Hi,
following the hints given by Serge Hallyn on the lxc-devel list, I
managed to run an unprivileged container on my Debian Jessie \o/
Now, I want to avoid handlings and get it works on startup. Thus, I set
permanently kernel.unprivileged_userns_clone to 1 and I create a systemd
service to run the following script:
#!/bin/bash
echo 1 > /sys/fs/cgroup/cpuset/cgroup.clone_children
# Allowed users
lxc_users="user1 user2"
for u in $lxc_users; do
for d in /sys/fs/cgroup/*; do
mkdir -p $d/$u
chown -R $u: $d/$u
done
done
The only thing that I need now is to put a 'good' PID in the tasks files
in order to be allowed to start my unprivileged containers. I can do
that by login as an allowed user and by putting the PID of the current
shell in my tasks file. But this solution is volatile and has to be done
on each startup for each container :-/
Is my approach good? Maybe there is a simpler solution to my problem...
If this is the way, how can I put a valid PID in the tasks files of the
allowed users on startup in order, for example, to autostart some
unprivileged containers?
Thanks,
Xavier
_______________________________________________
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users
