Skip to content

Instantly share code, notes, and snippets.

Avatar

Nels Nelson nelsnelson

View GitHub Profile
@nelsnelson
nelsnelson / seccomp-example.sh
Created Feb 13, 2014
lxc 1.0.0.beta1 seccomp example
View seccomp-example.sh
$ cat seccomp-example.sh
#! /usr/bin/env bash
cat << EOF > /tmp/config
lxc.seccomp = /tmp/whitelist
EOF
cat << EOF > /tmp/whitelist
1
whitelist
0
@nelsnelson
nelsnelson / example-lxc-execute-failure.txt
Last active Aug 29, 2015
Example of lxc-execute failure due to "lxc-execute: Failed to find an lxc-init"
View example-lxc-execute-failure.txt
$ cat seccomp.sh
#! /usr/bin/env bash
cat << EOF > /tmp/config
lxc.seccomp = /tmp/whitelist
EOF
cat << EOF > /tmp/whitelist
1
whitelist
1
View simple-lxc-execute-failure.txt
$ sudo aptitude versions lxc | grep 1.0.0
p 1.0.0~beta1-5~r1+1 unstable 500
p 1.0.0~beta1-5~r1+1 unstable 500
p 1.0.0~beta1-5~r1+1 unstable 500
p 1.0.0~beta1-5~r1+1 unstable 500
$ sudo apt-get install lxc=1.0.0~beta1-5~r1+1
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
@nelsnelson
nelsnelson / out.txt
Created Feb 21, 2014
Example of successful syscall filtering.
View out.txt
Config contents:
lxc.seccomp = /tmp/whitelist
Whitelist contents:
1
whitelist
0
1
@nelsnelson
nelsnelson / 0_shell.sh
Last active Aug 29, 2015
Example of ulimiting some forks
View 0_shell.sh
$ /bin/bash ulimiter.sh 40 forks.py
0: 9388
2: 9390
1: 9389
3: 9391
4: 9392
6: 9394
5: 9393
7: 9395
8: 9396
@nelsnelson
nelsnelson / output.txt
Last active Aug 29, 2015
Occasionally, when I run this code in a multi-threaded environment, I observe the provided error when accessing for example apple.tags.
View output.txt
$ ./tags.rb
apple
edible
View lxc-create-comparison.txt
$ sudo lxc-create -n test -o /tmp/lxc.log
lxc-create: Error creating container test
$ cat /tmp/lxc.log
lxc-create 1391754787.424 ERROR lxc_create_ui - Error creating container test
View lxc-execute-comparison.txt
$ sudo lxc-execute -n test -l DEBUG -o /tmp/lxc.log -- echo hello world
hello world
$ cat /tmp/lxc.log
lxc-execute 1391753212.665 INFO lxc_lsm - LSM security driver SELinux
lxc-execute 1391753212.665 DEBUG lxc_start - sigchild handler set
lxc-execute 1391753212.665 INFO lxc_console - no console for lxc-execute.
lxc-execute 1391753212.665 INFO lxc_start - 'test' is initialized
lxc-execute 1391753212.671 DEBUG lxc_start - Not dropping cap_sys_boot or watching utmp
lxc-execute 1391753212.671 INFO lxc_cgroup - cgroup driver cgroupfs initing for test
lxc-execute 1391753212.674 DEBUG lxc_conf - Set exec command to echo
View log-output.txt
$ cat /tmp/lxc.log
lxc-create 1391628487.880 WARN lxc_log - lxc_log_init called with log already initialized
lxc-create 1391628487.893 INFO bdev - got 0 for thin pool at path: /dev/lxc/lxc
lxc-create 1391628487.962 DEBUG bdev - trying to mount '/dev/lxc/test'->'/usr/lib/lxc/rootfs' with fstype 'ext3'
lxc-create 1391628487.963 INFO bdev - mounted '/dev/lxc/test' on '/usr/lib/lxc/rootfs', with fstype 'ext3'
lxc-create 1391628487.983 INFO lxc_create_ui - container test created
lxc-start 1391628487.988 INFO lxc_start_ui - using rcfile /var/lib/lxc/test/test/config
lxc-start 1391628487.988 WARN lxc_log - lxc_log_init called with log already initialized
lxc-start 1391628487.988 ERROR lxc_start_ui - Executing '/sbin/init' with no configuration file may crash the host
View lxc-weirdness.txt
$ sudo lxc-create -t sshd -n test -f /var/lib/lxc/test/config -l DEBUG -o /tmp/lxc.log &> /dev/null
$ sudo lxc-start -d -n test -f /var/lib/lxc/test/config -P /var/lib/lxc/test -l DEBUG -o /tmp/lxc.log
$ cat /tmp/lxc.log
lxc-create 1391637847.305 WARN lxc_log - lxc_log_init called with log already initialized
lxc-start 1391637853.096 WARN lxc_log - lxc_log_init called with log already initialized
lxc-start 1391637853.099 DEBUG lxc_cgroup - cgroup_init
lxc-start 1391637853.099 INFO lxc_cgroup - Initialized cgroup driver cgroupfs
lxc-start 1391637853.099 INFO lxc_lsm - LSM security driver SELinux
lxc-start 1391637853.099 DEBUG lxc_start - sigchild handler set
lxc-start 1391637853.100 DEBUG lxc_console - no console peer