libvirt users - Mar 2012 - Correctly using libvirt to mount /dev/pts and /dev in an lxc application container

We would like to mount /dev and /dev/pts correctly using the libvirt xml
config file instead of doing a bind mount in a container init script we use.

Currently the container config is:

<domain type='lxc'>
  <name>CentOS_57</name>
  <uuid>ff5d3c04-49e6-a3cc-0a14-ff13625eca3c</uuid>
  <memory>262144</memory>
  <currentMemory>262144</currentMemory>
  <vcpu>1</vcpu>
  <os>
    <type arch='i686'>exe</type>
    <init>/bin/lxc-progs</init>
  </os>
  <clock offset='utc'/>
  <on_poweroff>destroy</on_poweroff>
  <on_reboot>restart</on_reboot>
  <on_crash>restart</on_crash>
  <devices>
    <emulator>/usr/libexec/libvirt_lxc</emulator>
    <filesystem type='mount' accessmode='passthrough'>
      <source dir='//home'/>
      <target dir='/home'/>
    </filesystem>
    <filesystem type='mount' accessmode='passthrough'>
      <source dir='/archive/centos57-root'/>
      <target dir='/'/>
    </filesystem>
    <filesystem type='mount' accessmode='passthrough'>
      <source dir='//archive'/>
      <target dir='/archive'/>
    </filesystem>
    <console type='pty'>
      <target type='serial' port='0'/>
    </console>
  </devices>
</domain>


The /bin/lxc-progs file is:

#!/bin/sh

service rsyslog start
service sssd start
service sshd start
mount -t devtmpfs none /dev
mount -t devpts none /dev/pts
mount -t tmpfs none /dev/shm
exec /bin/sh

Basically how do we remove the above mount points in the lxc init
process and use libvirt to control the mounts instead?

Any help would be appreciated.  Thank you.

-- 
David W. Jablonski
Systems Administrator
INOC
608.204.0202
608.663.4555
djablonski at inoc.com
www.inoc.com

*** DELIVERING UPTIME ***

On 2012-03-06 19:34, David Jablonski wrote:
> We would like to mount /dev and /dev/pts correctly using the libvirt 
> xml
> config file instead of doing a bind mount in a container init script 
> we
> use.
You will automatically get a private /dev/pts, without any additional 
configuration.

/dev will also get created, but only a very minimal version, and you 
cannot use udev inside LXC. So any devices not in the minimal /dev that 
need to be accessible will need to be created using mknod in your 
script. If you get a permission denied error from mknod, the device 
permissions for the cgroup for the container need to be modified.

libvirt is supposed to set up such permissions for you if you specify 
you want a device passed through, but I have not been able to get this 
to work with containers. I could not get the libcgroup-tools service to 
run on bootup either. So I have been manipulating the cgroup permissions 
manually in /proc, which is not exactly ideal.

-- 
Robin