lxc-config/default-eve.conf

78 lines
2.6 KiB
Plaintext
Raw Normal View History

2014-08-18 08:29:43 +00:00
lxc.autodev = 1
lxc.kmsg = 0
2015-08-05 15:33:37 +00:00
lxc.cap.keep = chown dac_override dac_read_search fowner fsetid ipc_owner kill lease linux_immutable net_bind_service net_broadcast net_raw setgid setfcap setpcap setuid sys_admin sys_chroot sys_nice sys_ptrace sys_tty_config sys_resource sys_boot audit_write audit_control mknod
2015-03-30 22:02:32 +00:00
# Setup the LXC devices in /dev/lxc/
lxc.devttydir = lxc
2015-12-13 19:24:00 +00:00
lxc.init_cmd = /usr/lib/systemd/systemd
2015-03-30 22:02:32 +00:00
# Set the halt/stop signals
lxc.haltsignal=SIGRTMIN+4
lxc.stopsignal=SIGRTMIN+14
# Set the pivot directory
lxc.pivotdir = lxc_putold
# Blacklist some syscalls which are not safe in privileged
# containers
2015-03-31 06:46:30 +00:00
lxc.seccomp = /etc/lxc/default.seccomp
2014-08-18 08:29:43 +00:00
lxc.network.type = veth
lxc.network.link = br0
lxc.network.flags = up
2014-10-23 22:09:01 +00:00
lxc.network.name = eth0
2014-08-18 08:29:43 +00:00
lxc.network.mtu = 1500
2015-08-05 15:33:37 +00:00
lxc.network.ipv4.gateway = 172.23.75.2
2016-02-02 22:13:00 +00:00
lxc.network.ipv6.gateway = fe80::1
2014-08-18 08:29:43 +00:00
2014-10-23 22:09:01 +00:00
# cgroups
lxc.cgroup.devices.deny = a
2015-03-30 22:02:32 +00:00
## Allow any mknod (but not reading/writing the node)
2014-10-23 22:09:01 +00:00
lxc.cgroup.devices.allow = c *:* m
lxc.cgroup.devices.allow = b *:* m
2015-03-30 22:02:32 +00:00
## Allow specific devices
### /dev/null
2014-10-23 22:09:01 +00:00
lxc.cgroup.devices.allow = c 1:3 rwm
2015-03-30 22:02:32 +00:00
### /dev/zero
2014-10-23 22:09:01 +00:00
lxc.cgroup.devices.allow = c 1:5 rwm
2015-03-30 22:02:32 +00:00
### /dev/full
2014-10-23 22:09:01 +00:00
lxc.cgroup.devices.allow = c 1:7 rwm
lxc.cgroup.devices.allow = c 4:1 rwm
2015-03-30 22:02:32 +00:00
### /dev/tty
2014-10-23 22:09:01 +00:00
lxc.cgroup.devices.allow = c 5:0 rwm
2015-03-30 22:02:32 +00:00
### /dev/console
2014-10-23 22:09:01 +00:00
lxc.cgroup.devices.allow = c 5:1 rwm
2015-03-30 22:02:32 +00:00
### /dev/ptmx
2014-10-23 22:09:01 +00:00
lxc.cgroup.devices.allow = c 5:2 rwm
2015-03-30 22:02:32 +00:00
### /dev/random
lxc.cgroup.devices.allow = c 1:8 rwm
### /dev/urandom
lxc.cgroup.devices.allow = c 1:9 rwm
### /dev/pts/*
2014-10-23 22:09:01 +00:00
lxc.cgroup.devices.allow = c 136:* rwm
2015-03-30 22:02:32 +00:00
### fuse
lxc.cgroup.devices.allow = c 10:229 rwm
2014-10-23 22:09:01 +00:00
lxc.cgroup.memory.soft_limit_in_bytes = 1500M
lxc.cgroup.memory.limit_in_bytes = 2000M
lxc.cgroup.cpu.shares = 256
lxc.cgroup.blkio.weight = 500
2015-03-30 22:02:32 +00:00
# Setup the default mounts
lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
lxc.mount.entry = /data/pacman/pkg var/cache/pacman/pkg none bind 0 0
lxc.mount.entry = /data/pacman/sync var/lib/pacman/sync none bind 0 0
2015-08-05 15:33:37 +00:00
lxc.mount.entry = /data/containers/login/rootfs/var/lib/aurrepo srv/repo none bind,ro,create=dir,umask=0 0 0
2014-08-18 08:29:43 +00:00
lxc.mount.entry = /run/systemd/journal mnt/journal none bind,ro,create=dir 0 0
lxc.hook.clone = /etc/lxc/hooks/setup-machine-id
lxc.hook.clone = /etc/lxc/hooks/remove-journal
lxc.hook.clone = /etc/lxc/hooks/cleanup-lxc-config
lxc.hook.clone = /etc/lxc/hooks/create-lxc-config
lxc.hook.clone = /etc/lxc/hooks/update-zone
2015-01-03 16:55:03 +00:00
lxc.hook.clone = /etc/lxc/hooks/update-hetzner-rdns
2014-08-18 08:29:43 +00:00
lxc.hook.clone = /etc/lxc/hooks/ansible
2015-08-05 15:33:37 +00:00
lxc.hook.autodev = /etc/lxc/hooks/dn42-routes