[systemd-devel] udev within a container
Daniel P. Berrange
berrange at redhat.com
Fri Jul 26 08:20:33 PDT 2013
On Fri, Jul 26, 2013 at 05:16:16PM +0200, Kay Sievers wrote:
> On Fri, Jul 26, 2013 at 5:09 PM, Rob Spanton <rspanton at zepler.net> wrote:
> > I would like to run some processes inside a container that interact with
> > udev. Ideally udev would be within the same container as those
> > processes, as then I could also have udev rules that started other
> > things within that container too...
> > However, as far as I can tell, it's not possible to run udev within a
> > container -- is this correct? Is there a magical workaround that I
> > haven't found!?
> There is no real support to run udev inside a container. It might be
> possible to hack around that, but it's nothing that seems convincing
> so far. We just run containers without any udev setup, but with a
> minimal pre-setup /dev.
Furthermore, in the absence of any "devices" namespace in the kernel,
it would be a security flaw to allow a process inside the container
(whether udevd or something else) the permission to mknod. So you must
always pre-populate /dev and remove CAP_MKNOD instead of running udev,
if you want any security.
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
More information about the systemd-devel