linux: specify the default devices/filesystems available

[philips]

Linux applications rely on a number of devices and filesystems. Lets define a default set, what do people think of this set lifted from the appc OS-SPEC?

The following devices and filesystems MUST be made available in each application's filesystem

Path	Type	Notes
/proc	procfs
/sys	sysfs
/dev/null	device
/dev/zero	device
/dev/full	device
/dev/random	device
/dev/urandom	device
/dev/tty	device
/dev/console	device
/dev/pts	devpts
/dev/ptmx	device	Bind-mount or symlink of /dev/pts/ptmx
/dev/shm	tmpfs

[wking]

On Wed, Aug 05, 2015 at 03:45:06PM -0700, Brandon Philips wrote:

The following devices and filesystems MUST be made available in each
application's filesystem

I don't have a problem with automatically supplying these, as long as
explicit entries in the mounts or devices arrays can override the
compiled-in defaults. That doesn't leave you with a way to say “I
don't want anything mounted at /dev/shm” (for example), but that's
probably not a big deal.

[mrunalp]

/dev/shm could be optional I think. Also, it could be bind mounted in.

[philips]

@mrunalp We considered making it optional in appc but I don't think it hurts anything to have it.

[LK4D4]

Makes sense.
Also we need to specify order in which bind-mounts and devs created, because it can lead to pretty different behavior.

[philips]

@LK4D4 I agree, that is a separate issue though, right? Or are you saying what happens if someone decides to do a bindmount for /dev from a host filesystem?

[LK4D4]

@philips That is issue too, but I meant per-device. You're right it's another issue.

[mrunalp]

@philips Yeah, i see no harm in requiring /dev/shm.

[dqminh]

I think having these as default makes sense.
However should we also allow the bundle author to deny some devices ? For example, i may not want tty related devices in the container. Maybe that's a separate issue.

[wking]

On Fri, Aug 07, 2015 at 03:23:00AM -0700, Daniel, Dao Quang Minh wrote:

However should we also allow the bundle author to deny some devices
? For example, i may not want tty related devices in the
container. Maybe that's a separate issue.

Why would you not want tty devices? If a container is not attached to
a terminal, trying to open /dev/tty will raise an error 1. I don't
see a need to avoid having the /dev/tty device node though.

[vbatts]

this looks sane to me

On Fri, Aug 7, 2015 at 12:50 PM, W. Trevor King notifications@github.com
wrote:

On Fri, Aug 07, 2015 at 03:23:00AM -0700, Daniel, Dao Quang Minh wrote:

However should we also allow the bundle author to deny some devices
? For example, i may not want tty related devices in the
container. Maybe that's a separate issue.

Why would you not want tty devices? If a container is not attached to
a terminal, trying to open /dev/tty will raise an error 1. I don't
see a need to avoid having the /dev/tty device node though.

—
Reply to this email directly or view it on GitHub
#95 (comment)
.