News for hackers. Stuff that matters.

A comment on Linux Containers, Docker, and Security. Parent comment

Re:Linux Containers, Docker, and Security by moonboots on Saturday February 01, 2014 @03:32PM (#7163264)
I've also experienced problems with lack of host/container separation with lxc on arch linux, e.g. shutting down container shut down the host. I suspected the problem was an improperly mounted/unmounted /dev or /sys in the guest.

I've had a much smoother experience with lxc on Ubuntu than arch. The core lxc developers work for canonical, and Ubuntu lxc bootstrap scripts are much more refined. Lxc support for arch linux is provided by the community, and at least when I tried last year, there were minor problems here and there.

On arch linux, I've found that systemd-nspawn support is much better than lxc's. The commands mkarchroot and arch-nspawn (in the devtools package) make running arch in arch straightforward.

[ Parent | on HN ]
Re:Linux Containers, Docker, and Security by Da_Blitz on Saturday February 01, 2014 @07:14PM (#7164101)
Up until Linux 3.8/3.9 the shutdown() syscall was not container aware and hence shutting down from inside a container would shutdown a host

It has since been fixed and attached to the 'PID' namespace meaning that all processes in the PID namespace get shutdown in the same manner as the host calling shutdown() (ie init gets a specific signal, userspace processes get signaled as well)

[ Parent | on HN ]