{"action":"opened","number":1093,"pull_request":{"url":"https://api.github.com/repos/lxc/lxd/pulls/1093","id":44717192,"html_url":"https://github.com/lxc/lxd/pull/1093","diff_url":"https://github.com/lxc/lxd/pull/1093.diff","patch_url":"https://github.com/lxc/lxd/pull/1093.patch","issue_url":"https://api.github.com/repos/lxc/lxd/issues/1093","number":1093,"state":"open","locked":false,"title":"Support nested lxd [RFC]","user":{"login":"hallyn","id":1359441,"avatar_url":"https://avatars.githubusercontent.com/u/1359441?v=3","gravatar_id":"","url":"https://api.github.com/users/hallyn","html_url":"https://github.com/hallyn","followers_url":"https://api.github.com/users/hallyn/followers","following_url":"https://api.github.com/users/hallyn/following{/other_user}","gists_url":"https://api.github.com/users/hallyn/gists{/gist_id}","starred_url":"https://api.github.com/users/hallyn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hallyn/subscriptions","organizations_url":"https://api.github.com/users/hallyn/orgs","repos_url":"https://api.github.com/users/hallyn/repos","events_url":"https://api.github.com/users/hallyn/events{/privacy}","received_events_url":"https://api.github.com/users/hallyn/received_events","type":"User","site_admin":false},"body":"Closes: #1002 \r\n\r\nNOTE - this is for discussion, not yet for merge\r\n\r\nWhen running lxd inside a lxd container, a few things must be done differently.\r\n\r\nFirst, we cannot create devices.  This means when init'ing a container we have\r\nto avoid extracting the devices as that will fail.\r\n\r\nSecondly, we need some extra permissions from apparmor for mounting and\r\npivot_root.\r\n\r\nThirdly, we cannot load new apparmor policies, so avoid that.  Intead, tell\r\nlxc to use the same policy we are currently in.  (There is no way to tell\r\nlxc \"don't switch apparmor profiles at all\")  We support running lxd\r\ncontainers under a lxc-container-default-with-nesting profile, as well\r\nas supporting lxc-container-default containers under lxd containers.\r\n\r\nHOWTO\r\n\r\nTo tell lxd that a container should allow nesting containers inside itself,\r\nyou should\r\n\r\n1. set 'security.nesting = 1' in the container configuration or profile\r\n2. make sure that root has a wide enough uidgid allocation to support the\r\n   nesting.  If the allocated subuids in the nested containers will be\r\n   the default '100000:65536', then you must have a range of at least\r\n   165537 uids.  I usually just use\r\n\t   root:200000:200000\r\n   in the host's subuid and subgid files.\r\n\r\nTODO: instead of just excluding /dev/* in tar, use archive/tar by hand and\r\n      skip all devices\r\nTODO: figure out a way to not need 'mount,' apparmor rule.  As far as we know\r\n      this is currently still needed because of a bug in apparmor which\r\n      doesn't allow a mount rule combining 'remount' with other permissions,\r\n      so we cannot allow 'remount -o remount,bind,ro'.\r\n\r\nsidenote: I did also try to support the archive extraction using seccomp.\r\n\t  Simply using seccomp_errno to return errno 0 for mknod and mknodat\r\n\t  without creating the device does not suffice, because tar then\r\n\t  checks the utime of the created node.  Using seccomp_trap doesn't\r\n\t  work because we cannot catch sigsys for the tar we spawn.  However,\r\n\t  we should be able to (1) start the tar under seccomp and ptrace,\r\n\t  (2) use seccomp_ret_trace for mknod and mknodat, create a file\r\n\t  in place of the device, then continue the task.  This would\r\n\t  require us to be able to use ptrace to find the path to be\r\n\t  created.\r\n\r\nSigned-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>","created_at":"2015-09-10T20:46:36Z","updated_at":"2015-09-10T20:46:36Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/lxc/lxd/pulls/1093/commits","review_comments_url":"https://api.github.com/repos/lxc/lxd/pulls/1093/comments","review_comment_url":"https://api.github.com/repos/lxc/lxd/pulls/comments{/number}","comments_url":"https://api.github.com/repos/lxc/lxd/issues/1093/comments","statuses_url":"https://api.github.com/repos/lxc/lxd/statuses/818bc9f15795f6ea0e27ecb1e38625ace4fb33be","head":{"label":"hallyn:nesting","ref":"nesting","sha":"818bc9f15795f6ea0e27ecb1e38625ace4fb33be","user":{"login":"hallyn","id":1359441,"avatar_url":"https://avatars.githubusercontent.com/u/1359441?v=3","gravatar_id":"","url":"https://api.github.com/users/hallyn","html_url":"https://github.com/hallyn","followers_url":"https://api.github.com/users/hallyn/followers","following_url":"https://api.github.com/users/hallyn/following{/other_user}","gists_url":"https://api.github.com/users/hallyn/gists{/gist_id}","starred_url":"https://api.github.com/users/hallyn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hallyn/subscriptions","organizations_url":"https://api.github.com/users/hallyn/orgs","repos_url":"https://api.github.com/users/hallyn/repos","events_url":"https://api.github.com/users/hallyn/events{/privacy}","received_events_url":"https://api.github.com/users/hallyn/received_events","type":"User","site_admin":false},"repo":{"id":26297086,"name":"lxd","full_name":"hallyn/lxd","owner":{"login":"hallyn","id":1359441,"avatar_url":"https://avatars.githubusercontent.com/u/1359441?v=3","gravatar_id":"","url":"https://api.github.com/users/hallyn","html_url":"https://github.com/hallyn","followers_url":"https://api.github.com/users/hallyn/followers","following_url":"https://api.github.com/users/hallyn/following{/other_user}","gists_url":"https://api.github.com/users/hallyn/gists{/gist_id}","starred_url":"https://api.github.com/users/hallyn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hallyn/subscriptions","organizations_url":"https://api.github.com/users/hallyn/orgs","repos_url":"https://api.github.com/users/hallyn/repos","events_url":"https://api.github.com/users/hallyn/events{/privacy}","received_events_url":"https://api.github.com/users/hallyn/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/hallyn/lxd","description":"lxd (pronounced lex-dee) is a REST API, command line tool and OpenStack plugin based on liblxc","fork":true,"url":"https://api.github.com/repos/hallyn/lxd","forks_url":"https://api.github.com/repos/hallyn/lxd/forks","keys_url":"https://api.github.com/repos/hallyn/lxd/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hallyn/lxd/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hallyn/lxd/teams","hooks_url":"https://api.github.com/repos/hallyn/lxd/hooks","issue_events_url":"https://api.github.com/repos/hallyn/lxd/issues/events{/number}","events_url":"https://api.github.com/repos/hallyn/lxd/events","assignees_url":"https://api.github.com/repos/hallyn/lxd/assignees{/user}","branches_url":"https://api.github.com/repos/hallyn/lxd/branches{/branch}","tags_url":"https://api.github.com/repos/hallyn/lxd/tags","blobs_url":"https://api.github.com/repos/hallyn/lxd/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hallyn/lxd/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hallyn/lxd/git/refs{/sha}","trees_url":"https://api.github.com/repos/hallyn/lxd/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hallyn/lxd/statuses/{sha}","languages_url":"https://api.github.com/repos/hallyn/lxd/languages","stargazers_url":"https://api.github.com/repos/hallyn/lxd/stargazers","contributors_url":"https://api.github.com/repos/hallyn/lxd/contributors","subscribers_url":"https://api.github.com/repos/hallyn/lxd/subscribers","subscription_url":"https://api.github.com/repos/hallyn/lxd/subscription","commits_url":"https://api.github.com/repos/hallyn/lxd/commits{/sha}","git_commits_url":"https://api.github.com/repos/hallyn/lxd/git/commits{/sha}","comments_url":"https://api.github.com/repos/hallyn/lxd/comments{/number}","issue_comment_url":"https://api.github.com/repos/hallyn/lxd/issues/comments{/number}","contents_url":"https://api.github.com/repos/hallyn/lxd/contents/{+path}","compare_url":"https://api.github.com/repos/hallyn/lxd/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hallyn/lxd/merges","archive_url":"https://api.github.com/repos/hallyn/lxd/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hallyn/lxd/downloads","issues_url":"https://api.github.com/repos/hallyn/lxd/issues{/number}","pulls_url":"https://api.github.com/repos/hallyn/lxd/pulls{/number}","milestones_url":"https://api.github.com/repos/hallyn/lxd/milestones{/number}","notifications_url":"https://api.github.com/repos/hallyn/lxd/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hallyn/lxd/labels{/name}","releases_url":"https://api.github.com/repos/hallyn/lxd/releases{/id}","created_at":"2014-11-07T00:48:12Z","updated_at":"2015-07-02T21:56:05Z","pushed_at":"2015-09-10T20:33:24Z","git_url":"git://github.com/hallyn/lxd.git","ssh_url":"git@github.com:hallyn/lxd.git","clone_url":"https://github.com/hallyn/lxd.git","svn_url":"https://github.com/hallyn/lxd","homepage":"https://linuxcontainers.org","size":4359,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"lxc:master","ref":"master","sha":"709b8737c50cded72410b8be0b07b3234eb4ea4f","user":{"login":"lxc","id":2301756,"avatar_url":"https://avatars.githubusercontent.com/u/2301756?v=3","gravatar_id":"","url":"https://api.github.com/users/lxc","html_url":"https://github.com/lxc","followers_url":"https://api.github.com/users/lxc/followers","following_url":"https://api.github.com/users/lxc/following{/other_user}","gists_url":"https://api.github.com/users/lxc/gists{/gist_id}","starred_url":"https://api.github.com/users/lxc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lxc/subscriptions","organizations_url":"https://api.github.com/users/lxc/orgs","repos_url":"https://api.github.com/users/lxc/repos","events_url":"https://api.github.com/users/lxc/events{/privacy}","received_events_url":"https://api.github.com/users/lxc/received_events","type":"Organization","site_admin":false},"repo":{"id":26192117,"name":"lxd","full_name":"lxc/lxd","owner":{"login":"lxc","id":2301756,"avatar_url":"https://avatars.githubusercontent.com/u/2301756?v=3","gravatar_id":"","url":"https://api.github.com/users/lxc","html_url":"https://github.com/lxc","followers_url":"https://api.github.com/users/lxc/followers","following_url":"https://api.github.com/users/lxc/following{/other_user}","gists_url":"https://api.github.com/users/lxc/gists{/gist_id}","starred_url":"https://api.github.com/users/lxc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lxc/subscriptions","organizations_url":"https://api.github.com/users/lxc/orgs","repos_url":"https://api.github.com/users/lxc/repos","events_url":"https://api.github.com/users/lxc/events{/privacy}","received_events_url":"https://api.github.com/users/lxc/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/lxc/lxd","description":"Daemon based on liblxc offering a REST API to manage containers","fork":false,"url":"https://api.github.com/repos/lxc/lxd","forks_url":"https://api.github.com/repos/lxc/lxd/forks","keys_url":"https://api.github.com/repos/lxc/lxd/keys{/key_id}","collaborators_url":"https://api.github.com/repos/lxc/lxd/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/lxc/lxd/teams","hooks_url":"https://api.github.com/repos/lxc/lxd/hooks","issue_events_url":"https://api.github.com/repos/lxc/lxd/issues/events{/number}","events_url":"https://api.github.com/repos/lxc/lxd/events","assignees_url":"https://api.github.com/repos/lxc/lxd/assignees{/user}","branches_url":"https://api.github.com/repos/lxc/lxd/branches{/branch}","tags_url":"https://api.github.com/repos/lxc/lxd/tags","blobs_url":"https://api.github.com/repos/lxc/lxd/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/lxc/lxd/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/lxc/lxd/git/refs{/sha}","trees_url":"https://api.github.com/repos/lxc/lxd/git/trees{/sha}","statuses_url":"https://api.github.com/repos/lxc/lxd/statuses/{sha}","languages_url":"https://api.github.com/repos/lxc/lxd/languages","stargazers_url":"https://api.github.com/repos/lxc/lxd/stargazers","contributors_url":"https://api.github.com/repos/lxc/lxd/contributors","subscribers_url":"https://api.github.com/repos/lxc/lxd/subscribers","subscription_url":"https://api.github.com/repos/lxc/lxd/subscription","commits_url":"https://api.github.com/repos/lxc/lxd/commits{/sha}","git_commits_url":"https://api.github.com/repos/lxc/lxd/git/commits{/sha}","comments_url":"https://api.github.com/repos/lxc/lxd/comments{/number}","issue_comment_url":"https://api.github.com/repos/lxc/lxd/issues/comments{/number}","contents_url":"https://api.github.com/repos/lxc/lxd/contents/{+path}","compare_url":"https://api.github.com/repos/lxc/lxd/compare/{base}...{head}","merges_url":"https://api.github.com/repos/lxc/lxd/merges","archive_url":"https://api.github.com/repos/lxc/lxd/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/lxc/lxd/downloads","issues_url":"https://api.github.com/repos/lxc/lxd/issues{/number}","pulls_url":"https://api.github.com/repos/lxc/lxd/pulls{/number}","milestones_url":"https://api.github.com/repos/lxc/lxd/milestones{/number}","notifications_url":"https://api.github.com/repos/lxc/lxd/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/lxc/lxd/labels{/name}","releases_url":"https://api.github.com/repos/lxc/lxd/releases{/id}","created_at":"2014-11-04T22:40:52Z","updated_at":"2015-09-07T21:05:23Z","pushed_at":"2015-09-09T19:15:15Z","git_url":"git://github.com/lxc/lxd.git","ssh_url":"git@github.com:lxc/lxd.git","clone_url":"https://github.com/lxc/lxd.git","svn_url":"https://github.com/lxc/lxd","homepage":"https://linuxcontainers.org","size":7668,"stargazers_count":580,"watchers_count":580,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":84,"mirror_url":null,"open_issues_count":54,"forks":84,"open_issues":54,"watchers":580,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/lxc/lxd/pulls/1093"},"html":{"href":"https://github.com/lxc/lxd/pull/1093"},"issue":{"href":"https://api.github.com/repos/lxc/lxd/issues/1093"},"comments":{"href":"https://api.github.com/repos/lxc/lxd/issues/1093/comments"},"review_comments":{"href":"https://api.github.com/repos/lxc/lxd/pulls/1093/comments"},"review_comment":{"href":"https://api.github.com/repos/lxc/lxd/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/lxc/lxd/pulls/1093/commits"},"statuses":{"href":"https://api.github.com/repos/lxc/lxd/statuses/818bc9f15795f6ea0e27ecb1e38625ace4fb33be"}},"merged":false,"mergeable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"commits":1,"additions":144,"deletions":6,"changed_files":5}}