New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve the dhclient hook for OCI compat #2013

Merged
merged 4 commits into from Dec 20, 2017

Conversation

5 participants
@3XX0
Contributor

3XX0 commented Dec 8, 2017

Now it becomes:

lxc.hook.start-host = /usr/share/lxc/hooks/dhclient
lxc.hook.stop = /usr/share/lxc/hooks/dhclient

@stgraber @brauner Do you have any suggestion to address the LSM problems?
Most distribution protect dhclient, thus it won't have permissions to read or write config/lease/pid files. Should we write Apparmor/SELinux profile overrides or let the users figure it out (e.g. document what to do in /etc/apparmor.d/local/sbin.dhclient)?

@hallyn Seems like the hook namespace fds got fixed so I was able to leverage it.
Right now I use oci.common.conf to setup the hooks for all my OCI containers, should we add a --dhcp option to the OCI template as well? It might be problematic if both are set though, what do you think?

@lxc-jenkins

This comment has been minimized.

Show comment
Hide comment
@lxc-jenkins

lxc-jenkins Dec 8, 2017

This pull request didn't trigger Jenkins as its author isn't in the whitelist.

An organization member must perform one of the following:

  • To have this branch tested by Jenkins, use the "ok to test" command.
  • To have a one time test done, use the "test this please" command.

Those commands are simple Github comments of the format: "jenkins: COMMAND"

lxc-jenkins commented Dec 8, 2017

This pull request didn't trigger Jenkins as its author isn't in the whitelist.

An organization member must perform one of the following:

  • To have this branch tested by Jenkins, use the "ok to test" command.
  • To have a one time test done, use the "test this please" command.

Those commands are simple Github comments of the format: "jenkins: COMMAND"

Show outdated Hide outdated hooks/dhclient.in Outdated
@@ -279,6 +279,10 @@ if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ] && [ -e "${LXC_TEMP
echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/userns.conf" >> "${LXC_CONF_FILE}"
fi
if [ -e "${LXC_TEMPLATE_CONFIG}/oci.common.conf" ]; then
echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/oci.common.conf" >> "${LXC_CONF_FILE}"

This comment has been minimized.

@flx42

flx42 Dec 8, 2017

Contributor

Should we push oci.common.conf.in in the same commit? Even if it only contains commented hooks for now, e.g.:

# Uncomment if you want to use dhclient...
#lxc.hook.start-host = @LXCHOOKDIR@/dhclient
#lxc.hook.stop = @LXCHOOKDIR@/dhclient
@flx42

flx42 Dec 8, 2017

Contributor

Should we push oci.common.conf.in in the same commit? Even if it only contains commented hooks for now, e.g.:

# Uncomment if you want to use dhclient...
#lxc.hook.start-host = @LXCHOOKDIR@/dhclient
#lxc.hook.stop = @LXCHOOKDIR@/dhclient
@hallyn

This comment has been minimized.

Show comment
Hide comment
@hallyn

hallyn Dec 9, 2017

Member

Regarding the hook args, quite the opposite - we are hoping to stop sending them as argv and just send them as environment variables.

Member

hallyn commented Dec 9, 2017

Regarding the hook args, quite the opposite - we are hoping to stop sending them as argv and just send them as environment variables.

@hallyn

This comment has been minimized.

Show comment
Hide comment
@hallyn

hallyn Dec 9, 2017

Member

--dhcp option would be nice. Can it just double-check whether the dhcp hook is already set in the config when the template is called to avoid double-setting it?

Member

hallyn commented Dec 9, 2017

--dhcp option would be nice. Can it just double-check whether the dhcp hook is already set in the config when the template is called to avoid double-setting it?

@3XX0

This comment has been minimized.

Show comment
Hide comment
@3XX0

3XX0 Dec 11, 2017

Contributor

I updated the PR, I added the --dhcp option and guarded against multiple inclusion by checking the PID file and I included an oci.common.conf.in commented out.

@hallyn @brauner I will update the hook arguments once we settled on the environment variables

Contributor

3XX0 commented Dec 11, 2017

I updated the PR, I added the --dhcp option and guarded against multiple inclusion by checking the PID file and I included an oci.common.conf.in commented out.

@hallyn @brauner I will update the hook arguments once we settled on the environment variables

brauner added a commit to brauner/lxc that referenced this pull request Dec 12, 2017

confile: add lxc.hook.version
Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

brauner added a commit to brauner/lxc that referenced this pull request Dec 12, 2017

start: set LXC_HOOK_VERSION
This can be used by scripts to detect what version of the hooks are used.

Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

brauner added a commit to brauner/lxc that referenced this pull request Dec 12, 2017

conf: execute hooks based on lxc.hooks.version
Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

brauner added a commit to brauner/lxc that referenced this pull request Dec 12, 2017

start: pass namespaces as environment variables
Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

brauner added a commit to brauner/lxc that referenced this pull request Dec 12, 2017

network: pass info in env if hook version is 1
Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
@brauner

This comment has been minimized.

Show comment
Hide comment
@brauner

brauner Dec 12, 2017

Member

See #2026 .

Member

brauner commented Dec 12, 2017

See #2026 .

@3XX0

This comment has been minimized.

Show comment
Hide comment
@3XX0

3XX0 Dec 14, 2017

Contributor

@brauner I updated the hook to work with your PR

Contributor

3XX0 commented Dec 14, 2017

@brauner I updated the hook to work with your PR

brauner added a commit to brauner/lxc that referenced this pull request Dec 14, 2017

confile: add lxc.hook.version
Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

brauner added a commit to brauner/lxc that referenced this pull request Dec 14, 2017

start: set LXC_HOOK_VERSION
This can be used by scripts to detect what version of the hooks are used.

Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

brauner added a commit to brauner/lxc that referenced this pull request Dec 14, 2017

conf: execute hooks based on lxc.hooks.version
Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

brauner added a commit to brauner/lxc that referenced this pull request Dec 14, 2017

start: pass namespaces as environment variables
Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

brauner added a commit to brauner/lxc that referenced this pull request Dec 14, 2017

network: pass info in env if hook version is 1
Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
@brauner

This comment has been minimized.

Show comment
Hide comment
@brauner

brauner Dec 14, 2017

Member

@3XX0, excellent. Thanks! I'll wait for @hallyn to merge my pr and then I'm merging this one.

Member

brauner commented Dec 14, 2017

@3XX0, excellent. Thanks! I'll wait for @hallyn to merge my pr and then I'm merging this one.

@brauner brauner added the Blocked label Dec 14, 2017

@brauner

This comment has been minimized.

Show comment
Hide comment
@brauner

brauner Dec 14, 2017

Member

Labeling this as "blocked" until #2026 is merged. :)

Member

brauner commented Dec 14, 2017

Labeling this as "blocked" until #2026 is merged. :)

@brauner brauner added Incomplete and removed Blocked labels Dec 14, 2017

@brauner

Nice. I just left a comment about attaching to the user namespace. I think the logic needs to change there. Otherwise this lgtm.

Show outdated Hide outdated hooks/dhclient.in Outdated
Show outdated Hide outdated hooks/dhclient.in Outdated

3XX0 added some commits Dec 8, 2017

hooks: dhclient hook improvements
- Merge dhclient-start and dhclient-stop into a single hook.
- Wait for a lease before returning from the hook.
- Generate a logfile when LXC log level is either DEBUG or TRACE.
- Rely on namespace file descriptors for the stop hook.
- Use settings from /<sysconf>/lxc/dhclient.conf if available.
- Attempt to cleanup if dhclient fails to shutdown properly.

Signed-off-by: Jonathan Calmels <jcalmels@nvidia.com>
lxc-net: add LXC_DHCP_PING boolean option
Excerpt from dnsmasq(8):
By default, the DHCP server will attempt to ensure that an address in not
in use before allocating it to a host. It does this by sending an ICMP echo
request (aka "ping") to the address in question. If it gets a reply, then the
address must already be in use, and another is tried. This flag disables this check.

This is useful if one expects all the containers to get an IP address
from the LXC authoritative DHCP server and wants to speed up the process
of getting a lease.

Signed-off-by: Jonathan Calmels <jcalmels@nvidia.com>
lxc-oci: read configuration from oci.common.conf if available
Signed-off-by: Jonathan Calmels <jcalmels@nvidia.com>
lxc-oci: add DHCP option leveraging dhclient hooks
Signed-off-by: Jonathan Calmels <jcalmels@nvidia.com>
@3XX0

This comment has been minimized.

Show comment
Hide comment
@3XX0

3XX0 Dec 19, 2017

Contributor
  • Rebased on master
  • Fixed the issue w.r.t the userns
  • Ran shellcheck
  • Tested unprivileged/privileged containers with hook.version 0 and 1
Contributor

3XX0 commented Dec 19, 2017

  • Rebased on master
  • Fixed the issue w.r.t the userns
  • Ran shellcheck
  • Tested unprivileged/privileged containers with hook.version 0 and 1
@brauner

This comment has been minimized.

Show comment
Hide comment
@brauner

brauner Dec 20, 2017

Member

jenkins: test this please

Member

brauner commented Dec 20, 2017

jenkins: test this please

@brauner brauner merged commit d1de8dd into lxc:master Dec 20, 2017

3 of 4 checks passed

Testsuite Testsuite failed
Details
Branch target Branch target is correct
Details
Signed-off-by All commits signed-off
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details

geaaru added a commit to geaaru/lxc that referenced this pull request Jul 4, 2018

confile: add lxc.hook.version
Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

geaaru added a commit to geaaru/lxc that referenced this pull request Jul 4, 2018

start: set LXC_HOOK_VERSION
This can be used by scripts to detect what version of the hooks are used.

Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

geaaru added a commit to geaaru/lxc that referenced this pull request Jul 4, 2018

conf: execute hooks based on lxc.hooks.version
Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

geaaru added a commit to geaaru/lxc that referenced this pull request Jul 4, 2018

start: pass namespaces as environment variables
Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

geaaru added a commit to geaaru/lxc that referenced this pull request Jul 4, 2018

network: pass info in env if hook version is 1
Unblocks lxc#2013.
Unblocks lxc#2015.
Closes lxc#1766.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment