move monitor-fifo and monitor-sock to /run

Moving these files should allow $lxcpath to be a read-only fs.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
cgroup: address some style+safety issues

three issues raised by Christian Seiler: use pid_t, use snprintf,
and use const.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
hash lxcname for use in monitor unix socket sun_path[108]

- Also convert to unix abstract socket
- A simple FNV hash is used instead of SHA-1 since we may not HAVE_GNUTLS

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
ignore ability to init /lxc-monitord.log

We may long-term want to instead decide on a convention under
/var/log, but for now just ignore it.  This will only happen
if lxcpath is read-only.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Update .gitignore

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
utils: Add lxc_append_paths to join two paths.

Signed-off-by: Christian Seiler <christian@iwakd.de>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
cgroup: Split legacy 'ns' cgroup handling off from main cgroup handling

This patch splits off ns legacy cgroup handling from main cgroup
handling. It moves the creation of the cgroups before clone(), so that
the child will easily know which cgroups it will later belong to. Since
this is not possible for the renaming of the 'ns' cgroup, keep that
part after clone.

Signed-off-by: Christian Seiler <christian@iwakd.de>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
cgroup: Add lxc_setup_mount_cgroup to setup /sys/fs/cgroup inside the container

Add funbction to mount cgroup filesystem hierarchy into the container,
allowing only access to the parts that the container should have access
to, but none else.

Signed-off-by: Christian Seiler <christian@iwakd.de>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Support for automatic mounting of filesystems

This patch adds the lxc.mount.auto configuration option that allows the
user to specify that certain standard filesystems should be
automatically pre-mounted when the container is started.

Currently, four things are implemented:

 - /proc          (mounted read-write)
 - /sys           (mounted read-only)
 - /sys/fs/cgroup (special logic, see mailing list discussions)
 - /proc/sysrq-trigger (see below)

/proc/sysrq-trigger may be used from within a container to trigger a
forced host reboot (echo b > /proc/sysrq-trigger) or do other things
that a container shouldn't be able to do. The logic here is to
bind-mount /dev/null over /proc/sysrq-trigger, so that that cannot
happen. This obviously only protects fully if CAP_SYS_ADMIN is not
available inside the container (otherwise that bind-mount could be
removed).

Signed-off-by: Christian Seiler <christian@iwakd.de>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Change rootfs pinning mechnism

Chane pinning mechanism: Use $rootfs/lxc.hold instead of $rootfs.hold
(in case $rootfs is a mountpoint itself), but delete the file
immediately after creating it (but keep it open). This will keep the
root filesystem busy but does not leave any unnecessary files lying
around.

Signed-off-by: Christian Seiler <christian@iwakd.de>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
snapshots: add man page and fix up help info a bit.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
tests: Introduce lxc-test-concurrent for testing basic actions concurrently

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
use busybox instead of ubuntu to test as it's much more lightweight, also wait containers to enter desired state

Signed-off-by: S.Çağlar Onur <caglar@10ur.org>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
add pstore to container fstab

Otherwise user-namespace containers will hang on mountall.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
concurrent: take lxc template to use as argument

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
api_create and api_start: work toward making them thread-safe

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Revert "api_create and api_start: work toward making them thread-safe"

This should deadlock with daemonized start due to af_unix changes.

Do this later, but do it more carefully.

This reverts commit 002f3cff4d83c0666cfda40599eded8e0d638c6c.
cgroup: add bdev.h to fix the build error

Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
ubuntu templates: make pstore fstab entry optional

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
.gitignore generated Japanese manpages

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>