src/lxc/lxccontainer.c

	lxccontainer.c revision 12a50cc6ab5c8a4aa0bcb7ddcd7095265f7bb62b
409N/A/* liblxcapi
290N/A *
290N/A * Copyright © 2012 Serge Hallyn <serge.hallyn@ubuntu.com>.
290N/A * Copyright © 2012 Canonical Ltd.
290N/A *
290N/A * This program is free software; you can redistribute it and/or modify
290N/A * it under the terms of the GNU General Public License version 2, as
290N/A * published by the Free Software Foundation.
290N/A *
290N/A * This program is distributed in the hope that it will be useful,
290N/A * but WITHOUT ANY WARRANTY; without even the implied warranty of
290N/A * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
290N/A * GNU General Public License for more details.
290N/A *
290N/A * You should have received a copy of the GNU General Public License along
290N/A * with this program; if not, write to the Free Software Foundation, Inc.,
290N/A * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
290N/A */
290N/A
290N/A#include "lxc.h"
290N/A#include "state.h"
395N/A#include "lxccontainer.h"
395N/A#include "conf.h"
395N/A#include "config.h"
290N/A#include "confile.h"
454N/A#include "cgroup.h"
290N/A#include "commands.h"
448N/A#include "log.h"
290N/A#include <unistd.h>
290N/A#include <sys/types.h>
290N/A#include <sys/wait.h>
383N/A#include <errno.h>
290N/A
395N/Alxc_log_define(lxc_container, lxc);
290N/A
395N/A/* LOCKING
290N/A * c->privlock protects the struct lxc_container from multiple threads.
290N/A * c->slock protects the on-disk container data
290N/A * NOTHING mutexes two independent programs with their own struct
290N/A * lxc_container for the same c->name, between API calls.  For instance,
290N/A * c->config_read(); c->start();  Between those calls, data on disk
383N/A * could change (which shouldn't bother the caller unless for instance
290N/A * the rootfs get moved).  c->config_read(); update; c->config_write();
290N/A * Two such updaters could race.  The callers should therefore check their
290N/A * results.  Trying to prevent that would necessarily expose us to deadlocks
290N/A * due to hung callers.  So I prefer to keep the locks only within our own
290N/A * functions, not across functions.
290N/A *
290N/A * If you're going to fork while holding a lxccontainer, increment
290N/A * c->numthreads (under privlock) before forking.  When deleting,
465N/A * decrement numthreads under privlock, then if it hits 0 you can delete.
465N/A * Do not ever use a lxccontainer whose numthreads you did not bump.
465N/A */
465N/A
465N/Astatic void lxc_container_free(struct lxc_container *c)
465N/A{
465N/A    if (!c)
465N/A        return;
465N/A
465N/A    if (c->configfile) {
465N/A        free(c->configfile);
465N/A        c->configfile = NULL;
465N/A    }
465N/A    if (c->error_string) {
465N/A        free(c->error_string);
290N/A        c->error_string = NULL;
290N/A    }
290N/A    if (c->slock) {
395N/A        sem_close(c->slock);
395N/A        c->slock = NULL;
290N/A    }
395N/A    if (c->privlock) {
395N/A        sem_destroy(c->privlock);
290N/A        free(c->privlock);
395N/A        c->privlock = NULL;
395N/A    }
290N/A    if (c->name) {
395N/A        free(c->name);
395N/A        c->name = NULL;
290N/A    }
448N/A    if (c->lxc_conf) {
448N/A        lxc_conf_free(c->lxc_conf);
534N/A        c->lxc_conf = NULL;
534N/A    }
534N/A    free(c);
534N/A}
534N/A
534N/Aint lxc_container_get(struct lxc_container *c)
534N/A{
290N/A    if (!c)
290N/A        return 0;
290N/A
534N/A    if (lxclock(c->privlock, 0))
290N/A        return 0;
290N/A    if (c->numthreads < 1) {
290N/A        // bail without trying to unlock, bc the privlock is now probably
290N/A        // in freed memory
290N/A        return 0;
661N/A    }
290N/A    c->numthreads++;
290N/A    lxcunlock(c->privlock);
290N/A    return 1;
395N/A}
290N/A
290N/Aint lxc_container_put(struct lxc_container *c)
290N/A{
290N/A    if (!c)
290N/A        return -1;
395N/A    if (lxclock(c->privlock, 0))
430N/A        return -1;
395N/A    if (--c->numthreads < 1) {
395N/A        lxcunlock(c->privlock);
395N/A        lxc_container_free(c);
424N/A        return 1;
578N/A    }
395N/A    lxcunlock(c->privlock);
395N/A    return 0;
395N/A}
578N/A
395N/Astatic bool file_exists(char *f)
661N/A{
661N/A    struct stat statbuf;
661N/A
395N/A    return stat(f, &statbuf) == 0;
290N/A}
290N/A
395N/Astatic bool lxcapi_is_defined(struct lxc_container *c)
395N/A{
395N/A    struct stat statbuf;
395N/A    bool ret = false;
395N/A    int statret;
395N/A
395N/A    if (!c)
395N/A        return false;
395N/A
395N/A    if (lxclock(c->privlock, 0))
395N/A        return false;
395N/A    if (!c->configfile)
395N/A        goto out;
290N/A    statret = stat(c->configfile, &statbuf);
290N/A    if (statret != 0)
395N/A        goto out;
395N/A    ret = true;
395N/A
395N/Aout:
395N/A    lxcunlock(c->privlock);
395N/A    return ret;
395N/A}
395N/A
395N/Astatic const char *lxcapi_state(struct lxc_container *c)
395N/A{
395N/A    const char *ret;
395N/A    lxc_state_t s;
395N/A
290N/A    if (!c)
290N/A        return NULL;
430N/A    if (lxclock(c->slock, 0))
395N/A        return NULL;
395N/A    s = lxc_getstate(c->name);
395N/A    ret = lxc_state2str(s);
395N/A    lxcunlock(c->slock);
395N/A
395N/A    return ret;
290N/A}
395N/A
413N/Astatic bool lxcapi_is_running(struct lxc_container *c)
413N/A{
413N/A    const char *s;
395N/A
395N/A    if (!c)
413N/A        return false;
395N/A    s = lxcapi_state(c);
395N/A    if (!s || strcmp(s, "STOPPED") == 0)
413N/A        return false;
395N/A    return true;
395N/A}
395N/A
395N/Astatic bool lxcapi_freeze(struct lxc_container *c)
395N/A{
395N/A    int ret;
395N/A    if (!c)
395N/A        return false;
424N/A
395N/A    if (lxclock(c->slock, 0))
395N/A        return false;
395N/A    ret = lxc_freeze(c->name);
395N/A    lxcunlock(c->slock);
395N/A    if (ret)
451N/A        return false;
395N/A    return true;
395N/A}
395N/A
395N/Astatic bool lxcapi_unfreeze(struct lxc_container *c)
395N/A{
395N/A    int ret;
395N/A    if (!c)
395N/A        return false;
395N/A
395N/A    if (lxclock(c->slock, 0))
395N/A        return false;
395N/A    ret = lxc_unfreeze(c->name);
578N/A    lxcunlock(c->slock);
395N/A    if (ret)
691N/A        return false;
691N/A    return true;
691N/A}
395N/A
395N/Astatic pid_t lxcapi_init_pid(struct lxc_container *c)
395N/A{
395N/A    pid_t ret;
395N/A    if (!c)
290N/A        return -1;
395N/A
395N/A    if (lxclock(c->slock, 0))
591N/A        return -1;
591N/A    ret = get_init_pid(c->name);
591N/A    lxcunlock(c->slock);
395N/A    return ret;
395N/A}
290N/A
290N/Astatic bool load_config_locked(struct lxc_container *c, const char *fname)
290N/A{
290N/A    if (!c->lxc_conf)
290N/A        c->lxc_conf = lxc_conf_init();
290N/A    if (c->lxc_conf && !lxc_config_read(fname, c->lxc_conf))
290N/A        return true;
290N/A    return false;
290N/A}
290N/A
290N/Astatic bool lxcapi_load_config(struct lxc_container *c, const char *alt_file)
290N/A{
290N/A    bool ret = false;
290N/A    const char *fname;
395N/A    if (!c)
395N/A        return false;
290N/A
290N/A    fname = c->configfile;
290N/A    if (alt_file)
290N/A        fname = alt_file;
290N/A    if (!fname)
395N/A        return false;
395N/A    if (lxclock(c->slock, 0))
395N/A        return false;
290N/A    ret = load_config_locked(c, fname);
395N/A    lxcunlock(c->slock);
395N/A    return ret;
395N/A}
395N/A
591N/Astatic void lxcapi_want_daemonize(struct lxc_container *c)
591N/A{
591N/A    if (!c)
591N/A        return;
691N/A    c->daemonize = 1;
691N/A}
691N/A
691N/Astatic bool lxcapi_wait(struct lxc_container *c, const char *state, int timeout)
290N/A{
290N/A    int ret;
290N/A
290N/A    if (!c)
290N/A        return false;
591N/A
591N/A    ret = lxc_wait(c->name, state, timeout);
691N/A    return ret == 0;
691N/A}
290N/A
395N/A
395N/Astatic bool wait_on_daemonized_start(struct lxc_container *c)
290N/A{
395N/A    /* we'll probably want to make this timeout configurable? */
395N/A    int timeout = 5, ret, status;
395N/A
395N/A    /*
290N/A     * our child is going to fork again, then exit.  reap the
290N/A     * child
290N/A     */
395N/A    ret = wait(&status);
395N/A    if (ret == -1 || !WIFEXITED(status) || WEXITSTATUS(status) != 0)
395N/A        DEBUG("failed waiting for first dual-fork child");
395N/A    return lxcapi_wait(c, "RUNNING", timeout);
395N/A}
395N/A
290N/A/*
290N/A * I can't decide if it'd be more convenient for callers if we accept '...',
290N/A * or a null-terminated array (i.e. execl vs execv)
290N/A */
290N/Astatic bool lxcapi_start(struct lxc_container *c, int useinit, char * const argv[])
430N/A{
290N/A    int ret;
290N/A    struct lxc_conf *conf;
395N/A    int daemonize = 0;
290N/A    char *default_args[] = {
395N/A        "/sbin/init",
506N/A        '\0',
506N/A    };
506N/A
506N/A    /* container exists */
506N/A    if (!c)
506N/A        return false;
395N/A    /* container has been setup */
506N/A    if (!c->lxc_conf)
506N/A        return false;
513N/A
506N/A    /* is this app meant to be run through lxcinit, as in lxc-execute? */
506N/A    if (useinit && !argv)
506N/A        return false;
513N/A
506N/A    if (lxclock(c->privlock, 0))
506N/A        return false;
506N/A    conf = c->lxc_conf;
506N/A    daemonize = c->daemonize;
290N/A    lxcunlock(c->privlock);
290N/A
395N/A    if (useinit) {
395N/A        ret = lxc_execute(c->name, argv, 1, conf);
395N/A        return ret == 0 ? true : false;
395N/A    }
395N/A
395N/A    if (!argv)
413N/A        argv = default_args;
413N/A
413N/A    /*
395N/A    * say, I'm not sure - what locks do we want here?  Any?
290N/A    * Is liblxc's locking enough here to protect the on disk
395N/A    * container?  We don't want to exclude things like lxc_info
395N/A    * while container is running...
506N/A    */
506N/A    if (daemonize) {
395N/A        if (!lxc_container_get(c))
395N/A            return false;
395N/A        pid_t pid = fork();
395N/A        if (pid < 0) {
430N/A            lxc_container_put(c);
395N/A            return false;
290N/A        }
465N/A        if (pid != 0)
465N/A            return wait_on_daemonized_start(c);
290N/A        /* second fork to be reparented by init */
465N/A        pid = fork();
465N/A        if (pid < 0) {
465N/A            SYSERROR("Error doing dual-fork");
395N/A            return false;
465N/A        }
395N/A        if (pid != 0)
395N/A            exit(0);
465N/A        /* like daemon(), chdir to / and redirect 0,1,2 to /dev/null */
465N/A        if (chdir("/")) {
465N/A            SYSERROR("Error chdir()ing to /.");
395N/A            return false;
465N/A        }
395N/A        close(0);
465N/A        close(1);
395N/A        close(2);
465N/A        open("/dev/null", O_RDONLY);
465N/A        open("/dev/null", O_RDWR);
465N/A        open("/dev/null", O_RDWR);
395N/A        setsid();
395N/A    }
395N/A
395N/A    if (putenv("container=lxc")) {
465N/A        fprintf(stderr, "failed to set environment variable");
465N/A        if (daemonize) {
465N/A            lxc_container_put(c);
395N/A            exit(1);
498N/A        } else {
498N/A            return false;
498N/A        }
498N/A    }
290N/A
465N/Areboot:
465N/A    conf->reboot = 0;
465N/A    ret = lxc_start(c->name, argv, conf);
454N/A
465N/A    if (conf->reboot) {
454N/A        INFO("container requested reboot");
454N/A        conf->reboot = 0;
454N/A        if (conf->maincmd_fd)
454N/A            close(conf->maincmd_fd);
465N/A        conf->maincmd_fd = 0;
290N/A        goto reboot;
430N/A    }
395N/A
395N/A    if (daemonize) {
290N/A        lxc_container_put(c);
383N/A        exit (ret == 0 ? true : false);
383N/A    } else {
395N/A        return (ret == 0 ? true : false);
383N/A    }
383N/A}
384N/A
383N/A/*
383N/A * note there MUST be an ending NULL
383N/A */
383N/Astatic bool lxcapi_startl(struct lxc_container *c, int useinit, ...)
383N/A{
383N/A    va_list ap;
422N/A    char **inargs = NULL, **temp;
422N/A    int n_inargs = 0;
422N/A    bool bret = false;
422N/A
422N/A    /* container exists */
422N/A    if (!c)
422N/A        return false;
422N/A
422N/A    /* build array of arguments if any */
422N/A    va_start(ap, useinit);
422N/A    while (1) {
422N/A        char *arg;
422N/A        arg = va_arg(ap, char *);
422N/A        if (!arg)
422N/A            break;
422N/A        n_inargs++;
422N/A        temp = realloc(inargs, n_inargs * sizeof(*inargs));
383N/A        if (!temp)
422N/A            goto out;
383N/A        inargs = temp;
383N/A        inargs[n_inargs - 1] = strdup(arg);  // not sure if it's safe not to copy
383N/A    }
383N/A    va_end(ap);
383N/A
383N/A    /* add trailing NULL */
383N/A    if (n_inargs) {
422N/A        n_inargs++;
383N/A        temp = realloc(inargs, n_inargs * sizeof(*inargs));
383N/A        if (!temp)
290N/A            goto out;
430N/A        inargs = temp;
395N/A        inargs[n_inargs - 1] = NULL;
395N/A    }
290N/A
290N/A    bret = lxcapi_start(c, useinit, inargs);
290N/A
290N/Aout:
290N/A    if (inargs) {
290N/A        int i;
290N/A        for (i = 0; i < n_inargs; i++) {
290N/A            if (inargs[i])
290N/A                free(inargs[i]);
290N/A        }
290N/A        free(inargs);
395N/A    }
290N/A
395N/A    return bret;
290N/A}
395N/A
290N/Astatic bool lxcapi_stop(struct lxc_container *c)
534N/A{
534N/A    int ret;
465N/A
465N/A    if (!c)
290N/A        return false;
290N/A
448N/A    ret = lxc_stop(c->name);
430N/A
448N/A    return ret == 0;
448N/A}
448N/A
448N/Astatic bool valid_template(char *t)
290N/A{
290N/A    struct stat statbuf;
290N/A    int statret;
448N/A
448N/A    statret = stat(t, &statbuf);
430N/A    if (statret == 0)
448N/A        return true;
430N/A    return false;
290N/A}
290N/A
290N/A/*
290N/A * create the standard expected container dir
290N/A */
290N/Astatic bool create_container_dir(struct lxc_container *c)
448N/A{
448N/A    char *s;
448N/A    int len, ret;
448N/A
448N/A    len = strlen(LXCPATH) + strlen(c->name) + 2;
430N/A    s = malloc(len);
448N/A    if (!s)
290N/A        return false;
290N/A    ret = snprintf(s, len, "%s/%s", LXCPATH, c->name);
290N/A    if (ret < 0 || ret >= len) {
430N/A        free(s);
395N/A        return false;
290N/A    }
290N/A    ret = mkdir(s, 0755);
290N/A    if (ret) {
290N/A        if (errno == EEXIST)
290N/A            ret = 0;
613N/A        else
613N/A            SYSERROR("failed to create container path for %s\n", c->name);
613N/A    }
613N/A    free(s);
613N/A    return ret == 0;
613N/A}
613N/A
613N/A/*
613N/A * backing stores not (yet) supported
290N/A * for ->create, argv contains the arguments to pass to the template,
430N/A * terminated by NULL.  If no arguments, you can just pass NULL.
395N/A */
395N/Astatic bool lxcapi_create(struct lxc_container *c, char *t, char *const argv[])
395N/A{
395N/A    bool bret = false;
395N/A    pid_t pid;
395N/A    int ret, status;
395N/A    char *tpath = NULL;
395N/A    int len, nargs = 0;
395N/A    char **newargv;
395N/A
290N/A    if (!c)
383N/A        return false;
395N/A
395N/A    len = strlen(LXCTEMPLATEDIR) + strlen(t) + strlen("/lxc-") + 1;
395N/A    tpath = malloc(len);
395N/A    if (!tpath)
395N/A        return false;
290N/A    ret = snprintf(tpath, len, "%s/lxc-%s", LXCTEMPLATEDIR, t);
290N/A    if (ret < 0 || ret >= len)
395N/A        goto out;
395N/A    if (!valid_template(tpath)) {
395N/A        ERROR("bad template: %s\n", t);
395N/A        goto out;
395N/A    }
395N/A
290N/A    if (!create_container_dir(c))
290N/A        goto out;
395N/A
395N/A    if (!c->save_config(c, NULL)) {
395N/A        ERROR("failed to save starting configuration for %s\n", c->name);
613N/A        goto out;
290N/A    }
395N/A
395N/A    /* we're going to fork.  but since we'll wait for our child, we
395N/A       don't need to lxc_container_get */
395N/A
395N/A    if (lxclock(c->slock, 0)) {
395N/A        ERROR("failed to grab global container lock for %s\n", c->name);
395N/A        goto out;
395N/A    }
290N/A
395N/A    pid = fork();
395N/A    if (pid < 0) {
395N/A        SYSERROR("failed to fork task for container creation template\n");
395N/A        goto out_unlock;
395N/A    }
395N/A
430N/A    if (pid == 0) { // child
395N/A        char *patharg, *namearg;
395N/A        int i;
395N/A
395N/A        close(0);
395N/A        close(1);
395N/A        close(2);
691N/A        open("/dev/null", O_RDONLY);
691N/A        open("/dev/null", O_RDWR);
691N/A        open("/dev/null", O_RDWR);
691N/A
691N/A        /*
691N/A         * create our new array, pre-pend the template name and
691N/A         * base args
691N/A         */
395N/A        if (argv)
395N/A            for (; argv[nargs]; nargs++) ;
395N/A        nargs += 3;  // template, path and name args
395N/A        newargv = malloc(nargs * sizeof(*newargv));
395N/A        if (!newargv)
395N/A            exit(1);
395N/A        newargv[0] = t;
395N/A
395N/A        len = strlen(LXCPATH) + strlen(c->name) + strlen("--path=") + 2;
395N/A        patharg = malloc(len);
395N/A        if (!patharg)
395N/A            exit(1);
395N/A        ret = snprintf(patharg, len, "--path=%s/%s", LXCPATH, c->name);
        if (ret < 0 || ret >= len)
            exit(1);
        newargv[1] = patharg;
        len = strlen("--name=") + strlen(c->name) + 1;
        namearg = malloc(len);
        if (!namearg)
            exit(1);
        ret = snprintf(namearg, len, "--name=%s", c->name);
        if (ret < 0 || ret >= len)
            exit(1);
        newargv[2] = namearg;

        /* add passed-in args */
        if (argv)
            for (i = 3; i < nargs; i++)
                newargv[i] = argv[i-3];

        /* add trailing NULL */
        nargs++;
        newargv = realloc(newargv, nargs * sizeof(*newargv));
        if (!newargv)
            exit(1);
        newargv[nargs - 1] = NULL;

        /* execute */
        ret = execv(tpath, newargv);
        SYSERROR("failed to execute template %s", tpath);
        exit(1);
    }

again:
    ret = waitpid(pid, &status, 0);
    if (ret == -1) {
        if (errno == -EINTR)
            goto again;
        SYSERROR("waitpid failed");
        goto out_unlock;
    }
    if (ret != pid)
        goto again;
    if (!WIFEXITED(status))  { // did not exit normally
        // we could set an error code and string inside the
        // container_struct here if we like
        ERROR("container creation template exited abnormally\n");
        goto out_unlock;
    }

    if (WEXITSTATUS(status) != 0) {
        ERROR("container creation template for %s exited with %d\n",
              c->name, WEXITSTATUS(status));
        goto out_unlock;
    }

    // now clear out the lxc_conf we have, reload from the created
    // container
    if (c->lxc_conf)
        lxc_conf_free(c->lxc_conf);
    c->lxc_conf = NULL;
    bret = load_config_locked(c, c->configfile);

out_unlock:
    lxcunlock(c->slock);
out:
    if (tpath)
        free(tpath);
    return bret;
}

static bool lxcapi_shutdown(struct lxc_container *c, int timeout)
{
    bool retv;
    pid_t pid;

    if (!c)
        return false;

    if (!timeout)
        timeout = -1;
    if (!c->is_running(c))
        return true;
    pid = c->init_pid(c);
    if (pid <= 0)
        return true;
    kill(pid, SIGPWR);
    retv = c->wait(c, "STOPPED", timeout);
    if (!retv && timeout > 0) {
        c->stop(c);
        retv = c->wait(c, "STOPPED", 0); // 0 means don't wait
    }
    return retv;
}

static bool lxcapi_createl(struct lxc_container *c, char *t, ...)
{
    bool bret = false;
    char **args = NULL, **temp;
    va_list ap;
    int nargs = 0;

    if (!c)
        return false;

    /*
     * since we're going to wait for create to finish, I don't think we
     * need to get a copy of the arguments.
     */
    va_start(ap, t);
    while (1) {
        char *arg;
        arg = va_arg(ap, char *);
        if (!arg)
            break;
        nargs++;
        temp = realloc(args, (nargs+1) * sizeof(*args));
        if (!temp)
            goto out;
        args = temp;
        args[nargs - 1] = arg;
    }
    va_end(ap);
    args[nargs] = NULL;

    bret = c->create(c, t, args);

out:
    if (args)
        free(args);
    return bret;
}

static bool lxcapi_clear_config_item(struct lxc_container *c, const char *key)
{
    int ret;

    if (!c || !c->lxc_conf)
        return false;
    if (lxclock(c->privlock, 0)) {
        return false;
    }
    ret = lxc_clear_config_item(c->lxc_conf, key);
    lxcunlock(c->privlock);
    return ret == 0;
}

static int lxcapi_get_config_item(struct lxc_container *c, const char *key, char *retv, int inlen)
{
    int ret;

    if (!c || !c->lxc_conf)
        return -1;
    if (lxclock(c->privlock, 0)) {
        return -1;
    }
    ret = lxc_get_config_item(c->lxc_conf, key, retv, inlen);
    lxcunlock(c->privlock);
    return ret;
}

static int lxcapi_get_keys(struct lxc_container *c, const char *key, char *retv, int inlen)
{
    if (!key)
        return lxc_listconfigs(retv, inlen);
    /*
     * Support 'lxc.network.<idx>', i.e. 'lxc.network.0'
     * This is an intelligent result to show which keys are valid given
     * the type of nic it is
     */
    if (!c || !c->lxc_conf)
        return -1;
    if (lxclock(c->privlock, 0))
        return -1;
    int ret = -1;
    if (strncmp(key, "lxc.network.", 12) == 0)
        ret =  lxc_list_nicconfigs(c->lxc_conf, key, retv, inlen);
    lxcunlock(c->privlock);
    return ret;
}


/* default config file - should probably come through autoconf */
#define LXC_DEFAULT_CONFIG "/etc/lxc/lxc.conf"
static bool lxcapi_save_config(struct lxc_container *c, const char *alt_file)
{
    if (!alt_file)
        alt_file = c->configfile;
    if (!alt_file)
        return false;  // should we write to stdout if no file is specified?
    if (!c->lxc_conf)
        if (!c->load_config(c, LXC_DEFAULT_CONFIG)) {
            ERROR("Error loading default configuration file %s while saving %s\n", LXC_DEFAULT_CONFIG, c->name);
            return false;
        }

    FILE *fout = fopen(alt_file, "w");
    if (!fout)
        return false;
    if (lxclock(c->privlock, 0)) {
        fclose(fout);
        return false;
    }
    write_config(fout, c->lxc_conf);
    fclose(fout);
    lxcunlock(c->privlock);
    return true;
}

static bool lxcapi_destroy(struct lxc_container *c)
{
    pid_t pid;
    int ret, status;

    if (!c)
        return false;

    pid = fork();
    if (pid < 0)
        return false;
    if (pid == 0) { // child
        ret = execlp("lxc-destroy", "lxc-destroy", "-n", c->name, NULL);
        perror("execl");
        exit(1);
    }

again:
    ret = waitpid(pid, &status, 0);
    if (ret == -1) {
        if (errno == -EINTR)
            goto again;
        perror("waitpid");
        return false;
    }
    if (ret != pid)
        goto again;
    if (!WIFEXITED(status))  { // did not exit normally
        // we could set an error code and string inside the
        // container_struct here if we like
        return false;
    }

    return WEXITSTATUS(status) == 0;
}

static bool lxcapi_set_config_item(struct lxc_container *c, const char *key, const char *v)
{
    int ret;
    bool b = false;
    struct lxc_config_t *config;

    if (!c)
        return false;

    if (lxclock(c->privlock, 0))
        return false;

    if (!c->lxc_conf)
        c->lxc_conf = lxc_conf_init();
    if (!c->lxc_conf)
        goto err;
    config = lxc_getconfig(key);
    if (!config)
        goto err;
    ret = config->cb(key, v, c->lxc_conf);
    if (!ret)
        b = true;

err:
    lxcunlock(c->privlock);
    return b;
}

static char *lxcapi_config_file_name(struct lxc_container *c)
{
    if (!c || !c->configfile)
        return NULL;
    return strdup(c->configfile);
}

struct lxc_container *lxc_container_new(const char *name)
{
    struct lxc_container *c;
    int ret, len;

    c = malloc(sizeof(*c));
    if (!c) {
        fprintf(stderr, "failed to malloc lxc_container\n");
        return NULL;
    }
    memset(c, 0, sizeof(*c));

    c->name = malloc(strlen(name)+1);
    if (!c->name) {
        fprintf(stderr, "Error allocating lxc_container name\n");
        goto err;
    }
    strcpy(c->name, name);

    c->numthreads = 1;
    c->slock = lxc_newlock(name);
    if (!c->slock) {
        fprintf(stderr, "failed to create lock\n");
        goto err;
    }

    c->privlock = lxc_newlock(NULL);
    if (!c->privlock) {
        fprintf(stderr, "failed to alloc privlock\n");
        goto err;
    }

    len = strlen(LXCPATH)+strlen(c->name)+strlen("/config")+2;
    c->configfile = malloc(len);
    if (!c->configfile) {
        fprintf(stderr, "Error allocating config file pathname\n");
        goto err;
    }
    ret = snprintf(c->configfile, len, "%s/%s/config", LXCPATH, c->name);
    if (ret < 0 || ret >= len) {
        fprintf(stderr, "Error printing out config file name\n");
        goto err;
    }

    if (file_exists(c->configfile))
        lxcapi_load_config(c, NULL);

    // assign the member functions
    c->is_defined = lxcapi_is_defined;
    c->state = lxcapi_state;
    c->is_running = lxcapi_is_running;
    c->freeze = lxcapi_freeze;
    c->unfreeze = lxcapi_unfreeze;
    c->init_pid = lxcapi_init_pid;
    c->load_config = lxcapi_load_config;
    c->want_daemonize = lxcapi_want_daemonize;
    c->start = lxcapi_start;
    c->startl = lxcapi_startl;
    c->stop = lxcapi_stop;
    c->config_file_name = lxcapi_config_file_name;
    c->wait = lxcapi_wait;
    c->set_config_item = lxcapi_set_config_item;
    c->destroy = lxcapi_destroy;
    c->save_config = lxcapi_save_config;
    c->get_keys = lxcapi_get_keys;
    c->create = lxcapi_create;
    c->createl = lxcapi_createl;
    c->shutdown = lxcapi_shutdown;
    c->clear_config_item = lxcapi_clear_config_item;
    c->get_config_item = lxcapi_get_config_item;

    /* we'll allow the caller to update these later */
    if (lxc_log_init("/var/log/lxccontainer.log", "trace", "lxc_container", 0)) {
        fprintf(stderr, "failed to open log\n");
        goto err;
    }

    /*
     * default configuration file is $LXCPATH/$NAME/config
     */

    return c;

err:
    lxc_container_free(c);
    return NULL;
}

int lxc_get_wait_states(const char **states)
{
    int i;

    if (states)
        for (i=0; i<MAX_STATE; i++)
            states[i] = lxc_state2str(i);
    return MAX_STATE;
}