[Bug 1648056] Re: Support LXD multiple sub-uid mapping

[James Page]

** Changed in: nova-lxd (Ubuntu Xenial)
       Status: New => Triaged

** Changed in: nova-lxd (Ubuntu Yakkety)
       Status: New => Triaged

** Changed in: nova-lxd (Ubuntu Zesty)
       Status: New => Triaged

** Changed in: nova-lxd
       Status: In Progress => Fix Released

** Changed in: charm-lxd
       Status: Fix Committed => Fix Released

** Changed in: cloud-archive/mitaka
       Status: Fix Committed => Triaged

** Changed in: cloud-archive/newton
       Status: Fix Committed => Triaged

** Changed in: cloud-archive/ocata
       Status: New => Triaged

** Description changed:

- LXD 2.0.6 supports use of distinct sub-uid/gid for each running
- container; nova-lxd has support for this upstream in all stable and
- master branches so we should update nova-lxd in >= Xenial to support
- this feature.
+ [Impact]
+ By default, all LXD containers will run with the same subuid/subgid range, which means that if a single container is compromised, all containers on the same host are potentially compromised as well.
+ 
+ [Test Case]
+ deploy a nova-lxd based openstack cloud
+ boot multiple instances
+ they all share the same uid/gid mapping within a host
+ 
+ boot multiple instances with a flavor property of lxd:isolated
+ all containers have different uid/gid mappings within a host
+ 
+ [Regression Potential]
+ Minimal in nova-lxd itself; we're just adding an additional extra-spec and tweaking the container profile if the underlying LXD daemon supports the isolation feature.
+ 
+ [Original Bug Report]
+ LXD 2.0.6 supports use of distinct sub-uid/gid for each running container; nova-lxd has support for this upstream in all stable and master branches so we should update nova-lxd in >= Xenial to support this feature.

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1648056

Title:
  Support LXD multiple sub-uid mapping

Status in OpenStack LXD Charm:
  Fix Released
Status in Ubuntu Cloud Archive:
  Triaged
Status in Ubuntu Cloud Archive mitaka series:
  Triaged
Status in Ubuntu Cloud Archive newton series:
  Triaged
Status in Ubuntu Cloud Archive ocata series:
  Triaged
Status in nova-lxd:
  Fix Released
Status in nova-lxd package in Ubuntu:
  Triaged
Status in nova-lxd source package in Xenial:
  Triaged
Status in nova-lxd source package in Yakkety:
  Triaged
Status in nova-lxd source package in Zesty:
  Triaged

Bug description:
  [Impact]
  By default, all LXD containers will run with the same subuid/subgid range, which means that if a single container is compromised, all containers on the same host are potentially compromised as well.

  [Test Case]
  deploy a nova-lxd based openstack cloud
  boot multiple instances
  they all share the same uid/gid mapping within a host

  boot multiple instances with a flavor property of lxd:isolated
  all containers have different uid/gid mappings within a host

  [Regression Potential]
  Minimal in nova-lxd itself; we're just adding an additional extra-spec and tweaking the container profile if the underlying LXD daemon supports the isolation feature.

  [Original Bug Report]
  LXD 2.0.6 supports use of distinct sub-uid/gid for each running container; nova-lxd has support for this upstream in all stable and master branches so we should update nova-lxd in >= Xenial to support this feature.

To manage notifications about this bug go to:
https://bugs.launchpad.net/charm-lxd/+bug/1648056/+subscriptions