Red Hat Bugzilla – Bug 1029070
libvirt-lxc: allow the use of a pre-populated /dev directory
Last modified: 2014-01-23 10:54:28 EST
The docker team has a concept called docker-in-docker where they want to spawn containers from within a container. They already use the lxc tools for this purpose.
In my port of docker to use libvirt-lxc as its container backend, it would be very helpful to have this functionality. Currently libvirt-lxc drops the CAP_MKNOD capability so it's not directly possible to start a container from inside an outer libvirt-lxc container, since the inner container creation logic creates a /dev/ tmpfs and then needs to mknod several device files.
As Daniel Berrange pointed out to me, allowing a container to mknod is very dangerous. A much more acceptable solution would be to add a feature to libvirt-lxc to allow the use of an existing pre-populated /dev directory.
I think we can cancel this bug now since the mknod issue will be solved by bug 1057200.