Re: user namespace and fully visible proc and sys mounts

2016-03-07 Thread Eric W. Biederman
Andy Lutomirski writes: > On Mon, Mar 7, 2016 at 4:07 PM, Eric W. Biederman > wrote: >> Andy Lutomirski writes: >> >>> On a related note, can we *please* find a way to constrain namespace >>> creation in a way that might satisfy the RHEL crowd? >> >> I am not certain to what you are referrring

Re: user namespace and fully visible proc and sys mounts

2016-03-07 Thread Andy Lutomirski
On Mon, Mar 7, 2016 at 4:07 PM, Eric W. Biederman wrote: > Andy Lutomirski writes: > >> On a related note, can we *please* find a way to constrain namespace >> creation in a way that might satisfy the RHEL crowd? > > I am not certain to what you are referrring. > > As long as folks are willing to

Re: user namespace and fully visible proc and sys mounts

2016-03-07 Thread Eric W. Biederman
Andy Lutomirski writes: > On a related note, can we *please* find a way to constrain namespace > creation in a way that might satisfy the RHEL crowd? I am not certain to what you are referrring. As long as folks are willing to work with me I am happy to help design and design something that mak

Re: user namespace and fully visible proc and sys mounts

2016-03-06 Thread Serge E. Hallyn
On Sun, Mar 06, 2016 at 07:49:14PM -0800, Andy Lutomirski wrote: > On Sun, Mar 6, 2016 at 7:45 PM, Serge E. Hallyn wrote: > > On Sun, Mar 06, 2016 at 06:24:23PM -0800, Andy Lutomirski wrote: > >> On Mar 6, 2016 2:03 PM, "Eric W. Biederman" wrote: > >> > > >> > "Serge E. Hallyn" writes: > >> > >

Re: user namespace and fully visible proc and sys mounts

2016-03-06 Thread Andy Lutomirski
On Sun, Mar 6, 2016 at 7:45 PM, Serge E. Hallyn wrote: > On Sun, Mar 06, 2016 at 06:24:23PM -0800, Andy Lutomirski wrote: >> On Mar 6, 2016 2:03 PM, "Eric W. Biederman" wrote: >> > >> > "Serge E. Hallyn" writes: >> > >> > > Hi, >> > > >> > > So we've been over this many times... but unfortunate

Re: user namespace and fully visible proc and sys mounts

2016-03-06 Thread Serge E. Hallyn
On Sun, Mar 06, 2016 at 06:24:23PM -0800, Andy Lutomirski wrote: > On Mar 6, 2016 2:03 PM, "Eric W. Biederman" wrote: > > > > "Serge E. Hallyn" writes: > > > > > Hi, > > > > > > So we've been over this many times... but unfortunately there is more > > > breakage to report. Regular privileged an

Re: user namespace and fully visible proc and sys mounts

2016-03-06 Thread Andy Lutomirski
On Mar 6, 2016 2:03 PM, "Eric W. Biederman" wrote: > > "Serge E. Hallyn" writes: > > > Hi, > > > > So we've been over this many times... but unfortunately there is more > > breakage to report. Regular privileged and unprivileged containers > > work all right for us. But running an unprivileged

Re: user namespace and fully visible proc and sys mounts

2016-03-06 Thread Serge E. Hallyn
On Sun, Mar 06, 2016 at 03:53:40PM -0600, Eric W. Biederman wrote: > "Serge E. Hallyn" writes: > > > Hi, > > > > So we've been over this many times... but unfortunately there is more > > breakage to report. Regular privileged and unprivileged containers > > work all right for us. But running a

Re: user namespace and fully visible proc and sys mounts

2016-03-06 Thread Eric W. Biederman
"Serge E. Hallyn" writes: > Hi, > > So we've been over this many times... but unfortunately there is more > breakage to report. Regular privileged and unprivileged containers > work all right for us. But running an unprivileged container inside a > privileged container is blocked. > > When cre