Dne 16.3.2016 v 17:17 Serguei Bezverkhi (sbezverk) napsal(a):
Hi John,
At least in our situation, Dockers do not own LV and nothing prevents in theory LV created by a process in one container, to be removed by another process in another container. It is exactly the same if two processed are trying to do the same thing. In both cases if a volume is busy no process will be able to remove it.
In our case, dockers are more like process wrapper, it does not holds any resources other than it needs to run this one process.
I hope it clarifies a bit the approach we took.
Giving docker container root privileges to execute lvm2 command (or in effect
any other root commands!) is just not the docker is supposed to be used (IMHO).
You are just making the security hole bigger and bigger...
But I assume there is no way to convince you it's serious mistake with this
approach...
Regards
Zdenek
-----Original Message-----
From: linux-lvm-bounces@redhat.com [mailto:linux-lvm-bounces@redhat.com] On Behalf Of John Stoffel
Sent: Wednesday, March 16, 2016 11:43 AM
To: LVM general discussion and development <linux-lvm@redhat.com>
Subject: Re: disabling udev_sync and udev_rules
So what's to keep a docker container from deleting all your other LVs that it shouldn't know about?
If I have a VG called coontainers, with a bunch of LVs called c1, c2, ... , cN.
What is to keep c1 from nuking the LV in c2?
John
_______________________________________________
linux-lvm mailing list
linux-lvm@redhat.com
https://www.redhat.com/mailman/listinfo/linux-lvm
read the LVM HOW-TO at http://tldp.org/HOWTO/LVM-HOWTO/
_______________________________________________
linux-lvm mailing list
linux-lvm@redhat.com
https://www.redhat.com/mailman/listinfo/linux-lvm
read the LVM HOW-TO at http://tldp.org/HOWTO/LVM-HOWTO/
_______________________________________________
linux-lvm mailing list
linux-lvm@redhat.com
https://www.redhat.com/mailman/listinfo/linux-lvm
read the LVM HOW-TO at http://tldp.org/HOWTO/LVM-HOWTO/
