a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi<!DOCTYPE refentry PUBLIC @docdtd@ [

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi<!ENTITY commonoptions SYSTEM "@builddir@/common_options.sgml">

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi<!ENTITY seealso SYSTEM "@builddir@/see_also.sgml">

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi]>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi<refentry>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <docinfo><date>@LXC_GENERATE_DATE@</date></docinfo>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <refmeta>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <refentrytitle>lxc-attach</refentrytitle>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <manvolnum>1</manvolnum>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </refmeta>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <refnamediv>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <refname>lxc-attach</refname>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <refpurpose>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi start a process inside a running container.

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </refpurpose>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </refnamediv>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

6127da6b3f5815028bee187ac98840cd94313841KATOH Yasufumi <refsynopsisdiv>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <cmdsynopsis>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <command>lxc-attach</command>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <arg choice="req">-n <replaceable>name</replaceable></arg>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <arg choice="opt">-a <replaceable>arch</replaceable></arg>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <arg choice="opt">-e</arg>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <arg choice="opt">-s <replaceable>namespaces</replaceable></arg>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <arg choice="opt">-R</arg>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <arg choice="opt">--keep-env</arg>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <arg choice="opt">--clear-env</arg>

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi <arg choice="opt">-- <replaceable>command</replaceable></arg>

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi <arg choice="opt">-L <replaceable>file</replaceable></arg>

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi </cmdsynopsis>

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi </refsynopsisdiv>

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <refsect1>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <title>Description</title>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <command>lxc-attach</command> runs the specified

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <replaceable>command</replaceable> inside the container

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi specified by <replaceable>name</replaceable>. The container

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi has to be running already.

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <para>

7c3d3950528671460bcd333af842a6158e4166b6KATOH Yasufumi If no <replaceable>command</replaceable> is specified, the

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi current default shell of the user running

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <command>lxc-attach</command> will be looked up inside the

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi container and executed. This will fail if no such user exists

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi inside the container or the container does not have a working

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi nsswitch mechanism.

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi Previous versions of <command>lxc-attach</command> simply attached to the

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi specified namespaces of a container and ran a shell or the specified command

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi without first allocating a pseudo terminal. This made them vulnerable to

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi input faking via a TIOCSTI <command>ioctl</command> call after switching

dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi between userspace execution contexts with different privilege levels. Newer

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi versions of <command>lxc-attach</command> will try to allocate a pseudo

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi terminal master/slave pair on the host and attach any standard file

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi descriptors which refer to a terminal to the slave side of the pseudo

a9b21284fceafaf57b1bb58cf59f939dcf68141aKATOH Yasufumi terminal before executing a shell or command. Note, that if none of the

a9b21284fceafaf57b1bb58cf59f939dcf68141aKATOH Yasufumi standard file descriptors refer to a terminal <command>lxc-attach</command>

a9b21284fceafaf57b1bb58cf59f939dcf68141aKATOH Yasufumi will not try to allocate a pseudo terminal. Instead it will simply attach

a9b21284fceafaf57b1bb58cf59f939dcf68141aKATOH Yasufumi to the containers namespaces and run a shell or the specified command.

a9b21284fceafaf57b1bb58cf59f939dcf68141aKATOH Yasufumi </para>

a9b21284fceafaf57b1bb58cf59f939dcf68141aKATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </refsect1>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <refsect1>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <title>Options</title>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <variablelist>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <varlistentry>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <term>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <option>-a, --arch <replaceable>arch</replaceable></option>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </term>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <listitem>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi Specify the architecture which the kernel should appear to be

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi running as to the command executed. This option will accept the

dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi same settings as the <option>lxc.arch</option> option in

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi container configuration files, see

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <citerefentry>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <refentrytitle><filename>lxc.conf</filename></refentrytitle>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <manvolnum>5</manvolnum>

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi </citerefentry>. By default, the current archictecture of the

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi running container will be used.

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi </para>

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi </listitem>

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi </varlistentry>

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi <varlistentry>

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi <term>

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi <option>

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi -e, --elevated-privileges <replaceable>privileges</replaceable>

99e616a6681f83ac1364d27eface9f0a7bb22527KATOH Yasufumi </option>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </term>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <listitem>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi Do not drop privileges when running

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <replaceable>command</replaceable> inside the container. If

f7f1ba77b76e4d4dc18638cfdc859c3dc1750a9eStéphane Graber this option is specified, the new process will

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <emphasis>not</emphasis> be added to the container's cgroup(s)

dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi and it will not drop its capabilities before executing.

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi You may specify privileges, in case you do not want to elevate all of

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi them, as a pipe-separated list, e.g.

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <replaceable>CGROUP|LSM</replaceable>. Allowed values are

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <replaceable>CGROUP</replaceable>, <replaceable>CAP</replaceable> and

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <replaceable>LSM</replaceable> representing cgroup, capabilities and

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi restriction privileges respectively. (The pipe symbol needs to be escaped,

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi e.g. <replaceable>CGROUP\|LSM</replaceable> or quoted, e.g.

f7f1ba77b76e4d4dc18638cfdc859c3dc1750a9eStéphane Graber <replaceable>"CGROUP|LSM"</replaceable>.)

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </para>

dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi <para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <emphasis>Warning:</emphasis> This may leak privileges into the

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi container if the command starts subprocesses that remain active

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi after the main process that was attached is terminated. The

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi (re-)starting of daemons inside the container is problematic,

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi especially if the daemon starts a lot of subprocesses such as

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <command>cron</command> or <command>sshd</command>.

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <emphasis>Use with great care.</emphasis>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </listitem>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </varlistentry>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi <varlistentry>

dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi <term>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <option>-s, --namespaces <replaceable>namespaces</replaceable></option>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </term>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <listitem>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi Specify the namespaces to attach to, as a pipe-separated list,

7c3d3950528671460bcd333af842a6158e4166b6KATOH Yasufumi e.g. <replaceable>NETWORK|IPC</replaceable>. Allowed values are

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <replaceable>MOUNT</replaceable>, <replaceable>PID</replaceable>,

7c3d3950528671460bcd333af842a6158e4166b6KATOH Yasufumi <replaceable>UTSNAME</replaceable>, <replaceable>IPC</replaceable>,

7c3d3950528671460bcd333af842a6158e4166b6KATOH Yasufumi <replaceable>USER </replaceable> and

7c3d3950528671460bcd333af842a6158e4166b6KATOH Yasufumi <replaceable>NETWORK</replaceable>. This allows one to change

7c3d3950528671460bcd333af842a6158e4166b6KATOH Yasufumi the context of the process to e.g. the network namespace of the

7c3d3950528671460bcd333af842a6158e4166b6KATOH Yasufumi container while retaining the other namespaces as those of the

7c3d3950528671460bcd333af842a6158e4166b6KATOH Yasufumi host. (The pipe symbol needs to be escaped, e.g.

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <replaceable>MOUNT\|PID</replaceable> or quoted, e.g.

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <replaceable>"MOUNT|PID"</replaceable>.)

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <emphasis>Important:</emphasis> This option implies

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <option>-e</option>.

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </listitem>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </varlistentry>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <varlistentry>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <term>

51fded061acaff647a9f616d1591cbd4c452877eSungbae Yoo <option>-R, --remount-sys-proc</option>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </term>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <listitem>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi When using <option>-s</option> and the mount namespace is not

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi included, this flag will cause <command>lxc-attach</command>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi to remount <replaceable>/proc</replaceable> and

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <replaceable>/sys</replaceable> to reflect the current other

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi namespace contexts.

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi Please see the <emphasis>Notes</emphasis> section for more

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi details.

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi This option will be ignored if one tries to attach to the

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi mount namespace anyway.

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </para>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </listitem>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi </varlistentry>

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi

a5ba96715d4ef264c43d4f187251de491ba198c0KATOH Yasufumi <varlistentry>

<term>

<option>--keep-env</option>

</term>

<listitem>

<para>

Keep the current environment for attached programs. This is

the current default behaviour (as of version 0.9), but is

is likely to change in the future, since this may leak

undesirable information into the container. If you rely on

the environment being available for the attached program,

please use this option to be future-proof. In addition to

current environment variables, container=lxc will be set.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>--clear-env</option>

</term>

<listitem>

<para>

Clear the environment before attaching, so no undesired

environment variables leak into the container. The variable

container=lxc will be the only environment with which the

attached program starts.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>-L, --pty-log <replaceable>file</replaceable></option>

</term>

<listitem>

<para>

Specify a file where the output of <command>lxc-attach</command> will be

logged.

</para>

<para>

<emphasis>Important:</emphasis> When a standard file descriptor

does not refer to a pty ouput produced on it will not be logged.

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect1>

&commonoptions;

<refsect1>

<title>Examples</title>

<para>

To spawn a new shell running inside an existing container, use

<programlisting>

lxc-attach -n container

</programlisting>

</para>

<para>

To restart the cron service of a running Debian container, use

<programlisting>

lxc-attach -n container -- /etc/init.d/cron restart

</programlisting>

</para>

<para>

To deactivate the network link eth1 of a running container that

does not have the NET_ADMIN capability, use either the

<option>-e</option> option to use increased capabilities,

assuming the <command>ip</command> tool is installed:

<programlisting>

lxc-attach -n container -e -- /sbin/ip link delete eth1

</programlisting>

Or, alternatively, use the <option>-s</option> to use the

tools installed on the host outside the container:

<programlisting>

lxc-attach -n container -s NETWORK -- /sbin/ip link delete eth1

</programlisting>

</para>

</refsect1>

<refsect1>

<title>Compatibility</title>

<para>

Attaching completely (including the pid and mount namespaces) to a

container requires a kernel of version 3.8 or higher, or a

patched kernel, please see the lxc website for

details. <command>lxc-attach</command> will fail in that case if

used with an unpatched kernel of version 3.7 and prior.

</para>

<para>

Nevertheless, it will succeed on an unpatched kernel of version 3.0

or higher if the <option>-s</option> option is used to restrict the

namespaces that the process is to be attached to to one or more of

<replaceable>NETWORK</replaceable>, <replaceable>IPC</replaceable>

and <replaceable>UTSNAME</replaceable>.

</para>

<para>

Attaching to user namespaces is supported by kernel 3.8 or higher

with enabling user namespace.

</para>

</refsect1>

<refsect1>

<title>Notes</title>

<para>

The Linux <replaceable>/proc</replaceable> and

<replaceable>/sys</replaceable> filesystems contain information

about some quantities that are affected by namespaces, such as

the directories named after process ids in

<replaceable>/proc</replaceable> or the network interface information

in <replaceable>/sys/class/net</replaceable>. The namespace of the

process mounting the pseudo-filesystems determines what information

is shown, <emphasis>not</emphasis> the namespace of the process

accessing <replaceable>/proc</replaceable> or

<replaceable>/sys</replaceable>.

</para>

<para>

If one uses the <option>-s</option> option to only attach to

the pid namespace of a container, but not its mount namespace

(which will contain the <replaceable>/proc</replaceable> of the

container and not the host), the contents of <option>/proc</option>

will reflect that of the host and not the container. Analogously,

the same issue occurs when reading the contents of

<replaceable>/sys/class/net</replaceable> and attaching to just

the network namespace.

</para>

<para>

To work around this problem, the <option>-R</option> flag provides

the option to remount <replaceable>/proc</replaceable> and

<replaceable>/sys</replaceable> in order for them to reflect the

network/pid namespace context of the attached process. In order

not to interfere with the host's actual filesystem, the mount

namespace will be unshared (like <command>lxc-unshare</command>

does) before this is done, essentially giving the process a new

mount namespace, which is identical to the hosts's mount namespace

except for the <replaceable>/proc</replaceable> and

<replaceable>/sys</replaceable> filesystems.

</para>

<para>

Previous versions of <command>lxc-attach</command> suffered a bug whereby

a user could attach to a containers namespace without being placed in a

writeable cgroup for some critical subsystems. Newer versions of

<command>lxc-attach</command> will check whether a user is in a writeable

cgroup for those critical subsystems. <command>lxc-attach</command> might

thus fail unexpectedly for some users (E.g. on systems where an

unprivileged user is not placed in a writeable cgroup in critical

subsystems on login.). However, this behavior is correct and more secure.

</para>

</refsect1>

<refsect1>

<title>Security</title>

<para>

The <option>-e</option> and <option>-s</option> options should

be used with care, as it may break the isolation of the containers

if used improperly.

</para>

</refsect1>

&seealso;

<refsect1>

<title>Author</title>

<para>Daniel Lezcano <email>daniel.lezcano@free.fr</email></para>

</refsect1>

</refentry>