Alexander Larsson a4a84bcafe libcontainer: Use pivot_root instead of chroot ...

Instead of keeping all the old mounts in the container namespace and
just using subtree as root we pivot_root so that the actual root in
the namespace is the root we want, and then we unmount the previous
mounts.

This has multiple advantages:

* The namespace mount tree is smaller (in the kernel)
* If you break out of the chroot you could previously access the host
  filesystem. Now the host filesystem is fully invisible to the namespace.
* We get rid of all unrelated mounts from the parent namespace, which means
  we don't hog these. This is important if we later switch to MS_PRIVATE instead
  of MS_SLAVE as otherwise these mounts would be impossible to unmount from the
  parent namespace.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 5b5c884cc8266d0c2a56da0bc2df14cc9d5d85e8
Component: engine

2014-03-04 12:44:08 +01:00

..

nsinit

Fix cross compile for make cross

2014-02-25 15:19:13 -08:00

command.go

Fix cross compile for make cross

2014-02-25 15:19:13 -08:00

exec.go

Code review updates

2014-02-26 19:21:46 -08:00

execin.go

Factor out finalize namespace

2014-03-03 12:15:47 -08:00

init.go

Factor out finalize namespace

2014-03-03 12:15:47 -08:00

mount.go

libcontainer: Use pivot_root instead of chroot

2014-03-04 12:44:08 +01:00

nsinit.go

Refactor and improve libcontainer and driver

2014-02-24 21:11:52 -08:00

state.go

Move container.json and pid file into a root specific driver dir

2014-02-25 12:41:31 -08:00

sync_pipe.go

Add syncpipe for passing context

2014-02-21 22:58:30 -08:00

term.go

Refactor driver to use Exec function from nsini

2014-02-22 01:21:26 -08:00

unsupported.go

Fix cross compile for make cross

2014-02-25 15:19:13 -08:00