From: Marc MERLIN <marc@merlins.org>
To: Tobias Hunger <tobias.hunger@gmail.com>
Cc: linux-btrfs@vger.kernel.org
Subject: Re: btrfs and containers
Date: Wed, 9 Mar 2016 13:10:04 -0800 [thread overview]
Message-ID: <20160309211004.GK27437@merlins.org> (raw)
In-Reply-To: <CAMdWP3G9uaTcbDWE68LYd17sf8-j11Aqo+ACRrZFFGdB995gSQ@mail.gmail.com>
On Mon, Mar 07, 2016 at 11:55:47PM +0100, Tobias Hunger wrote:
> Hi,
>
> I have been running systemd-nspawn containers on top of a btrfs
> filesystem for a while now.
>
> This works great: Snapshots are a huge help to manage containers!
>
> But today I ran btrfs subvol list . *inside* a container. To my
> surprise I got a list of *all* subvolumes on that drive. That is
> basically a complete list of containers running on the machine. I do
> not want to have that kind of information exposed to my containers.
I have a very stripped down docker image that actually mounts portion of
of my root filesystem read only.
While it's running out of a btrfs filesystem, you can't run btrfs
commands against it:
05233e5c91f0:/# btrfs fi show
05233e5c91f0:/# btrfs subvol list /
ERROR: can't perform the search - Operation not permitted
05233e5c91f0:/# btrfs subvol list .
ERROR: can't perform the search - Operation not permitted
I didn't do anything special, it's just working that way.
Marc
--
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems ....
.... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/ | PGP 1024R/763BE901
next prev parent reply other threads:[~2016-03-09 21:10 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-07 22:55 btrfs and containers Tobias Hunger
2016-03-07 23:45 ` Chris Murphy
2016-03-08 19:58 ` Liu Bo
2016-03-08 21:28 ` Chris Murphy
2016-03-09 12:15 ` Austin S. Hemmelgarn
2016-03-10 2:55 ` Duncan
2016-03-10 17:04 ` Austin S. Hemmelgarn
2016-03-10 19:35 ` Chris Murphy
2016-03-10 22:34 ` Liu Bo
2016-03-11 2:50 ` Duncan
2016-03-08 12:12 ` Austin S. Hemmelgarn
2016-03-09 21:10 ` Marc MERLIN [this message]
2016-03-09 21:21 ` Chris Murphy
2016-03-09 21:45 ` Marc MERLIN
2016-03-09 23:28 ` Rich Freeman
-- strict thread matches above, loose matches on Subject: below --
2016-03-11 3:55 Tomasz Chmielewski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160309211004.GK27437@merlins.org \
--to=marc@merlins.org \
--cc=linux-btrfs@vger.kernel.org \
--cc=tobias.hunger@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.