[lxc] why a container wants to mount sysfs anyway?

[Иван Присяжный]

Hi,

What is the reason containers start wants to mount sysfs so badly?

Why it is in the auto-mounts list and can't be disabled?

Why sysfs is needed and whats for?

Thx,
Ivan

[Serge E. Hallyn]

A lot of user space wants to poke around /sys to get system
information.

But you can disable its mounting into containers - or should be able to - by
setting lxc.mount.auto to not include it. See 'man lxc.container.conf' for
information.

> --
> You received this message because you are subscribed to the Google Groups "lxc-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to lxc-users+...@lists.linuxcontainers.org.
> To view this discussion on the web visit https://groups.google.com/a/lists.linuxcontainers.org/d/msgid/lxc-users/6f7edb1e-8f43-4a23-9b11-3a03e287cb82n%40lists.linuxcontainers.org.

[Иван Присяжный]

вторник, 25 января 2022 г. в 20:42:55 UTC+2, Serge E. Hallyn:

A lot of user space wants to poke around /sys to get system
information.

But you can disable its mounting into containers - or should be able to - by
setting lxc.mount.auto to not include it. See 'man lxc.container.conf' for
information.

It seems that it is impossible to do so:

lxc.mount.auto = proc:mixed cgroup:ro

due to how the set_config_mount_auto is implemented.

In current impl it is only possible to manually materialized common and user includes and comment out the strings that generally set auto sys to mixed.

[Serge E. Hallyn]

On Wed, Jan 26, 2022 at 07:42:53AM -0800, Иван Присяжный wrote:
>
>
> вторник, 25 января 2022 г. в 20:42:55 UTC+2, Serge E. Hallyn:
>
> > A lot of user space wants to poke around /sys to get system
> > information.
> >
> > But you can disable its mounting into containers - or should be able to -
> > by
> > setting lxc.mount.auto to not include it. See 'man lxc.container.conf' for
> > information.
> >
>
> It seems that it is impossible to do so:

It's not. I put

lxc.mount.auto = proc:mixed

Into a busybox container's config, and /sys was thereafter not mounted.
Now, if an earlier line - perhaps in a lxc.include = file - specifies
lxc.mount.auto = sys:something, then you'll have to clear that out by
doing:

lxc.mount.auto =
lxc.mount.auto = proc:mixed

-serge

[Иван Присяжный]

Oh, thx! This indeed helps.

>
> -serge



--
-- Ivan Prisyazhnyy

[Serge E. Hallyn]

The lxc.mount.auto section lxc.container.conf(5) should be updated to mention
that entries are appended, and the accumulated entries can be cleared by
using the line with no option. There's a line like that for the lxc.net,
I thought there was one for lxc.mount.auto.