[Bug 1648056] Please test proposed package
James Page
james.page at ubuntu.com
Wed Feb 8 11:19:14 UTC 2017
Hello James, or anyone else affected,
Accepted nova-lxd into newton-proposed. The package will build now and
be available in the Ubuntu Cloud Archive in a few hours, and then in the
-proposed repository.
Please help us by testing this new package. To enable the -proposed
repository:
sudo add-apt-repository cloud-archive:newton-proposed
sudo apt-get update
Your feedback will aid us getting this update out to other Ubuntu users.
If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, and change the tag
from verification-newton-needed to verification-newton-done. If it does
not fix the bug for you, please add a comment stating that, and change
the tag to verification-newton-failed. In either case, details of your
testing will help us make a better decision.
Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in
advance!
** Changed in: cloud-archive/newton
Status: Triaged => Fix Committed
** Tags added: verification-newton-needed
--
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1648056
Title:
Support LXD multiple sub-uid mapping
Status in OpenStack LXD Charm:
Fix Released
Status in Ubuntu Cloud Archive:
Fix Released
Status in Ubuntu Cloud Archive mitaka series:
Fix Committed
Status in Ubuntu Cloud Archive newton series:
Fix Committed
Status in Ubuntu Cloud Archive ocata series:
Fix Released
Status in nova-lxd:
Fix Released
Status in nova-lxd package in Ubuntu:
Fix Released
Status in nova-lxd source package in Xenial:
Fix Released
Status in nova-lxd source package in Yakkety:
Fix Committed
Status in nova-lxd source package in Zesty:
Fix Released
Bug description:
[Impact]
By default, all LXD containers will run with the same subuid/subgid range, which means that if a single container is compromised, all containers on the same host are potentially compromised as well.
[Test Case]
deploy a nova-lxd based openstack cloud
boot multiple instances
they all share the same uid/gid mapping within a host
boot multiple instances with a flavor property of lxd:isolated
all containers have different uid/gid mappings within a host
[Regression Potential]
Minimal in nova-lxd itself; we're just adding an additional extra-spec and tweaking the container profile if the underlying LXD daemon supports the isolation feature.
[Original Bug Report]
LXD 2.0.6 supports use of distinct sub-uid/gid for each running container; nova-lxd has support for this upstream in all stable and master branches so we should update nova-lxd in >= Xenial to support this feature.
To manage notifications about this bug go to:
https://bugs.launchpad.net/charm-lxd/+bug/1648056/+subscriptions
More information about the Ubuntu-openstack-bugs
mailing list