[Qgis-developer] docker container: unshare namespace (sysadmin talk)
Tim Sutton
tim at linfiniti.com
Mon Nov 18 21:16:50 PST 2013
HI
On Mon, Nov 18, 2013 at 9:49 PM, Matthias Kuhn <matthias.kuhn at gmx.ch> wrote:
> I hope we have some experienced sysadmins here on the list who can bring
> light into the dark.
>
> The situation is
>
> I try to build rpms for fedora/centos on our shiny new server where we
> have docker.io set up, so we can easily create multiple containers for
> the different tasks the server will run. So I have created a container
> based on centos and installed mock (the tool fedora uses for packaging).
>
> However, running mock (inside the container) fails:
>
> ERROR: Namespace unshare failed.
>
> As far as I can tell, mock needs the "unshare" system call to create a
> new mountpoint inside the process, where it can create a virtual build
> environment. But calling namespace with CLONE_NEWNS fails with EPERM.
> The manpage states:
>
> EPERM flags specified CLONE_NEWNS but the calling process
> was not
> privileged (did not have the CAP_SYS_ADMIN capability).
>
> Trying to change this capability of the binary does not work, although
> we are root inside the container, so I guess this kind of capabilities
> gets inherited from my non-privileged user on the host itself. I assume
> (untested) that the following command would fix this issue:
>
> sudo lxc-docker run centos/qgis-nightly setcap cap_sys_admin+ep
> /usr/sbin/mock
>
> I would be very happy, if somebody with server administration and
> especially capabilities experience could let me know, if this is a safe
> thing and the right to do in order to solve this problem, because to me
> this is all still black magic.
>
> Regards
> Matthias
>
I reckon since you are just bringing up your container, building your
package and then bringing it down without hosting any public service from
the container itself (correct?) , its probably fine.
Regards
Tim
--
Tim Sutton - QGIS Project Steering Committee Member
==============================================
Visit http://linfiniti.com to find out about:
* QGIS programming services
* GeoDjango web development
* FOSS Consulting Services
Skype: timlinux Irc: timlinux on #qgis at freenode.net
==============================================
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20131119/e8bdfe63/attachment.html>
More information about the Qgis-developer
mailing list