd-journald.service
as it is unnecessary in a container and causes serious problems when
running in a Fedora 20 container.

The Fedora template is also updated to default to Fedora 20 when running
on a non-Fedora host.

Regards,
Mike

Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Unset lxc.devttydir for userns CentOS

Without this, the container entirely fails to start.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>