<div dir="ltr"><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Aug 13, 2014 at 10:12 PM, Pavel Emelyanov <span dir="ltr"><<a href="mailto:xemul@parallels.com" target="_blank">xemul@parallels.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 08/14/2014 01:55 AM, Aditya Kali wrote:<br>
> On Wed, Aug 13, 2014 at 12:53 AM, Cyrill Gorcunov <<a href="mailto:gorcunov@gmail.com">gorcunov@gmail.com</a>> wrote:<br>
>> On Mon, Aug 11, 2014 at 05:17:10PM +0400, Andrew Vagin wrote:<br>
>>> Hi Sophie,<br>
>>><br>
>>> On Fri, Aug 08, 2014 at 10:21:19PM -0700, Sophie Blee-Goldman wrote:<br>
>>>> Adds basic support for user namespaces by dumping and restoring<br>
>>>> the namespace itself and the uid/gid maps of the root process.<br>
>>><br>
>>> How do you test your patches? ZDTM test suite can execute tests in<br>
>>> namespaces, but the current version knows nothing about userns. Have you<br>
>>> try to add userns in ZDTM lib?<br>
>>><br>
>>>><br>
>>>> Currently depends on a kernel patch to avoid failing on the prctl<br>
>>>> syscall by checking for CAP_SYS_RESOURCE in the user namespace<br>
>>>> instead of in the global one.<br>
>>><br>
>>> It isn't so simple.<br>
>>> Kirill is trying to fix this issue: <a href="https://lkml.org/lkml/2014/8/4/570" target="_blank">https://lkml.org/lkml/2014/8/4/570</a><br>
>><br>
>> Yes, this particular series is acked by Serge but didn't reach -mm<br>
>> or -next tree yet, I think people need more time to think if it is<br>
>> safe.<br>
>><br>
>>><br>
>>> We have a number of other kernel issues, which are described here:<br>
>>> <a href="http://criu.org/UserNamespace" target="_blank">http://criu.org/UserNamespace</a><br>
>>><br>
>>> Have you seen my patches for userns?<br>
>>> <a href="http://lists.openvz.org/pipermail/criu/2014-February/012399.html" target="_blank">http://lists.openvz.org/pipermail/criu/2014-February/012399.html</a><br>
>>><br>
>>> and here is updated version:<br>
>>> <a href="https://github.com/avagin/criu/tree/userns2" target="_blank">https://github.com/avagin/criu/tree/userns2</a><br>
>>><br>
>>> I suggest to find the difference between our patch sets and make a new one,<br>
>>> which will contain best things from both ones.<br>
><br>
> Some of Sophie's changes/fixes are applicable to main criu branch even<br>
> without userns support. Other userns specific changes could be applied<br>
> to the Andrew Vagin's userns tree. They will need to be split<br>
> accordingly.<br>
<br>
</div></div>Yup, Sophie's fix for parasite args size calculation is already merged :)<br>
<a href="https://github.com/xemul/criu/commit/3faaed2f6461d018c8d4e05010967f8085a5a5e5" target="_blank">https://github.com/xemul/criu/commit/3faaed2f6461d018c8d4e05010967f8085a5a5e5</a><br>
<div class=""><br>
>><br>
>> Guys, actually I don't see much point in implementing user-ns support until<br>
>> all restrictions from kernel are moved off. I mean we can prepare kind of<br>
>> scaffold code (I must admit I didn't read the series precisely) but without<br>
>> kernel support it might be a waste of time, the kernel interface variant<br>
>> which will be eventually merged might be completely different from initial<br>
>> proposal. Thus, from my POV -- priority number 1 is to address the kernel.<br>
>><br>
>> Still, if we need a scaffold code -- it should be quite "common" and won't<br>
>> require much efforts to change once kernel get stabilized in new interfaces.<br>
>><br>
>> Don't get me wrong please, I'm not against user-ns development in criu at<br>
>> the current stage but it must be done by very small pieces keeping in mind<br>
>> that kernel migh be heavily changed.<br>
><br>
> Even with kernel changes not finalized, I find it useful to have<br>
> userns changes in CRIU done somewhere. With Sophie's patches, the<br>
> CRIU-userns support atleast lets us dump and restore uid mappings &<br>
> capabilities (with experimental kernel). I feel its valuable to be<br>
> able to test these as it lets us find issues in our container setup<br>
> early on.<br>
<br>
</div>I do agree, that userns support is better to get merged early and kernel<br>
to get fixed eventually. What I ask is two things:<br>
<br>
1. We need to know exactly what is not working and using zdtm tests<br>
for this seems the best way to me.<br>
<br>
2. Since we have two experts in this area -- Andrey and Sophie -- it<br>
would be great if they come to an agreement on how things should<br>
look like, so we have really great userns code.<br></blockquote><div><br></div><div><div class="gmail_default" style="font-size:small">Sophie finished her internship last week, and remove her email from here which won't work from this moment.</div>
<div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Pavel, I think you have merged all the patches she recently pushed and the remaining ones are the actual user namespace support which also being covered by Andrew's patches. So let us know what you guys need help with and we will follow-up from there.</div>
<div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Thanks</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">
--Ying</div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Thanks,<br>
Pavel<br>
<div class="HOEnZb"><div class="h5"><br>
_______________________________________________<br>
CRIU mailing list<br>
<a href="mailto:CRIU@openvz.org">CRIU@openvz.org</a><br>
<a href="https://lists.openvz.org/mailman/listinfo/criu" target="_blank">https://lists.openvz.org/mailman/listinfo/criu</a><br>
</div></div></blockquote></div><br></div></div>