mydocker
mydocker copied to clipboard
xianlubird
运行之后关闭之后,ubuntu的/proc就没有了
http://old-releases.ubuntu.com/releases/14.04.0/ubuntu-14.04-desktop-amd64.iso 提供一个和作者内核版本一样的 ubuntu
kernel: 5.0.4 在 namespace 里面 mount /proc 后，退出后 host /proc 需要重新 mount 请问怎么解决这个问题
kernel: 5.0.4 在 namespace 里面 mount /proc 后，退出后 host /proc 需要重新 mount 请问怎么解决这个问题
// systemd 加入linux之后, mount namespace 就变成 shared by default, 所以你必须显示
//声明你要这个新的mount namespace独立。
syscall.Mount("", "/", "", syscall.MS_PRIVATE | syscall.MS_REC, "")
defualtMountFlags := syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
syscall.Mount("proc", "/proc", "proc", uintptr(defualtMountFlags), "")
kernel: 5.0.4 在 namespace 里面 mount /proc 后，退出后 host /proc 需要重新 mount 请问怎么解决这个问题
// systemd 加入linux之后, mount namespace 就变成 shared by default, 所以你必须显示 //声明你要这个新的mount namespace独立。 syscall.Mount("", "/", "", syscall.MS_PRIVATE | syscall.MS_REC, "") defualtMountFlags := syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV syscall.Mount("proc", "/proc", "proc", uintptr(defualtMountFlags), "")
请问：syscall.Mount("", "/", "", syscall.MS_PRIVATE | syscall.MS_REC, "")和在命令行输入unshare -m的效果一样吗？
发现是systemd的锅...
厉害了，发现的步骤是怎样的呢？ 的确解决了我的问题。
我用腾讯云centos开发， 每次运行后。 不仅需要重新 mount。 而且再用ssh连机器 都连不上～～～
加上 syscall.Mount("", "/", "", syscall.MS_PRIVATE | syscall.MS_REC, "") 后就好了
感谢 @readlnh 的解答！
这里补充一下 mount 官方文档的完整解释：
https://man7.org/linux/man-pages/man7/mount_namespaces.7.html#NOTES
The propagation type assigned to a new mount depends on the propagation type of the parent mount. If the mount has a parent (i.e., it is a non-root mount point) and the propagation type of the parent is MS_SHARED, then the propagation type of the new mount is also MS_SHARED. Otherwise, the propagation type of the new mount is MS_PRIVATE.
Notwithstanding the fact that the default propagation type for new mount is in many cases MS_PRIVATE, MS_SHARED is typically more useful. For this reason, systemd(1) automatically remounts all mounts as MS_SHARED on system startup. Thus, on most modern systems, the default propagation type is in practice MS_SHARED.
Since, when one uses unshare(1) to create a mount namespace, the goal is commonly to provide full isolation of the mounts in the new namespace, unshare(1) (since util-linux version 2.27) in turn reverses the step performed by systemd(1), by making all mounts private in the new namespace. That is, unshare(1) performs the equivalent of the following in the new mount namespace:
mount --make-rprivate /
To prevent this, one can use the --propagation unchanged option to unshare(1).
An application that creates a new mount namespace directly using clone(2) or unshare(2) may desire to prevent propagation of mount events to other mount namespaces (as is done by unshare(1)). This can be done by changing the propagation type of mounts in the new namespace to either MS_SLAVE or MS_PRIVATE, using a call such as the following:
mount(NULL, "/", MS_SLAVE | MS_REC, NULL);
For a discussion of propagation types when moving mounts (MS_MOVE) and creating bind mounts (MS_BIND), see Documentation/filesystems/sharedsubtree.txt.
