Re: [libvirt] [PATCH]LXC: force container to enable network namespace

On 08/21/2013 05:53 PM, Daniel P. Berrange wrote: > On Wed, Aug 21, 2013 at 05:49:05PM +0800, Chen Hanxiao wrote: >> From: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com&gt; >> >> If we don't enable network namespace, we could shutdown host >> inside container by command 'shutdown', which is unacceptable. >> This patch will force users to enable network namespace >> before they start container. >> >> Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com&gt; >> --- >> src/lxc/lxc_container.c | 6 ++++++ >> 1 files changed, 6 insertions(+), 0 deletions(-) >> >> diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c >> index c7a22ab..5631ad7 100644 >> --- a/src/lxc/lxc_container.c >> +++ b/src/lxc/lxc_container.c >> @@ -1937,6 +1937,12 @@ int lxcContainerStart(virDomainDefPtr def, >> if (lxcNeedNetworkNamespace(def)) { >> VIR_DEBUG("Enable network namespaces"); >> cflags |= CLONE_NEWNET; >> + } else { >> + errno = EINVAL; >> + >> + virReportSystemError(errno, "%s", >> + _("Network namespace needed")); >> + return -1; >> } >> >> pid = clone(lxcContainerChild, stacktop, cflags, &args); > > NACK. > > We explicitly want to allow containers sharing the host's network > namespace. If you wish to prevent the problem you describe, then > set the <privnet/> feature in the XML, or configure virtual NICs > At least we should give user some warning message or add a notification about the probable reboot problem if user doesn't configure private net namespace for container.