/
lxc.container.conf.sgml.in
2084 lines (1976 loc) · 77 KB
/
lxc.container.conf.sgml.in
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!--
lxc: linux Container library
(C) Copyright IBM Corp. 2007, 2008
Authors:
Daniel Lezcano <daniel.lezcano at free.fr>
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-->
<!DOCTYPE refentry PUBLIC @docdtd@ [
<!ENTITY seealso SYSTEM "@builddir@/see_also.sgml">
]>
<refentry>
<docinfo><date>@LXC_GENERATE_DATE@</date></docinfo>
<refmeta>
<refentrytitle>lxc.container.conf</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>lxc.container.conf</refname>
<refpurpose>
LXC container configuration file
</refpurpose>
</refnamediv>
<refsect1>
<title>Description</title>
<para>
LXC is the well-known and heavily tested low-level Linux container
runtime. It is in active development since 2008 and has proven itself in
critical production environments world-wide. Some of its core contributors
are the same people that helped to implement various well-known
containerization features inside the Linux kernel.
</para>
<para>
LXC's main focus is system containers. That is, containers which offer an
environment as close as possible as the one you'd get from a VM but
without the overhead that comes with running a separate kernel and
simulating all the hardware.
</para>
<para>
This is achieved through a combination of kernel security features such as
namespaces, mandatory access control and control groups.
</para>
<para>
LXC has supports unprivileged containers. Unprivileged containers are
containers that are run without any privilege. This requires support for
user namespaces in the kernel that the container is run on. LXC was the
first runtime to support unprivileged containers after user namespaces
were merged into the mainline kernel.
</para>
<para>
In essence, user namespaces isolate given sets of UIDs and GIDs. This is
achieved by establishing a mapping between a range of UIDs and GIDs on the
host to a different (unprivileged) range of UIDs and GIDs in the
container. The kernel will translate this mapping in such a way that
inside the container all UIDs and GIDs appear as you would expect from the
host whereas on the host these UIDs and GIDs are in fact unprivileged. For
example, a process running as UID and GID 0 inside the container might
appear as UID and GID 100000 on the host. The implementation and working
details can be gathered from the corresponding user namespace man page.
UID and GID mappings can be defined with the <option>lxc.idmap</option>
key.
</para>
<para>
Linux containers are defined with a simple configuration file. Each
option in the configuration file has the form <command>key =
value</command> fitting in one line. The "#" character means the line is a
comment. List options, like capabilities and cgroups options, can be used
with no value to clear any previously defined values of that option.
</para>
<para>
LXC namespaces configuration keys by using single dots. This means complex
configuration keys such as <option>lxc.net.0</option> expose various
subkeys such as <option>lxc.net.0.type</option>,
<option>lxc.net.0.link</option>, <option>lxc.net.0.ipv6.address</option>, and
others for even more fine-grained configuration.
</para>
<refsect2>
<title>Configuration</title>
<para>
In order to ease administration of multiple related containers, it is
possible to have a container configuration file cause another file to be
loaded. For instance, network configuration can be defined in one common
file which is included by multiple containers. Then, if the containers
are moved to another host, only one file may need to be updated.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.include</option>
</term>
<listitem>
<para>
Specify the file to be included. The included file must be
in the same valid lxc configuration file format.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Architecture</title>
<para>
Allows one to set the architecture for the container. For example, set a
32bits architecture for a container running 32bits binaries on a 64bits
host. This fixes the container scripts which rely on the architecture to
do some work like downloading the packages.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.arch</option>
</term>
<listitem>
<para>
Specify the architecture for the container.
</para>
<para>
Some valid options are
<option>x86</option>,
<option>i686</option>,
<option>x86_64</option>,
<option>amd64</option>
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Hostname</title>
<para>
The utsname section defines the hostname to be set for the container.
That means the container can set its own hostname without changing the
one from the system. That makes the hostname private for the container.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.uts.name</option>
</term>
<listitem>
<para>
specify the hostname for the container
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Halt signal</title>
<para>
Allows one to specify signal name or number sent to the container's
init process to cleanly shutdown the container. Different init systems
could use different signals to perform clean shutdown sequence. This
option allows the signal to be specified in kill(1) fashion, e.g.
SIGPWR, SIGRTMIN+14, SIGRTMAX-10 or plain number. The default signal is
SIGPWR.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.signal.halt</option>
</term>
<listitem>
<para>
specify the signal used to halt the container
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Reboot signal</title>
<para>
Allows one to specify signal name or number to reboot the container.
This option allows signal to be specified in kill(1) fashion, e.g.
SIGTERM, SIGRTMIN+14, SIGRTMAX-10 or plain number. The default signal
is SIGINT.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.signal.reboot</option>
</term>
<listitem>
<para>
specify the signal used to reboot the container
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Stop signal</title>
<para>
Allows one to specify signal name or number to forcibly shutdown the
container. This option allows signal to be specified in kill(1) fashion,
e.g. SIGKILL, SIGRTMIN+14, SIGRTMAX-10 or plain number. The default
signal is SIGKILL.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.signal.stop</option>
</term>
<listitem>
<para>
specify the signal used to stop the container
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Init command</title>
<para>
Sets the command to use as the init system for the containers.
This option is ignored when using lxc-execute.
Defaults to: /sbin/init
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.init.cmd</option>
</term>
<listitem>
<para>
Absolute path from container rootfs to the binary to use as init.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Init ID</title>
<para>
Sets the UID/GID to use for the init system, and subsequent commands.
Note that using a non-root uid when booting a system container will
likely not work due to missing privileges. Setting the UID/GID is mostly
useful when running application container.
Defaults to: UID(0), GID(0)
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.init.uid</option>
</term>
<listitem>
<para>
UID to use for init.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.init.gid</option>
</term>
<listitem>
<para>
GID to use for init.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Ephemeral</title>
<para>
Allows one to specify whether a container will be destroyed on shutdown.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.ephemeral</option>
</term>
<listitem>
<para>
The only allowed values are 0 and 1. Set this to 1 to destroy a
container on shutdown.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Network</title>
<para>
The network section defines how the network is virtualized in
the container. The network virtualization acts at layer
two. In order to use the network virtualization, parameters
must be specified to define the network interfaces of the
container. Several virtual interfaces can be assigned and used
in a container even if the system has only one physical
network interface.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.net</option>
</term>
<listitem>
<para>
may be used without a value to clear all previous network options.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].type</option>
</term>
<listitem>
<para>
specify what kind of network virtualization to be used
for the container.
Multiple networks can be specified by using an additional index
<option>i</option>
after all <option>lxc.net.*</option> keys. For example,
<option>lxc.net.0.type = veth</option> and
<option>lxc.net.1.type = veth</option> specify two different
networks of the same type. All keys sharing the same index
<option>i</option> will be treated as belonging to the same
network. For example, <option>lxc.net.0.link = br0</option>
will belong to <option>lxc.net.0.type</option>.
Currently, the different virtualization types can be:
</para>
<para>
<option>none:</option> will cause the container to share
the host's network namespace. This means the host
network devices are usable in the container. It also
means that if both the container and host have upstart as
init, 'halt' in a container (for instance) will shut down the
host.
</para>
<para>
<option>empty:</option> will create only the loopback
interface.
</para>
<para>
<option>veth:</option> a virtual ethernet pair
device is created with one side assigned to the container
and the other side attached to a bridge specified by
the <option>lxc.net.[i].link</option> option.
If the bridge is not specified, then the veth pair device
will be created but not attached to any bridge.
Otherwise, the bridge has to be created on the system
before starting the container.
<command>lxc</command> won't handle any
configuration outside of the container.
By default, <command>lxc</command> chooses a name for the
network device belonging to the outside of the
container, but if you wish to handle
this name yourselves, you can tell <command>lxc</command>
to set a specific name with
the <option>lxc.net.[i].veth.pair</option> option (except for
unprivileged containers where this option is ignored for security
reasons).
</para>
<para>
<option>vlan:</option> a vlan interface is linked with
the interface specified by
the <option>lxc.net.[i].link</option> and assigned to
the container. The vlan identifier is specified with the
option <option>lxc.net.[i].vlan.id</option>.
</para>
<para>
<option>macvlan:</option> a macvlan interface is linked
with the interface specified by
the <option>lxc.net.[i].link</option> and assigned to
the container.
<option>lxc.net.[i].macvlan.mode</option> specifies the
mode the macvlan will use to communicate between
different macvlan on the same upper device. The accepted
modes are <option>private</option>, <option>vepa</option>,
<option>bridge</option> and <option>passthru</option>.
In <option>private</option> mode, the device never
communicates with any other device on the same upper_dev (default).
In <option>vepa</option> mode, the new Virtual Ethernet Port
Aggregator (VEPA) mode, it assumes that the adjacent
bridge returns all frames where both source and
destination are local to the macvlan port, i.e. the
bridge is set up as a reflective relay. Broadcast
frames coming in from the upper_dev get flooded to all
macvlan interfaces in VEPA mode, local frames are not
delivered locally. In <option>bridge</option> mode, it
provides the behavior of a simple bridge between
different macvlan interfaces on the same port. Frames
from one interface to another one get delivered directly
and are not sent out externally. Broadcast frames get
flooded to all other bridge ports and to the external
interface, but when they come back from a reflective
relay, we don't deliver them again. Since we know all
the MAC addresses, the macvlan bridge mode does not
require learning or STP like the bridge module does. In
<option>passthru</option> mode, all frames received by
the physical interface are forwarded to the macvlan
interface. Only one macvlan interface in <option>passthru</option>
mode is possible for one physical interface.
</para>
<para>
<option>phys:</option> an already existing interface
specified by the <option>lxc.net.[i].link</option> is
assigned to the container.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].flags</option>
</term>
<listitem>
<para>
Specify an action to do for the network.
</para>
<para><option>up:</option> activates the interface.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].link</option>
</term>
<listitem>
<para>
Specify the interface to be used for real network traffic.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].mtu</option>
</term>
<listitem>
<para>
Specify the maximum transfer unit for this interface.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].name</option>
</term>
<listitem>
<para>
The interface name is dynamically allocated, but if another name
is needed because the configuration files being used by the
container use a generic name, eg. eth0, this option will rename
the interface in the container.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].hwaddr</option>
</term>
<listitem>
<para>
The interface mac address is dynamically allocated by default to
the virtual interface, but in some cases, this is needed to
resolve a mac address conflict or to always have the same
link-local ipv6 address. Any "x" in address will be replaced by
random value, this allows setting hwaddr templates.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].ipv4.address</option>
</term>
<listitem>
<para>
Specify the ipv4 address to assign to the virtualized interface.
Several lines specify several ipv4 addresses. The address is in
format x.y.z.t/m, eg. 192.168.1.123/24.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].ipv4.gateway</option>
</term>
<listitem>
<para>
Specify the ipv4 address to use as the gateway inside the
container. The address is in format x.y.z.t, eg. 192.168.1.123.
Can also have the special value <option>auto</option>,
which means to take the primary address from the bridge
interface (as specified by the
<option>lxc.net.[i].link</option> option) and use that as
the gateway. <option>auto</option> is only available when
using the <option>veth</option> and
<option>macvlan</option> network types.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].ipv6.address</option>
</term>
<listitem>
<para>
Specify the ipv6 address to assign to the virtualized
interface. Several lines specify several ipv6 addresses. The
address is in format x::y/m, eg.
2003:db8:1:0:214:1234:fe0b:3596/64
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].ipv6.gateway</option>
</term>
<listitem>
<para>
Specify the ipv6 address to use as the gateway inside the
container. The address is in format x::y, eg. 2003:db8:1:0::1
Can also have the special value <option>auto</option>,
which means to take the primary address from the bridge
interface (as specified by the
<option>lxc.net.[i].link</option> option) and use that as
the gateway. <option>auto</option> is only available when
using the <option>veth</option> and
<option>macvlan</option> network types.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].script.up</option>
</term>
<listitem>
<para>
Add a configuration option to specify a script to be
executed after creating and configuring the network used
from the host side. The following arguments are passed
to the script: container name and config section name
(net) Additional arguments depend on the config section
employing a script hook; the following are used by the
network system: execution context (up), network type
(empty/veth/macvlan/phys), Depending on the network
type, other arguments may be passed:
veth/macvlan/phys. And finally (host-sided) device name.
</para>
<para>
Standard output from the script is logged at debug level.
Standard error is not logged, but can be captured by the
hook redirecting its standard error to standard output.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].script.down</option>
</term>
<listitem>
<para>
Add a configuration option to specify a script to be
executed before destroying the network used from the
host side. The following arguments are passed to the
script: container name and config section name (net)
Additional arguments depend on the config section
employing a script hook; the following are used by the
network system: execution context (down), network type
(empty/veth/macvlan/phys), Depending on the network
type, other arguments may be passed:
veth/macvlan/phys. And finally (host-sided) device name.
</para>
<para>
Standard output from the script is logged at debug level.
Standard error is not logged, but can be captured by the
hook redirecting its standard error to standard output.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>New pseudo tty instance (devpts)</title>
<para>
For stricter isolation the container can have its own private
instance of the pseudo tty.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.pty.max</option>
</term>
<listitem>
<para>
If set, the container will have a new pseudo tty
instance, making this private to it. The value specifies
the maximum number of pseudo ttys allowed for a pts
instance (this limitation is not implemented yet).
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Container system console</title>
<para>
If the container is configured with a root filesystem and the
inittab file is setup to use the console, you may want to specify
where the output of this console goes.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.console.logfile</option>
</term>
<listitem>
<para>
Specify a path to a file where the console output will
be written.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.console.path</option>
</term>
<listitem>
<para>
Specify a path to a device to which the console will be
attached. The keyword 'none' will simply disable the
console. Note, when specifying 'none' and creating a device node
for the console in the container at /dev/console or bind-mounting
the hosts's /dev/console into the container at /dev/console the
container will have direct access to the hosts's /dev/console.
This is dangerous when the container has write access to the
device and should thus be used with caution.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Console through the ttys</title>
<para>
This option is useful if the container is configured with a root
filesystem and the inittab file is setup to launch a getty on the
ttys. The option specifies the number of ttys to be available for
the container. The number of gettys in the inittab file of the
container should not be greater than the number of ttys specified
in this option, otherwise the excess getty sessions will die and
respawn indefinitely giving annoying messages on the console or in
<filename>/var/log/messages</filename>.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.tty.max</option>
</term>
<listitem>
<para>
Specify the number of tty to make available to the
container.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Console devices location</title>
<para>
LXC consoles are provided through Unix98 PTYs created on the
host and bind-mounted over the expected devices in the container.
By default, they are bind-mounted over <filename>/dev/console</filename>
and <filename>/dev/ttyN</filename>. This can prevent package upgrades
in the guest. Therefore you can specify a directory location (under
<filename>/dev</filename> under which LXC will create the files and
bind-mount over them. These will then be symbolically linked to
<filename>/dev/console</filename> and <filename>/dev/ttyN</filename>.
A package upgrade can then succeed as it is able to remove and replace
the symbolic links.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.tty.dir</option>
</term>
<listitem>
<para>
Specify a directory under <filename>/dev</filename>
under which to create the container console devices. Note that LXC
will move any bind-mounts or device nodes for /dev/console into
this directory.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>/dev directory</title>
<para>
By default, lxc creates a few symbolic links (fd,stdin,stdout,stderr)
in the container's <filename>/dev</filename> directory but does not
automatically create device node entries. This allows the container's
<filename>/dev</filename> to be set up as needed in the container
rootfs. If lxc.autodev is set to 1, then after mounting the container's
rootfs LXC will mount a fresh tmpfs under <filename>/dev</filename>
(limited to 500k) and fill in a minimal set of initial devices.
This is generally required when starting a container containing
a "systemd" based "init" but may be optional at other times. Additional
devices in the containers /dev directory may be created through the
use of the <option>lxc.hook.autodev</option> hook.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.autodev</option>
</term>
<listitem>
<para>
Set this to 0 to stop LXC from mounting and populating a minimal
<filename>/dev</filename> when starting the container.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Mount points</title>
<para>
The mount points section specifies the different places to be
mounted. These mount points will be private to the container
and won't be visible by the processes running outside of the
container. This is useful to mount /etc, /var or /home for
examples.
</para>
<para>
NOTE - LXC will generally ensure that mount targets and relative
bind-mount sources are properly confined under the container
root, to avoid attacks involving over-mounting host directories
and files. (Symbolic links in absolute mount sources are ignored)
However, if the container configuration first mounts a directory which
is under the control of the container user, such as /home/joe, into
the container at some <filename>path</filename>, and then mounts
under <filename>path</filename>, then a TOCTTOU attack would be
possible where the container user modifies a symbolic link under
his home directory at just the right time.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.mount.fstab</option>
</term>
<listitem>
<para>
specify a file location in
the <filename>fstab</filename> format, containing the
mount information. The mount target location can and in
most cases should be a relative path, which will become
relative to the mounted container root. For instance,
</para>
<programlisting>
proc proc proc nodev,noexec,nosuid 0 0
</programlisting>
<para>
Will mount a proc filesystem under the container's /proc,
regardless of where the root filesystem comes from. This
is resilient to block device backed filesystems as well as
container cloning.
</para>
<para>
Note that when mounting a filesystem from an
image file or block device the third field (fs_vfstype)
cannot be auto as with
<citerefentry>
<refentrytitle>mount</refentrytitle>
<manvolnum>8</manvolnum>
</citerefentry>
but must be explicitly specified.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.mount.entry</option>
</term>
<listitem>
<para>
specify a mount point corresponding to a line in the
fstab format.
Moreover lxc add two options to mount.
<option>optional</option> don't fail if mount does not work.
<option>create=dir</option> or <option>create=file</option>
to create dir (or file) when the point will be mounted.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.mount.auto</option>
</term>
<listitem>
<para>
specify which standard kernel file systems should be
automatically mounted. This may dramatically simplify
the configuration. The file systems are:
</para>
<itemizedlist>
<listitem>
<para>
<option>proc:mixed</option> (or <option>proc</option>):
mount <filename>/proc</filename> as read-write, but
remount <filename>/proc/sys</filename> and
<filename>/proc/sysrq-trigger</filename> read-only
for security / container isolation purposes.
</para>
</listitem>
<listitem>
<para>
<option>proc:rw</option>: mount
<filename>/proc</filename> as read-write
</para>
</listitem>
<listitem>
<para>
<option>sys:mixed</option> (or <option>sys</option>):
mount <filename>/sys</filename> as read-only but with
/sys/devices/virtual/net writable.
</para>
</listitem>
<listitem>
<para>
<option>sys:ro</option>:
mount <filename>/sys</filename> as read-only
for security / container isolation purposes.
</para>
</listitem>
<listitem>
<para>
<option>sys:rw</option>: mount
<filename>/sys</filename> as read-write
</para>
</listitem>
<listitem>
<para>
<option>cgroup:mixed</option>:
mount a tmpfs to <filename>/sys/fs/cgroup</filename>,
create directories for all hierarchies to which
the container is added, create subdirectories
there with the name of the cgroup, and bind-mount
the container's own cgroup into that directory.
The container will be able to write to its own
cgroup directory, but not the parents, since they
will be remounted read-only.
</para>
</listitem>
<listitem>
<para>
<option>cgroup:ro</option>: similar to
<option>cgroup:mixed</option>, but everything will
be mounted read-only.
</para>
</listitem>
<listitem>
<para>
<option>cgroup:rw</option>: similar to
<option>cgroup:mixed</option>, but everything will
be mounted read-write. Note that the paths leading
up to the container's own cgroup will be writable,
but will not be a cgroup filesystem but just part
of the tmpfs of <filename>/sys/fs/cgroup</filename>
</para>
</listitem>
<listitem>
<para>
<option>cgroup</option> (without specifier):
defaults to <option>cgroup:rw</option> if the
container retains the CAP_SYS_ADMIN capability,
<option>cgroup:mixed</option> otherwise.
</para>
</listitem>
<listitem>
<para>
<option>cgroup-full:mixed</option>:
mount a tmpfs to <filename>/sys/fs/cgroup</filename>,
create directories for all hierarchies to which
the container is added, bind-mount the hierarchies
from the host to the container and make everything
read-only except the container's own cgroup. Note
that compared to <option>cgroup</option>, where
all paths leading up to the container's own cgroup
are just simple directories in the underlying
tmpfs, here
<filename>/sys/fs/cgroup/$hierarchy</filename>
will contain the host's full cgroup hierarchy,
albeit read-only outside the container's own cgroup.
This may leak quite a bit of information into the
container.
</para>
</listitem>
<listitem>
<para>
<option>cgroup-full:ro</option>: similar to
<option>cgroup-full:mixed</option>, but everything
will be mounted read-only.
</para>
</listitem>
<listitem>
<para>
<option>cgroup-full:rw</option>: similar to
<option>cgroup-full:mixed</option>, but everything
will be mounted read-write. Note that in this case,
the container may escape its own cgroup. (Note also
that if the container has CAP_SYS_ADMIN support
and can mount the cgroup filesystem itself, it may
do so anyway.)
</para>
</listitem>
<listitem>
<para>
<option>cgroup-full</option> (without specifier):
defaults to <option>cgroup-full:rw</option> if the
container retains the CAP_SYS_ADMIN capability,
<option>cgroup-full:mixed</option> otherwise.
</para>
</listitem>
</itemizedlist>
<para>
If cgroup namespaces are enabled, then any <option>cgroup</option>
auto-mounting request will be ignored, since the container can
mount the filesystems itself, and automounting can confuse the