Quoting Jean-Marc Pigeon (jmp@xxxxxxx): > Hello, > > > I have done a small utility to build containers > using kernel API 'clone' available with kernel-2.6.31. > So far I am able to run more than 30 different > distribution (from rh7.3 -> fc12) on the same > host. > (ftp://ftp.safe.ca/pub/linux/vzgot to know more.) > > Everything is working fine... > > Except seems HOST and all containers share the > SAME /proc/kmsg, meaning kernel syslog information > are scrambled (useless). > > Namely, I have in iptables, reject packet logging > on the HOST, as soon rsyslog is started on one > container, I can't see my reject packet log anymore. > > Also, container have their own iptables with reject > packet logging which are not displayed too. > > Am I wrong/forgetting something about the /proc/kmsg > sharing? > > If I am right, should ALL /proc/kmsg be isolated from > each other??? > > How could it be done?? Well, the results of do_syslog() should be containerized. Kernel messages (oopses for instance) should always go to the initial container. Shouldn't be hard to do, but the question is what do we tie it to? User namespace? Network namespace? Eric, is this something you've thought about at all? I'm tempted to say userns makes the most sense - if you start a new userns you likely always want private syslog, whereas with netns and pidns you may not. -serge _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/containers
