差分
このページの2つのバージョン間の差分を表示します。
| 次のリビジョン | 前のリビジョン | ||
| linux:lxc:lxc-attachメモ [2013/03/15 09:12] – 作成 tenforward | linux:lxc:lxc-attachメモ [2013/03/15 09:24] (現在) – tenforward | ||
|---|---|---|---|
| 行 1: | 行 1: | ||
| ====== lxc-attach コマンドメモ ====== | ====== lxc-attach コマンドメモ ====== | ||
| + | lxc 0.9.0 以降は userns 対応もあって lxc-attach コマンドが大幅に書き直されている．こんな仕組みみたい． | ||
| + | |||
| + | <code c> | ||
| + | /* For the cgroup attaching logic to work in conjunction with pid and user namespaces, | ||
| + | * we need to have the following hierarchy: | ||
| + | * | ||
| + | * | ||
| + | * | socketpair(cgroup_ipc_sockets) | ||
| + | * | fork() | ||
| + | * | ||
| + | * | ||
| + | * | ||
| + | * | ||
| + | * | ||
| + | * | ||
| + | * | ||
| + | * | add to cgroups | ||
| + | * | signal child --------> | ||
| + | * | ||
| + | * | waitpid() | ||
| + | * | ||
| + | * | ||
| + | * | exit() | ||
| + | * | ||
| + | * The rationale is the following: The first parent is needed because after | ||
| + | * setns() (mount + user namespace) we can't access the cgroup filesystem | ||
| + | * to add the pid to the corresponding cgroup. Therefore, we need to do that | ||
| + | * in a process executed on the host, so that's why we need to fork and wait | ||
| + | * for it to have done some initialization (cgroups may restrict certain | ||
| + | * operations so we have to do that in the end) and use IPC for signaling. | ||
| + | * | ||
| + | * Then in the child process we do the setns(). However, a process is never | ||
| + | * really attached to a pid namespace (never changes its pid, doesn' | ||
| + | * in the pid namespace /proc), only child processes of that process are | ||
| + | * truely inside the new pid namespace. That's why we need to fork() again | ||
| + | * after setns() before performing final initializations, | ||
| + | * parent, which signals the primary process, which does cgroup adding, | ||
| + | * which then signals to the grandchild that it can exec(). | ||
| + | */ | ||
| + | (src/ | ||
| + | </ | ||
| + | |||
| + | * 親プロセスは，実際にアタッチするプロセスを対象の cgroup に追加しなければいけないので必要．そもそも子供から cgroup fs が見えない | ||
| + | * 子プロセスは，setns() するけど，そのプロセス自身は対象となる pid namespace には入れないので，そこからさらに fork() する必要がある | ||