Skip to content

Merge upstream branch 'main' #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DreamConnected merged 14 commits into from
Dec 18, 2025
Merged

Merge upstream branch 'main' #40

Changes from 1 commit
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
5d160e2
meson: add meson option for running doxygen in build
chackoj-1204 Nov 29, 2025
1090d85
added "--rbduser" option in "lxc-create -B rbd"
Rahik-Sikder Dec 9, 2025
9799eba
added doc for --rbduser
Rahik-Sikder Dec 11, 2025
46ae4ef
Merge pull request #4622 from Rahik-Sikder/lxc_create_rbd_user_option
stgraber Dec 12, 2025
f085a8c
Added documentation on unprivileged LXC containers
chackoj-1204 Dec 2, 2025
af691a1
build(deps): bump actions/upload-artifact from 5 to 6
dependabot[bot] Dec 15, 2025
16891f1
Merge pull request #4625 from lxc/dependabot/github_actions/actions/u…
stgraber Dec 15, 2025
5cd13aa
Merge pull request #4615 from chackoj-1204/meson-build-enable-api-docs
stgraber Dec 15, 2025
e6ad17a
start: Remove outdated comment about group dropping
Filiprogrammer Dec 15, 2025
9e6caea
start: Respect lxc.init.groups also in new user namespace
Filiprogrammer Dec 15, 2025
49c34b1
copy_rdepends: Don't fail on missing source file
Dec 14, 2025
e59aea2
Merge pull request #4624 from James-Featherston/issue-4514
stgraber Dec 16, 2025
27e8823
Merge pull request #4626 from Filiprogrammer/fix-init-groups-in-userns
stgraber Dec 16, 2025
1311e1b
Merge pull request #4616 from chackoj-1204/doc/unprivileged-container…
stgraber Dec 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
start: Respect lxc.init.groups also in new user namespace 
Fix supplementary groups defined in 'lxc.init.groups' being ignored when
the container uses a new user namespace.

In other words: Fix lxc.init.groups for unprivileged containers.

Signed-off-by: Filip Schauer <[email protected]>
  • Loading branch information
@Filiprogrammer
Filiprogrammer committed Dec 15, 2025
commit 9e6caeabec77471c46a629ad5a5a6586ff31e9ce
12 changes: 7 additions & 5 deletions src/lxc/start.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1603,17 +1603,19 @@ static int do_start(void *data)
if (lxc_proc_cap_is_set(CAP_SETGID, CAP_EFFECTIVE))
#endif
{
if (handler->conf->init_groups.size > 0) {
if (!lxc_setgroups(handler->conf->init_groups.list,
handler->conf->init_groups.size))
goto out_warn_father;
} else {
if (handler->conf->init_groups.size == 0) {
if (!lxc_drop_groups())
goto out_warn_father;
}
}
}

if (handler->conf->init_groups.size > 0) {
if (!lxc_setgroups(handler->conf->init_groups.list,
handler->conf->init_groups.size))
goto out_warn_father;
}

if (!lxc_switch_uid_gid(new_uid, new_gid))
goto out_warn_father;

Expand Down