On Mon, Jun 10, 2013 at 09:07:08AM +0800, Gao feng wrote: Thanks for the quick reply. I was surprised too. I didn't post /proc/mounts to container. libvirt_lxc did it for me. I read http://libvirt.org/drvlxc.html about Filesystem mounts: " In the absence of any explicit configuration, the container will inherit the host OS filesystem mounts. A number of mount points will be made read only, or re-mounted with new instances to provide container specific data. The following special mounts are setup by libvirt * /dev a new "tmpfs" pre-populated with authorized device nodes * /dev/pts a new private "devpts" instance for console devices * /sys the host "sysfs" instance remounted read-only * /proc a new instance of the "proc" filesystem * /proc/sys the host "/proc/sys" bind-mounted read-only * /sys/fs/selinux the host "selinux" instance remounted read-only * /sys/fs/cgroup/NNNN the host cgroups controllers bind-mounted to * only expose the sub-tree associated with the container * /proc/meminfo a FUSE backed file reflecting memory limits of the * container " Can I disable this behavior? How do I specify an explicit configuration? Thanks. my container.xml: (The entire xml file is shown in the my original post)

On 06/10/2013 01:41 PM, pr.G wrote: I mean show the /proc/mounts of container and host in container: cat /proc/mounts [root@Donkey /]# cat /proc/mounts rootfs / rootfs rw 0 0 devpts /dev/pts devpts rw,nosuid,relatime,gid=5,mode=620,ptmxmode=666 0 0 devfs /dev tmpfs rw,nosuid,relatime,size=64k,mode=755 0 0 /dev/sdb2 / ext4 rw,relatime,data=ordered 0 0 proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0 proc /proc/sys proc ro,relatime 0 0 sysfs /sys sysfs ro,relatime 0 0 libvirt /proc/meminfo fuse rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other 0 0 tmpfs /sys/fs/cgroup tmpfs rw,nosuid,nodev,noexec,relatime,size=64k,mode=755,uid=1000,gid=1000 0 0 cgroup /sys/fs/cgroup/cpu,cpuacct cgroup rw,nosuid,nodev,noexec,relatime,cpuacct,cpu 0 0 cgroup /sys/fs/cgroup/cpuset cgroup rw,nosuid,nodev,noexec,relatime,cpuset 0 0 cgroup /sys/fs/cgroup/memory cgroup rw,nosuid,nodev,noexec,relatime,memory 0 0 cgroup /sys/fs/cgroup/devices cgroup rw,nosuid,nodev,noexec,relatime,devices 0 0 cgroup /sys/fs/cgroup/freezer cgroup rw,nosuid,nodev,noexec,relatime,freezer 0 0 cgroup /sys/fs/cgroup/blkio cgroup rw,nosuid,nodev,noexec,relatime,blkio 0 0 cgroup /sys/fs/cgroup/net_cls cgroup rw,nosuid,nodev,noexec,relatime,net_cls 0 0 cgroup /sys/fs/cgroup/perf_event cgroup rw,nosuid,nodev,noexec,relatime,perf_event 0 0 devpts /dev/ptmx devpts rw,nosuid,relatime,gid=5,mode=620,ptmxmode=666 0 0 and in host [root@Donkey libvirt]# cat /proc/mounts rootfs / rootfs rw 0 0 proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0 sysfs /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0 devtmpfs /dev devtmpfs rw,nosuid,size=5081344k,nr_inodes=1270336,mode=755 0 0 securityfs /sys/kernel/security securityfs rw,nosuid,nodev,noexec,relatime 0 0 tmpfs /dev/shm tmpfs rw,nosuid,nodev 0 0 devpts /dev/pts devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0 tmpfs /run tmpfs rw,nosuid,nodev,mode=755 0 0 tmpfs /sys/fs/cgroup tmpfs rw,nosuid,nodev,noexec,mode=755 0 0 cgroup /sys/fs/cgroup/systemd cgroup rw,nosuid,nodev,noexec,relatime,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd 0 0 pstore /sys/fs/pstore pstore rw,nosuid,nodev,noexec,relatime 0 0 cgroup /sys/fs/cgroup/cpuset cgroup rw,nosuid,nodev,noexec,relatime,cpuset 0 0 cgroup /sys/fs/cgroup/cpu,cpuacct cgroup rw,nosuid,nodev,noexec,relatime,cpuacct,cpu 0 0 cgroup /sys/fs/cgroup/memory cgroup rw,nosuid,nodev,noexec,relatime,memory 0 0 cgroup /sys/fs/cgroup/devices cgroup rw,nosuid,nodev,noexec,relatime,devices 0 0 cgroup /sys/fs/cgroup/freezer cgroup rw,nosuid,nodev,noexec,relatime,freezer 0 0 cgroup /sys/fs/cgroup/net_cls cgroup rw,nosuid,nodev,noexec,relatime,net_cls 0 0 cgroup /sys/fs/cgroup/blkio cgroup rw,nosuid,nodev,noexec,relatime,blkio 0 0 cgroup /sys/fs/cgroup/perf_event cgroup rw,nosuid,nodev,noexec,relatime,perf_event 0 0 cgroup /sys/fs/cgroup/hugetlb cgroup rw,nosuid,nodev,noexec,relatime,hugetlb 0 0 .... This can't be disabled and it's no need to disable this. Your configuration looks good, In container,the sysfs is mounted as read-only default. Since we don't want user in container to change some sysfs-configuration of host. Thanks Gao.