document that lxc-execute with separate rootfs does not work with commands

[B. Clausius]

1. $ sudo lxc-execute -n container /bin/bash
2. -> The prompt is shown
3. Type echo hello
4. -> The characters you type are not displayed, but the command output is displayed
5. -> The message "lxc-execute: Input/output error - failed to read" is displayed
6. Type exit
7. -> [1]+ Stopped sudo lxc-execute -n precise /bin/bash
8. Type fg and the container ends.

For other commands like nano or less it's the same. The output is correct but the input is not handled right, the effects in 4.,5. and 7. can vary.

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: lxc 0.7.5-3ubuntu52
ProcVersionSignature: Ubuntu 3.2.0-23.36-generic 3.2.14
Uname: Linux 3.2.0-23-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.0.1-0ubuntu5
Architecture: amd64
Date: Sun Apr 22 19:35:33 2012
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Release amd64 (20111012)
SourcePackage: lxc
UpgradeStatus: Upgraded to precise on 2012-03-31 (22 days ago)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Serge Hallyn (serge-hallyn)]

Reproduced with upstream lxc.git as well.

[Serge Hallyn (serge-hallyn)]

the read() in src/lxc/console.c:console_handler() is getting -1 (EPERM).

[Serge Hallyn (serge-hallyn)]

The task getting the -EPERM is the actual lxc-execute process itself (which is unconfined by both apparmor and cgroups), and the fd is to /dev/tty.

[Daniel Lezcano (daniel-lezcano)]

The lxc-execute command is used for 'application container'. Usually, the system container uses a rootfs and the application container do not use a rootfs. So lxc is looking for if the rootfs option is set and then setup the console.

Here lxc-execute is used with the rootfs, so it setup the console, that is to say it maps /dev/console to /dev/tty.

Of course, that makes sense only if we have the applications writing to /dev/console which is the case when the system containers boot. Doing that with a shell is messy and we have problem with the tty.

 => Why is needed a rootfs with lxc-execute ?

There are 2 solutions to fix this problem:

 (1) do not specify the rootfs but ro-bind-mount the <rootfs>/usr to /usr and the other needed directories.
 (2) change the code to have lxc-execute to take into account a rootfs but I wouldn't recommend that because that will bring much more complexity and more errors with the console by adding a new configuration combination. At least we should decide to ignore the rootfs option when lxc-execute is used.

[Serge Hallyn (serge-hallyn)]

Thanks Daniel.

It sounds then like we should document this somewhere explicitly. I'll re-title the but and mark it low priority.

[B. Clausius (barcc)]

The last comments make me think that lxc-execute works with application containers. Does it work?

The simplest usage would be (without a created container test):
$ sudo lxc-execute -n test /bin/bash
But due to bug 981955 this does not work. With the workaround there:
$ sudo lxc-execute -n test /bin/bash -s lxc.rootfs=/ -s lxc.aa_profile=unconfined
Now Daniel suggests not to specify lxc.rootfs?

What config makes the bash work with lxc-execute?
Or are interactive commands not intended to work with lxc-execute? The man-page says it should.

[Serge Hallyn (serge-hallyn)]

Quoting B Clausius (<email address hidden>):
> The last comments make me think that lxc-execute works with application
> containers. Does it work?
>
> The simplest usage would be (without a created container test):
> $ sudo lxc-execute -n test /bin/bash
> But due to bug 981955 this does not work. With the workaround there:
> $ sudo lxc-execute -n test /bin/bash -s lxc.rootfs=/ -s lxc.aa_profile=unconfined
> Now Daniel suggests not to specify lxc.rootfs?

Right, that being the case, that bug's priority needs to be raised. I will
get fixes proposed for SRU for that bug today.

> What config makes the bash work with lxc-execute?

Just lxc.aa_profile = unconfined will work, once bug 981955 is fixed.

[Dylan Vassallo (dylanvassallo)]

I am seeing this behavior too on 12.04. I must specify lxc.aa_profile = unconfined, and I must omit a rootfs setting, for lxc-execute to work with anything interactive like bash or python.

[flob (fburka)]

Adding -s lxc.tty=1 -s lxc.console=/dev/console for interactive processes works for me:

sudo lxc-execute -n test /bin/bash -s lxc.rootfs=/ -s lxc.tty=1 -s lxc.console=/dev/console

[Christian Brauner (cbrauner)]

lxc-execute now works correctly without a rootfs in LXC 2.*.*. So closing this.