On Mon, 2013-08-26 at 11:35 +0800, Gao feng wrote: > On 08/26/2013 11:19 AM, James Bottomley wrote: > > Yes, we are discussing this problem in this whole thread. I wasn't really watching that bit, since the problem looks solved to me. I was just reacting against the unfortunate notion that a container should run init. > If so, OpenVZ > > has never suffered from that problem and I thought it was fixed > > upstream. I've not tested lxc tools, but the latest vzctl from the > > openvz website will bring up a container on the vanilla 3.9 kernel > > (provided you have USER_NS compiled in) can also be used to reboot the > > container, so I see no reason it wouldn't work for lxc as well. > > > > I'm using libvirt lxc not lxc-tools. > Not all of users enable user namespace, I trust these container > management > tools can have right/proper setting which inhibit this reboot-problem > occur. > but I don't think this reboot-problem won't happen in any > configuration. It sounds like you're setting up your containers wrongly. If a container can reboot the system it means that host root capabilities have leaked into the container, which is a big security no-no. The upstream way of avoiding this is USER_NS (because root in the container is now not root in the host). The OpenVZ kernel uses a different mechanism to solve the problem, but we think USER_NS is the better way to go on this. James -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list