lxc-start-ephemeral is not all ephemeral

[Gary Poster]

The directories mounted both using the ephemeral's fstab and using -b are not ephemeral. Changes to them persist on the filesystem, and are thus shared across other ephemeral instances that mount the same directories.

We have a branch that addresses this concern. We took the approach that -b should bind ephemeral directories; *and* if the destination directory is in the ephemeral's inherited fstab, we disable that mount from the fstab.

Thus, if a base container's fstab mounts proc, sys, and /home/gary, and you pass "-b /home/gary" to lxc-start-ephemeral, /home/gary will be mounted as an ephemeral, local copy; otherwise, without the -b, the fstab entry will be mounted as usual, and /home/gary will be persisted and shared.

[Serge Hallyn (serge-hallyn)]

Hi Gary,

if that's what you want I'll happily import the branch, but my understanding was that the -b directory was meant as a way to copy the end result to the host.

The branch addressing this isn't linked to this bug yet. Can you make sure to add a changelog entry with a (LP: #951150) and push, so that it will link to this bug?

thanks,
-serge

[Gary Poster (gary)]

Hi Serge. I don't actually know the original intent of -b, but what you say makes sense. I changed our code to change all bind mounts in the ephemeral's container to an ephemeral overlay, instead. That's kind of what I wanted anyway, but I was being lazy. :-) I also worried it would not be safe, but I thought about it some more and I think it might be fine.

Also, now -b will change fstab rather than directly mounting, which simplifies some of the cleanup code.

I'll add a changelog as you request. We still want to test it a bit more before we make an MP, but I'll link it now in case you have any thoughts you want to share early.

Thanks!

[Serge Hallyn (serge-hallyn)]

Quoting Gary Poster (<email address hidden>):
> Hi Serge. I don't actually know the original intent of -b, but what you
> say makes sense. I changed our code to change all bind mounts in the
> ephemeral's container to an ephemeral overlay, instead. That's kind of
> what I wanted anyway, but I was being lazy. :-) I also worried it would
> not be safe, but I thought about it some more and I think it might be
> fine.
>
> Also, now -b will change fstab rather than directly mounting, which
> simplifies some of the cleanup code.
>
> I'll add a changelog as you request.

No need, I've pushed your patch. Please do check when it is published
to make sure I merged the right branch :)

thanks,
-serge