{"action":"opened","issue":{"url":"https://api.github.com/repos/lxc/lxc/issues/538","labels_url":"https://api.github.com/repos/lxc/lxc/issues/538/labels{/name}","comments_url":"https://api.github.com/repos/lxc/lxc/issues/538/comments","events_url":"https://api.github.com/repos/lxc/lxc/issues/538/events","html_url":"https://github.com/lxc/lxc/issues/538","id":80942050,"number":538,"title":"lxc-start cannot share namespaces in daemon mode or with --close-all-fds","user":{"login":"stewartbrodie","id":6807128,"avatar_url":"https://avatars.githubusercontent.com/u/6807128?v=3","gravatar_id":"","url":"https://api.github.com/users/stewartbrodie","html_url":"https://github.com/stewartbrodie","followers_url":"https://api.github.com/users/stewartbrodie/followers","following_url":"https://api.github.com/users/stewartbrodie/following{/other_user}","gists_url":"https://api.github.com/users/stewartbrodie/gists{/gist_id}","starred_url":"https://api.github.com/users/stewartbrodie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stewartbrodie/subscriptions","organizations_url":"https://api.github.com/users/stewartbrodie/orgs","repos_url":"https://api.github.com/users/stewartbrodie/repos","events_url":"https://api.github.com/users/stewartbrodie/events{/privacy}","received_events_url":"https://api.github.com/users/stewartbrodie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-26T12:31:28Z","updated_at":"2015-05-26T12:31:28Z","closed_at":null,"body":"Version: lxc-1.1.2\r\n\r\nNone of the namespace sharing options for lxc-start (--share-net --share-ipc --share-uts) work if the container is being started with the --close-all-fds option.  Since this option is implied by --daemon, then the problem occurs in daemon mode as well.\r\n\r\nNamespaces can be shared succcessfully if the --foreground option is specified and --close-all-fds is not specified.\r\n\r\ne.g. lxc-start -n net --share-ipc $$\r\n\r\nThe initial lxc-start process successfully opens /proc/$$/ns/ipc but after the double-fork, the grandchild process then very early on closes the file descriptor before it's called setns().  Subsequently, the setns() call fails with EINVAL because it doesn't like the file descriptor.  In the cases I've seen, the file descriptor is open as it happens to have been re-used.  If it hadn't been, I expect I'd have seen EBADFD instead.\r\n\r\nI did a quick experiment whereby I made lxc_check_inherited() ignore any fds it finds in conf->inherit_ns_fd[] and whilst that seems to achieve the effect I want (the container starts and appears to be using the inherited IPC namespace), it makes other things unhappy.  (Is it because I'm interfering with the IPC namespace?)\r\n\r\n<log>\r\n/ # lxc-start -n net --logfile /tmp/net.log --logpriority TRACE --share-ipc 1\r\nlxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 10\r\nlxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 50\r\nlxc-start: monitor.c: lxc_monitor_open: 208 connect : backing off 100\r\nlxc-start: monitor.c: lxc_monitor_open: 213 connect : Connection refused\r\nlxc-start: lxc_start.c: main: 344 The container failed to start.\r\nlxc-start: lxc_start.c: main: 346 To get more details, run the container in foreground mode.\r\nlxc-start: lxc_start.c: main: 348 Additional information can be obtained by setting the --logfile and --logpriority options.\r\n</log>\r\n<log>\r\nINFO     lxc_monitor - monitor.c:lxc_monitor_sock_name:177 - using monitor sock name lxc/526ce194f37e8eec//containers\r\nERROR    lxc_monitor - monitor.c:lxc_monitor_open:208 - connect : backing off 10\r\nERROR    lxc_monitor - monitor.c:lxc_monitor_open:208 - connect : backing off 50\r\nERROR    lxc_monitor - monitor.c:lxc_monitor_open:208 - connect : backing off 100\r\nERROR    lxc_monitor - monitor.c:lxc_monitor_open:213 - connect : Connection refused\r\n</log>\r\n\r\nOne way for me to get around this for the time being is to use the foreground option, but this is really ugly:  setsid setsid lxc-start -F -n net --share-ipc $$"}}