Re: jessie and unpriviledged lxc containers
Christian Seiler wrote:
> On 05/03/2015 08:43 AM, Johannes Graumann wrote:
>> I'm playing with unpriviledged lxc containers according to
>> http://tinyurl.com/kvzxlvj on jessie. In order to lxc-create as a
>> non-root user I have to do
>> PROMPT> echo 1 > /sys/fs/cgroup/cpuset/cgroup.clone_children
>> PROMPT> echo 1 > /proc/sys/kernel/unprivileged_userns_clone
>> How can I make those setting persistent such that they are automatically
>> (re)set upon reboot?
> The second one is trivial: create a file /etc/sysctl.d/10-unpriv-lxc
> with the following contents:
> kernel.unprivileged_userns_clone = 1
> Then on boot this setting will be automatically applied.
> If you want to activate clone_children for the cgroup automatically at
> boot, you kind-of need to do that manually. I'm going to assume you're
> using systemd as init system on the host (because it's the default and
> you didn't mention anything else ). The easiest way is to simply
> create a file /etc/systemd/system/setup-clone-children.service:
> Description=Setup cpuset cgroup clone_children for LXC
> Before=sysinit.target shutdown.target
> ExecStart=/bin/sh -c "echo 1 >
> /sys/fs/cgroup/cpuset/cgroup.clone_children" StandardOutput=null
> (the ExecStart= is one line, my mail client just likes to wrap)
> Then you can just do
> systemctl enable setup-clone-children.service
> and the next time you reboot, the setting will be applied.
> Hope that helps.
Many thanks. Implemented and awaiting testing.