Strongswan daemon puts its .pid and .ctl files in /var/run to detect if it is already running.

I want to run multiple of these daemons on the same machine within different network namespaces. I am trying to achieve this by bind mounting different directories (say /etc/namespace1 to namespace1's /var/run and /etc/namespace2 to namespace2's /var/run). /var/run is a symlink to /run, so I bind mount to /run like below.

I can almost achieve this like this:

""In default namespace""

$:~ sudo echo "red" >> /etc/red/run/pidfile
$:~ sudo echo "blue" >> /etc/blue/run/pidfile
$:~ sudo ip netns exec red

""In red namespace""

$:~ mount --bind /etc/red/run/ /run/
$:~ cat /var/run/pidfile


""In blue namespace""

 $:~ mount --bind /etc/blue/run/ /run/
 $:~ cat /var/run/pidfile


So this works fine. This way the daemon when it creates /var/run/charon.pid while inside red will not confuse with blue namespace's /var/run/charon.pid and two instances may start.

However, here's the issue: if I "exit" from red namespace and then re-enter via "ip netns exec red bash", then the mount is no longer present. That is there is no /var/run/redfile at all.

So, the question is how can I make this sticky? Do I need /etc/fstab changes? But it doesn't work. If asked, I can provide details of "it doesn't work".

I am lost. Will appreciate some help.


migrated from serverfault.com Apr 29 '17 at 5:52

This question came from our site for system and network administrators.


The simple solution would be to instruct each instance of strongswan to use a different directory to store the PID file by means of setting the correct value of the IPSEC_PIDDIR environment variable in your start and stop script.

  • Hi, Certainly that is precisely what I need. But I couldn't find any release that supports passing IPSEC_PIDDIR as an environment variable. I only see it being hardcoded in /usr/sbin/ipsec to be "/var/run". Any pointers/release version would greatly help! I don't see there is any release that honors IPSEC_PIDDIR. Will be very happy if I am wrong. – Samar Apr 30 '17 at 21:00

ip netns exec already bind mounts /etc/netns/<netns name>/* over the corresponding file/directory in /etc. So you may compile strongSwan with e.g. --with-piddir=/etc/ipsec.d/run and then create the required directories so each instance creates its PID files in separate directories:

# mkdir -p /etc/ipsec.d/run
# mkdir -p /etc/netns/<netns name 1>/ipsec.d/run
# mkdir -p /etc/netns/<netns name 2>/ipsec.d/run

More details can be found on the strongSwan wiki.

  • Hi, Yes I had already tried this approach and it works. But unfortunately for my deployment, I cannot involve the compile step. I will need to work with standard .deb files (I cannot do with compilation changes, autoconf changes or custom .deb files) :( – Samar May 1 '17 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.