[systemd-devel] udev within a container

[Daniel P. Berrange]

On Fri, Jul 26, 2013 at 05:16:16PM +0200, Kay Sievers wrote:
> On Fri, Jul 26, 2013 at 5:09 PM, Rob Spanton <rspanton at zepler.net> wrote:
> > I would like to run some processes inside a container that interact with
> > udev.  Ideally udev would be within the same container as those
> > processes, as then I could also have udev rules that started other
> > things within that container too...
> >
> > However, as far as I can tell, it's not possible to run udev within a
> > container -- is this correct?  Is there a magical workaround that I
> > haven't found!?
> 
> There is no real support to run udev inside a container. It might be
> possible to hack around that, but it's nothing that seems convincing
> so far. We just run containers without any udev setup, but with a
> minimal pre-setup /dev.

Furthermore, in the absence of any "devices" namespace in the kernel,
it would be a security flaw to allow a process inside the container
(whether udevd or something else) the permission to mknod. So you must
always pre-populate /dev and remove CAP_MKNOD instead of running udev,
if you want any security.

Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|