33
votes
Accepted
What is the /etc/subuid file?
The subordinate uid file contains a list of users and the user ids that the user is allowed to impersonate.
In the example:
dockremap:165536:65536
dockremap is the name of the system user. This can ...
- 9,161
17
votes
Accepted
Podman volume mounts: When to use the :z or :Z suffix?
“Shared” means that multiple containers can share the volume; “unshared” says that they can’t. In a little more detail, :z labels the volume inside each container with the appropriate label (...
- 450k
16
votes
Accepted
What does "if1@if2" mean in interface name in output of "ip address" command on Ubuntu
This represents the link's peer interface index. Although this property appears to be available for any interface, it makes sense for only a few interface types : veth, macvlan, vlan (sub-interface), ....
- 37.5k
14
votes
Access usb device from systemd-nspawn container
systemd-nspawn handles permissions for devices through [cgroups][1]. By default, any container is granted with permissions only for common devices like /dev/null, /dev/zero, etc, and additionally to ...
- 521
13
votes
Accepted
Why is conmon in a different cgroup when podman is started with systemd?
The whole idea behind podman is to go away from the centralized architecture with the super-powerful overseer (e.g. dockerd), where the centralized daemon is a single point of failure. There even is a ...
- 1,272
10
votes
Accepted
Linux - Isolate process without containers
I have not read anything in the description of your problem that would prevent you from creating different user accounts for the applications. You can then use trivial file permissions for preventing ...
- 90.7k
10
votes
Accepted
How to achieve processor affinity in containers?
If your system supports SMP (Symmetric multiprocessing) with some combination of multiple physical CPUs, CPU cores, and logical CPUs, you can assign Docker Containers to specific CPU resources.
...
- 7,302
9
votes
Accepted
How to properly log and view nftables activity?
You can use nftrace to trace packet flows. It's very verbose but doesn't go to kernel logs but instead is distributed over multicast netlink socket (ie if nothing listens to them, traces just go to &...
- 37.5k
8
votes
Accepted
systemd-nspawn OS container is unusable because I can't set the root password
For some reason, dnf didn't set the "right" SELinux label on /etc/passwd. But it did set a label on /bin/passwd. That mismatch is what causes the problem. Further explanations welcomed :).
$ ls -Z ...
- 51.4k
8
votes
Accepted
Why does `nsenter` need to call `fork` before `exec` to ensure that any children will also be in the newly entered PID namespace?
The explanation is given in the “PID namespace” section of man nsenter:
Children will have a set of PID to process mappings separate
from the nsenter process.
...
- 450k
8
votes
Accepted
How can a process detect that it's in a child namespace?
I can share what I found out some time ago when I researched the subject myself. It's certainly not authoritative nor exhaustive but it may be of some help.
Technical description
Disclaimer note
I ...
- 5,478
8
votes
Accepted
getdents() syscall appears to be returning different results within a container
It turns out that getdirents is telling you the truth!
If we enter a rootless podman container and run mount, we see that /dev/null is actually a bind mount (the -v ... here is just so that I have ...
- 36.5k
7
votes
How can we easily revert the changes made by experiements with unfamiliar commands?
I suggest you set up a VM in either Virtual Box or VMware Workstation (VMware Player does not support snapshots), snapshot the VM, do your experiments, and then revert to the snapshot whenever you ...
- 4,686
7
votes
Accepted
How do I find all interfaces that have been configured in Linux, including those of containers?
An interface, at a given time, belongs to one network namespace and only one. The init (initial) network namespace, except for inheriting physical interfaces of destroyed network namespaces has no ...
- 37.5k
7
votes
Accepted
Podman can not kill containers: not running, but state improper
My guess is that this is a bug because containers that are not running should not be targeted with podman kill -a
I was able to get rid of these containers by running
podman container rm -fa
- 32.3k
7
votes
Accepted
Get Raspi's CPU temperature within Docker container
If we just mount /opt/vc inside a container...
docker run -it --rm -v /opt/vc:/opt/vc debian:stretch /opt/vc/bin/vcgencmd measure_temp
...it fails with:
/opt/vc/bin/vcgencmd: error while loading ...
- 36.5k
7
votes
Accepted
Mount NFS - "operation not permitted" in Proxmox container
I found the issue.
Basically, I've created a Debian unprivileged container in Proxmox.
That means NFS is unavailable. Until now, I was unaware of that restriction while using Proxmox containers.
To be ...
- 365
6
votes
Process descendants
You could use this kind of shell script:
set -m; (
# start the processes in this container:
...
) & set +m; pid=$!
...
# terminate the container:
kill -- -"$pid"
The trick is to enable job ...
- 670
6
votes
"date -d" command fails on Docker Alpine Linux container
busybox date supports a -D option which (like zsh's strftime but contrary to GNU date) gives you an interface to strptime() where you can parse dates (though not relative dates) in any format (ast-...
- 559k
6
votes
Accepted
How can I check if cgroups are available on my Linux host?
UPDATE: Upon re-reading your question, I realized that I had answered a slightly different one. You want to know whether a service is running, and I had originally answered how to tell if a package ...
- 3,128
6
votes
Accepted
How to create a chroot from which root cannot escape using chdir("..") on Linux, inside a filesystem?
To protect against the specific chdir("..") escape technique you mentioned, you can simply drop the capability to execute chroot(2) again once you're chrooted to /var/mychroot yourself. The ...
- 22.1k
6
votes
Accepted
Running a different configuration.nix file into a virtual machine from a non-nixos operating system
Thanks to clever and infinisil:
nix-build '<nixpkgs/nixos>' -A vm -I nixos-config=./configuration.nix
- 4,361
6
votes
Docker container shows, "sleep: cannot read realtime clock: Operation not permitted"
All you have to do is add --privileged to docker run
- 32.3k
6
votes
Accepted
Cannot start unprivileged LXC containers on Debian 11 Bullseye
The very last version of Debian bullseye LXC package (1:4.0.6-2 from Fri, 11 Jun 2021) somewhat lately warns about changes in starting unprivileged containers in Debian 11 using cgroup v2 and LXC 4.x:
...
- 37.5k
6
votes
Accepted
Why does podman stop the container why I try to attach to it?
You are trying to get interactive control of the running process. As the container was run with the -t option, apache is attached to a terminal, something not meant to be for a daemon. Attaching to ...
- 37.5k
6
votes
Accepted
What is the net.bridge.bridge-nf-call-iptables kernel parameter?
These parameters determine whether packets crossing a bridge are sent to iptables for processing. Most Kubernetes CNIs rely on iptables, so this is usually necessary for Kubernetes.
The in-kernel ...
- 450k
5
votes
Why is systemd-nspawn not appropriate for production deployments?
That was mentioned in a presentation by Lennart Poettering in 2013, but in 2015 he was quoted saying the following:
systemd also contains the systemd-nspawn container manager. It's a relatively ...
- 448
5
votes
How to make a USB visible in LXD Container
This question is quite old, but I stumbled upon the same use case today and I found a solution so easy that probably it wasn't available 7 months ago.
At this link one can find more information, but ...
- 224
5
votes
Accepted
Should I set the time in a container?
Currently (*), there is no virtualisation of the time ressource in a container, ie there is no "time namespace". That means that should you succeed in changing the time in a container (by overriding ...
- 37.5k
Only top scored, non community-wiki answers of a minimum length are eligible