[Bug 1648056] Re: Support LXD multiple sub-uid mapping
james.page at ubuntu.com
Wed Feb 8 12:08:17 UTC 2017
Verified LXD isolation on yakkety:
$ ps -aef | grep init
165536 1934 1910 0 11:59 ? 00:00:00 /sbin/init
231072 3203 3185 0 11:59 ? 00:00:00 /sbin/init
container init and other processes running in distinct ranges.
** Tags removed: verification-needed
** Tags added: verification-done
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
Support LXD multiple sub-uid mapping
Status in OpenStack LXD Charm:
Status in Ubuntu Cloud Archive:
Status in Ubuntu Cloud Archive mitaka series:
Status in Ubuntu Cloud Archive newton series:
Status in Ubuntu Cloud Archive ocata series:
Status in nova-lxd:
Status in nova-lxd package in Ubuntu:
Status in nova-lxd source package in Xenial:
Status in nova-lxd source package in Yakkety:
Status in nova-lxd source package in Zesty:
By default, all LXD containers will run with the same subuid/subgid range, which means that if a single container is compromised, all containers on the same host are potentially compromised as well.
deploy a nova-lxd based openstack cloud
boot multiple instances
they all share the same uid/gid mapping within a host
boot multiple instances with a flavor property of lxd:isolated
all containers have different uid/gid mappings within a host
Minimal in nova-lxd itself; we're just adding an additional extra-spec and tweaking the container profile if the underlying LXD daemon supports the isolation feature.
[Original Bug Report]
LXD 2.0.6 supports use of distinct sub-uid/gid for each running container; nova-lxd has support for this upstream in all stable and master branches so we should update nova-lxd in >= Xenial to support this feature.
To manage notifications about this bug go to:
More information about the Ubuntu-openstack-bugs