On 2013-07-30 17:52, "Daniel P. Berrange" <berrange@redhat.com> wrote:
On Tue, Jul 30, 2013 at 05:49:28PM +0800, hzguanqiang wrote: Hi Guys, I started a lxc container with libvit in ubuntu Operating system, and succeed using lxc-enter-namespace to enter the namespaces and security context of the container. But when I do the same thing in debian OS, It reported an error, with details as following:
root@debian:/etc# vir list Id Name State ---------------------------------------------------- 4424 instance-00000007 running 25913 instance-00000008 running
root@debian:/etc# vir dumpxml 4424 <domain type='lxc' id='4424'> <name>instance-00000007</name> <uuid>f1ce5360-bb5e-4cfc-b5ef-d05f8db52618</uuid> <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>3</vcpu> <resource> <partition>/machine</partition> </resource> <os> <type arch='x86_64'>exe</type> <init>/sbin/init</init> <cmdline>console=tty0 console=ttyS0</cmdline> </os> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/lib/libvirt/libvirt_lxc</emulator> <filesystem type='mount' accessmode='passthrough'> <source dir='/opt/stack/data/nova/instances/f1ce5360-bb5e-4cfc-b5ef-d05f8db52618/rootfs'/> <target dir='/'/> </filesystem> <interface type='bridge'> <mac address='fa:16:3e:3a:c6:11'/> <source bridge='br100'/> <target dev='veth0'/> <filterref filter='nova-instance-instance-00000007-fa163e3ac611'/> </interface> <console type='pty' tty='/dev/pts/1'> <source path='/dev/pts/1'/> <target type='lxc' port='0'/> <alias name='console0'/> </console> </devices> <seclabel type='none'/> </domain>
root@debian:/etc# vir lxc-enter-namespace 4424 /bin/sh/ libvirt: error : argument unsupported: Security model cannot be entered
Is there anything that needs to be configured in debian OS for using the 'lxc-enter-namespace' interface?
Hmm, that's a bug in virsh. As a workaround use the --noseclabel flag
Well, Daniel. I succeed to try 'lxc-enter-namespace' with --noseclabel flag to get the disk space info of the lxc container. But the result is not what it might be. The operations I did are just as following: root@debian:~# vir version Compiled against library: libvirt 1.1.0 Using library: libvirt 1.1.0 Using API: LXC 1.1.0 Running hypervisor: LXC 3.2.46 root@debian:~# vir list Id Name State ---------------------------------------------------- 4424 instance-00000007 running 25913 instance-00000008 running root@debian:~# vir lxc-enter-namespace 4424 --noseclabel /bin/df -hl Filesystem Size Used Avail Use% Mounted on rootfs 20G 9.5G 9.3G 51% / udev 10M 0 10M 0% /dev tmpfs 397M 228K 397M 1% /run /dev/disk/by-uuid/cc8a372b-907a-4cd9-a474-1a112033cfd6 20G 9.5G 9.3G 51% / tmpfs 5.0M 0 5.0M 0% /run/lock tmpfs 794M 0 794M 0% /run/shm cgroup 2.0G 0 2.0G 0% /sys/fs/cgroup Then I enter into the lxc container, and execute command 'df -hl' returning a different result as following: root@debian:~# vir console 4424 Connected to domain instance-00000007 Escape character is ^] Ubuntu 12.04.2 LTS lxc1 tty1 lxc1 login: ubuntu Password: Last login: Tue Jul 30 11:02:03 UTC 2013 on pts/0 Welcome to Ubuntu 12.04.2 LTS (GNU/Linux 3.2.46-openstack-amd64 x86_64) * Documentation: https://help.ubuntu.com/ System information as of Tue Jul 30 11:02:54 UTC 2013 System load: 0.08 Processes: 24 Usage of /: 70.5% of 1.35GB Users logged in: 0 Memory usage: 56% IP address for eth0: 10.0.0.2 Swap usage: 0% Graph this data and manage this system at https://landscape.canonical.com/ Get cloud support with Ubuntu Advantage Cloud Guest: http://www.ubuntu.com/business/services/cloud Use Juju to deploy your cloud instances and workloads: https://juju.ubuntu.com/#cloud-precise 31 packages can be updated. 21 updates are security updates. ubuntu@lxc1:~$ df -hl Filesystem Size Used Avail Use% Mounted on /dev/nbd10 1.4G 976M 340M 75% / devfs 64K 8.0K 56K 13% /dev tmpfs 64K 0 64K 0% /sys/fs/cgroup none 397M 12M 385M 3% /run none 5.0M 0 5.0M 0% /run/lock none 2.0G 0 2.0G 0% /run/shm I used to try 'lxc-enter-namespace' to execute df command with libvirt version of 1.0.2 under host of ubuntu OS, and the Operation result is just the same as what I did in lxc container. What's the problem? Could 'lxc-enter-namespace' be different with --noseclabel flag? ------------------ Best regards! GuanQiang 2013-07-30