I have host running RHEL-7.2. Inside that running LXC. Inside LXC creating network namespaces. Inside the namespace changing
sysctl variables was failing (as root):
$ ip netns add testns $ ip netns exec testns bash $ sysctl net.ipv6.conf.all.disable_ipv6=1 sysctl: setting key "net.ipv6.conf.all.disable_ipv6": Read-only file system
If I remount
/proc/sys for RW in a shell and then
sysctl -w inside same shell, then it does work.
$ ip netns exec testns bash $ mount -o remount,rw /proc/sys $ sysctl net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.all.disable_ipv6 = 1
I then start 2nd shell and enter netns and
/proc/sys appears Read-ONLY for that shell, but remains writable within the 1sh shell. This puzzles me. The affect of changing values by first shell is visible to the second shell.
I was trying to add remounting to the provisioning script, but this issue gets in the way.
$ ip netns exec testns sysctl net.ipv6.conf.all.disable_ipv6=1 sysctl: setting key "net.ipv6.conf.all.disable_ipv6": Read-only file system $ ip netns exec testns sh -c \ > 'mount -o remount,rw /proc/sys && sysctl net.ipv6.conf.all.disable_ipv6=1' net.ipv6.conf.all.disable_ipv6 = 1 $ ip netns exec testns sysctl net.ipv6.conf.all.disable_ipv6=0 sysctl: setting key "net.ipv6.conf.all.disable_ipv6": Read-only file system
Note that I can do this
sysctl change on host and in LXC's default namespace without any problems. If I create a namespace on the host directly I do not have this problem. I only run into
/proc/sys being read-only inside the namespace inside LXC.
My questions here are:
Q1. I would like
/proc/sys inside the namespace inside LXC to remain permanently mounted with RW so I can set sysctl vars anytime.
Q2. I would like to understand why it behaves the way it does. It seems
/proc/sys mount is somehow per process, or per
setns system call?
man ip-netns talks about bind mount for
/etc/netns/<name>/file but I don't see anything about
/proc. Did I miss something obvious?
I found what is most likely to be the answer to my Q2.
First experimentally and then in
ip netns exec automates handling of this configuration, file convention for network namespace unaware applications, by creating a mount namespace and bind mounting all of the per network namespace configure files into their traditional location in
So every time
ip netns exec creates a new mount namespace but
/proc/sys happens to become the victim of whatever mount options it got where ever it got them from. My best guess is I need to find what causes
ip netns exec to mount bind
/proc/sys in read only mode under LXC, which probably will answer my question Q1.