[libvirt] [PATCH]LXC: force container to enable network namespace

[Gao feng]

On 08/21/2013 05:53 PM, Daniel P. Berrange wrote:
> On Wed, Aug 21, 2013 at 05:49:05PM +0800, Chen Hanxiao wrote:
>> From: Chen Hanxiao <chenhanxiao at cn.fujitsu.com>
>>
>> If we don't enable network namespace, we could shutdown host
>> inside container by command 'shutdown', which is unacceptable.
>> This patch will force users to enable network namespace
>> before they start container.
>>
>> Signed-off-by: Chen Hanxiao <chenhanxiao at cn.fujitsu.com>
>> ---
>>  src/lxc/lxc_container.c |    6 ++++++
>>  1 files changed, 6 insertions(+), 0 deletions(-)
>>
>> diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
>> index c7a22ab..5631ad7 100644
>> --- a/src/lxc/lxc_container.c
>> +++ b/src/lxc/lxc_container.c
>> @@ -1937,6 +1937,12 @@ int lxcContainerStart(virDomainDefPtr def,
>>      if (lxcNeedNetworkNamespace(def)) {
>>          VIR_DEBUG("Enable network namespaces");
>>          cflags |= CLONE_NEWNET;
>> +    } else {
>> +        errno = EINVAL;
>> +
>> +        virReportSystemError(errno, "%s",
>> +                             _("Network namespace needed"));
>> +        return -1;
>>      }
>>  
>>      pid = clone(lxcContainerChild, stacktop, cflags, &args);
> 
> NACK.
> 
> We explicitly want to allow containers sharing the host's network
> namespace. If you wish to prevent the problem you describe, then
> set the <privnet/> feature in the XML, or configure virtual NICs
> 

At least we should give user some warning message or add a notification
about the probable reboot problem if user doesn't configure private
net namespace for container.

Thanks