Re: [libvirt] [PATCH] Inherit namespace feature

Thanks Daniel and Michal again for your valuable inputs. Please check my reply with text <imran> for some of your comments. And request you to help on those. BTW: should i reply with rework in the new patch. or i should reply to this thread itself? Sorry i am new to the community so yet to get familiar with etiquette.

> > + ns_fd[VIR_DOMAIN_NAMESPACE_SHARENET] = open(path, O_RDONLY); > > + VIR_FREE(path); > > + if (ns_fd[VIR_DOMAIN_NAMESPACE_SHARENET] < 0) { > > + virReportSystemError(errno, > > + _("failed to open netns %s"), > lxcDef->ns_val[VIR_DOMAIN_NAMESPACE_SHARENET]); > > + return -1; > > + } > > + } > > + for (i = 0; i < VIR_DOMAIN_NAMESPACE_LAST; i++) { > > + /* If not yet intialized by above: netns*/ > > + if (lxcDef->ns_type[i] && ns_fd[i] == -1) { > > + pid = strtol(lxcDef->ns_val[i], &eptr, 10); > > + if (*eptr != '\0' || pid < 1) { > > + /* check if the domain is running, then set the > namespaces > > + * to that container > > + */ > > + const char *ns[] = { "user", "ipc", "uts", "net", > "pid", "mnt" }; > > + conn = virConnectOpen("lxc:///"); > > + if (!conn) { > > + virReportError(virGetLastError()->code, > > + _("unable to get connect to lxc %s"), > lxcDef->ns_val[i]); > > + rc = -1; > > + goto cleanup; > > + } > > + dom = virDomainLookupByName(conn, lxcDef->ns_val[i]); > > + if (!dom) { > > + virReportError(virGetLastError()->code, > > + _("Unable to lookup peer containeri > %s"), > > + lxcDef->ns_val[i]); > > + rc = -1; > > + goto cleanup; > > + } > > + if ((nfdlist = virDomainLxcOpenNamespace(dom, &fdlist, > 0)) < 0) { > > + virReportError(virGetLastError()->code, > > + _("Unable to open %s"), > lxcDef->ns_val[i]); > > + rc = -1; > > + goto cleanup; > > + } > > I really hate the idea of the libvirt_lxc program opening a connection > back to libvirtd using virConnectOpen, as that creates a circular > dependancy. It also risks deadlock, because libvirtd will be holding > locks while starting up the container, and you're calling back into > the driver which may then end up acquiring the same lock. > > <imran>: This is where i am finding problem to code. All the driver functions are static and to access them i might have to change the static to non-static.which will not be inline with current design. i don't see circular dependency with this approach as the internal connection is just used to get the fd's. please share any approach to handle this or hope i can keep the current code.

> I think a better approach in general is for libvirtd lxc_process.c > code to be responsible for getting access to all the namespace > file descriptors. We can then pass those pre-opened file descrpitors > down into libvirt_lxc using command line args, in the sme way that > we pass down file descriptors for pre-opened TAP devices. > > eg so we end up running > > libvirt_lxc --netns 23 --pidns 24 --utsns 25 > > or something like that. > <imran>: And useability wise its easier to provide names instead of fds. as if the shared container goes down. the fds wont be valid. with name a simple restart and again get the new fds with names automatically.