# lxc-attach

## NAME



           lxc-attach - start a process inside a running container.
    


## SYNOPSIS



           **lxc-attach**{-n, --name _name_} [-f, --rcfile _config_file_] [-a,
                      --arch _arch_] [-e, --elevated-privileges _privileges_]
                      [-s, --namespaces _namespaces_] [-R, --remount-sys-proc]
                      [--keep-env] [--clear-env] [-v, --set-var _variable_]
                      [--keep-var _variable_] [-u, --uid _uid_] [-g, --gid _gid_]
                      [-- _command_]
    


## DESCRIPTION



           **lxc-attach** runs the specified _command_ inside the container speci‐
           fied by _name_. The container has to be running already.
    
           If no _command_ is specified, the current default shell of the  user
           running **lxc-attach** will be looked up inside the container and exe‐
           cuted.  This will fail if no such user exists inside the container
           or the container does not have a working nsswitch mechanism.
    
           Previous versions of **lxc-attach** simply attached to  the  specified
           namespaces of a container and ran a shell or the specified command
           without first allocating a pseudo terminal. This made them vulner‐
           able  to input faking via a TIOCSTI **ioctl** call after switching be‐
           tween userspace execution contexts with different  privilege  lev‐
           els.  Newer  versions  of **lxc-attach** will try to allocate a pseudo
           terminal file descriptor pair on the host and attach any  standard
           file  descriptors  which refer to a terminal to the container side
           of the pseudo terminal before executing a shell or command.  Note,
           that  if none of the standard file descriptors refer to a terminal
           **lxc-attach** will not try to allocate a pseudo terminal. Instead  it
           will simply attach to the containers namespaces and run a shell or
           the specified command.
    


## OPTIONS



           **-f, --rcfile** _config_file_
                  Specify the configuration file to configure the virtualiza‐
                  tion and isolation functionalities for the container.
    
                  This configuration file if present will be used even if
                  there is already a configuration file present in the previ‐
                  ously created container (via lxc-create).
    
           **-a, --arch** _arch_
                  Specify the architecture which the kernel should appear to
                  be running as to the command executed. This option will ac‐
                  cept the same settings as the **lxc.arch** option in container
                  configuration files, see lxc.conf(5). By default, the cur‐
                  rent architecture of the running container will be used.
    
           **-e, --elevated-privileges** _privileges_
                  Do not drop privileges when running _command_ inside the con‐
                  tainer. If this option is specified, the new process will
                  _not_ be added to the container's cgroup(s) and it will not
                  drop its capabilities before executing.
    
                  You may specify privileges, in case you do not want to ele‐
                  vate all of them, as a pipe-separated list, e.g.
                  _CGROUP|LSM_. Allowed values are _CGROUP_ , _CAP_ and _LSM_ repre‐
                  senting cgroup, capabilities and restriction privileges re‐
                  spectively. (The pipe symbol needs to be escaped, e.g.
                  _CGROUP\|LSM_ or quoted, e.g.  _"CGROUP|LSM"_.)
    
                  _Warning:_ This may leak privileges into the container if the
                  command starts subprocesses that remain active after the
                  main process that was attached is terminated. The
                  (re-)starting of daemons inside the container is problemat‐
                  ic, especially if the daemon starts a lot of subprocesses
                  such as **cron** or **sshd**.  _Use with great care._
    
           **-s, --namespaces** _namespaces_
                  Specify the namespaces to attach to, as a pipe-separated
                  list, e.g. _NETWORK|IPC_. Allowed values are _MOUNT_ , _PID_ , _UT‐_
                  _SNAME_ , _IPC_ , _USER_ and _NETWORK_. This allows one to change the
                  context of the process to e.g. the network namespace of the
                  container while retaining the other namespaces as those of
                  the host. (The pipe symbol needs to be escaped, e.g.
                  _MOUNT\|PID_ or quoted, e.g.  _"MOUNT|PID"_.)
    
                  _Important:_ This option implies **-e**.
    
           **-R, --remount-sys-proc**
                  When using **-s** and the mount namespace is not included, this
                  flag will cause **lxc-attach** to remount _/proc_ and _/sys_ to re‐
                  flect the current other namespace contexts.
    
                  Please see the _Notes_ section for more details.
    
                  This option will be ignored if one tries to attach to the
                  mount namespace anyway.
    
           **--keep-env**
                  Keep the current environment for attached programs. This is
                  the current default behaviour (as of version 0.9), but is
                  is likely to change in the future, since this may leak un‐
                  desirable information into the container. If you rely on
                  the environment being available for the attached program,
                  please use this option to be future-proof. In addition to
                  current environment variables, container=lxc will be set.
    
           **--clear-env**
                  Clear the environment before attaching, so no undesired en‐
                  vironment variables leak into the container. The variable
                  container=lxc will be the only environment with which the
                  attached program starts.
    
           **-v, --set-var** _variable_
                  Set an additional environment variable that is seen by the
                  attached program in the container. It is specified in the
                  form of "VAR=VALUE", and can be specified multiple times.
    
           **--keep-var** _variable_
                  Keep a specified environment variable. It can only be spec‐
                  ified in conjunction with _--clear-env_ , and can be specified
                  multiple times.
    
           **-u, --uid** _uid_
                  Executes the _command_ with user ID (use numerical value) _uid_
                  inside the container.
    
           **--g, --gid** _gid_
                  Executes the _command_ with group ID (use numerical value)
                  _gid_ inside the container.
    


## COMMON OPTIONS



           These options are common to most of lxc commands.
    
           **-?, -h, --help**
                  Print a longer usage message than normal.
    
           **--usage**
                  Give the usage message
    
           **-q, --quiet**
                  mute on
    
           **-P, --lxcpath=**_PATH_
                  Use an alternate container path. The default is
                  /var/lib/lxc.
    
           **-o, --logfile=**_FILE_
                  Output to an alternate log _FILE_. The default is no log.
    
           **-l, --logpriority=**_LEVEL_
                  Set log priority to _LEVEL_. The default log priority is ER‐
                  ROR. Possible values are : FATAL, ALERT, CRIT, WARN, ERROR,
                  NOTICE, INFO, DEBUG, TRACE.
    
                  Note that this option is setting the priority of the events
                  log in the alternate log file. It do not have effect on the
                  ERROR events log on stderr.
    
           **-n, --name=**_NAME_
                  Use container identifier _NAME_.  The container identifier
                  format is an alphanumeric string.
    
           **--rcfile=**_FILE_
                  Specify the configuration file to configure the virtualiza‐
                  tion and isolation functionalities for the container.
    
                  This configuration file if present will be used even if
                  there is already a configuration file present in the previ‐
                  ously created container (via lxc-create).
    
           **--version**
                  Show the version number.
    


## EXAMPLES



           To spawn a new shell running inside an existing container, use
    
                     lxc-attach -n container
    
           To restart the cron service of a running Debian container, use
    
                     lxc-attach -n container -- /etc/init.d/cron restart
    
           To deactivate the network link eth1 of a running container that
           does not have the NET_ADMIN capability, use either the **-e** option
           to use increased capabilities, assuming the **ip** tool is installed:
    
                     lxc-attach -n container -e -- /sbin/ip link delete eth1
    
           Or, alternatively, use the **-s** to use the tools installed on the
           host outside the container:
    
                     lxc-attach -n container -s NETWORK -- /sbin/ip link delete eth1
    


## COMPATIBILITY



           Attaching completely (including the pid and mount namespaces) to a
           container requires a kernel of version 3.8 or higher, or a patched
           kernel, please see the lxc website for details. **lxc-attach** will
           fail in that case if used with an unpatched kernel of version 3.7
           and prior.
    
           Nevertheless, it will succeed on an unpatched kernel of version
           3.0 or higher if the **-s** option is used to restrict the namespaces
           that the process is to be attached to to one or more of _NETWORK_ ,
           _IPC_ and _UTSNAME_.
    
           Attaching to user namespaces is supported by kernel 3.8 or higher
           with enabling user namespace.
    


## NOTES



           The Linux _/proc_ and _/sys_ filesystems contain information about
           some quantities that are affected by namespaces, such as the di‐
           rectories named after process ids in _/proc_ or the network inter‐
           face information in _/sys/class/net_. The namespace of the process
           mounting the pseudo-filesystems determines what information is
           shown, _not_ the namespace of the process accessing _/proc_ or _/sys_.
    
           If one uses the **-s** option to only attach to the pid namespace of a
           container, but not its mount namespace (which will contain the
           _/proc_ of the container and not the host), the contents of **/proc**
           will reflect that of the host and not the container. Analogously,
           the same issue occurs when reading the contents of _/sys/class/net_
           and attaching to just the network namespace.
    
           To work around this problem, the **-R** flag provides the option to
           remount _/proc_ and _/sys_ in order for them to reflect the net‐
           work/pid namespace context of the attached process. In order not
           to interfere with the host's actual filesystem, the mount name‐
           space will be unshared (like **lxc-unshare** does) before this is
           done, essentially giving the process a new mount namespace, which
           is identical to the hosts's mount namespace except for the _/proc_
           and _/sys_ filesystems.
    
           Previous versions of **lxc-attach** suffered a bug whereby a user
           could attach to a containers namespace without being placed in a
           writeable cgroup for some critical subsystems. Newer versions of
           **lxc-attach** will check whether a user is in a writeable cgroup for
           those critical subsystems. **lxc-attach** might thus fail unexpectedly
           for some users (E.g. on systems where an unprivileged user is not
           placed in a writeable cgroup in critical subsystems on login.).
           However, this behavior is correct and more secure.
    


## SECURITY



           The **-e** and **-s** options should be used with care, as it may break
           the isolation of the containers if used improperly.
    


* * *