On Wed, Aug 21, 2013 at 9:22 AM, Gao feng <gaofeng@xxxxxxxxxxxxxx> wrote: > On 08/21/2013 03:06 PM, Eric W. Biederman wrote: >> I suspect libvirt should simply not share /run or any other normally >> writable directory with the host. Sharing /run /var/run or even /tmp >> seems extremely dubious if you want some kind of containment, and >> without strange things spilling through. Right, /run or /var cannot be shared. It's not only about sockets, many other things will also go really wrong that way. > right now I only take note of the unix socket /run/systemd/private, > but there may have many similar unix sockets, they can exist in any > path. the strange problems will still happen. > > anyway, I will send a patch to setup a fresh tmpfs for the /run directory of > container first. This is what systemd-nspawn does for a container setup: http://cgit.freedesktop.org/systemd/systemd/tree/src/nspawn/nspawn.c#n350 Kay _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
