On 13/08/14 01:21 PM, Mihamina Rakotomandimby wrote:
On 08/13/2014 08:09 PM, Leonid Isaev wrote:
As you know, user_ns is a necesary prerequisite for unpriviileged containers: https://www.stgraber.org/2014/01/17/lxc-1-0-unprivileged-containers/ . AFAIU, currently only Ubuntu 14.04 supports those.
However, I agree with you that CONFIG_USER_NS is better left disabled in -ARCH kernels. After all, people using containers should be able to compile a custom kernel...
Hi all,
One use case of using LXC might be to want to quicky have a virtual environment running.
Easing the work by defaulting to a ready-to-work kernel would be nice.
Regards.
Containers work fine without CONFIG_USER_NS. You just can't spawn them without being a privileged user. There's a good reason for that, as shown by the endless stream of local root exploits via user namespaces. Having uid 0 or root equivalent capabilities in a container with or without user namespaces is equivalent to root access on the host due to flaws in the implementation. By removing the check for a privileged user, upstream just guaranteed that sane distributions are not going to enable the feature (at least without patching it, which isn't Arch's style).