This repository was archived by the owner on Sep 24, 2020. It is now read-only.
cherry-pick: nspawn: R/W support for /sys, and /proc/sys (v231)#71
Merged
crawford merged 1 commit intocoreos:v231-coreosfrom Nov 30, 2016
Merged
Conversation
This commit adds the possibility to leave /sys, and /proc/sys read-write. It introduces a new (undocumented) env var SYSTEMD_NSPAWN_API_VFS_WRITABLE to enable this feature. If set to "yes", /sys, and /proc/sys will be read-write. If set to "no", /sys, and /proc/sys will be read-only. If set to "network" /proc/sys/net will be read-write. This is useful in use-cases, where systemd-nspawn is used in an external network namespace. This adds the possibility to start privileged containers which need more control over settings in the /proc, and /sys filesystem. This is also a follow-up on the discussion from systemd#4018 (comment) where an introduction of a simple env var to enable R/W support for those directories was already discussed.
|
👍 |
s-urbaniak
changed the title
Author
|
ping @coreos/team-os do we have a chance to land this? |
crawford
approved these changes
Nov 30, 2016
|
We can get this into tomorrow's Alpha. |
|
Sorry, I forgot to bump the systemd release in our overlay. This change will be in the next Alpha in two weeks. |
This was referenced Dec 8, 2016
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This cherry-picks the upstream contribution systemd#4395.
It is needed in rkt to support privileged containers rkt/rkt#3245.
This is the backport for v231 of systemd.