{"action":"created","issue":{"url":"https://api.github.com/repos/lxc/lxc/issues/827","repository_url":"https://api.github.com/repos/lxc/lxc","labels_url":"https://api.github.com/repos/lxc/lxc/issues/827/labels{/name}","comments_url":"https://api.github.com/repos/lxc/lxc/issues/827/comments","events_url":"https://api.github.com/repos/lxc/lxc/issues/827/events","html_url":"https://github.com/lxc/lxc/issues/827","id":134923009,"number":827,"title":"Fix LXC nested inside privileged LXD (devices.allow problem)","user":{"login":"stgraber","id":2230599,"avatar_url":"https://avatars.githubusercontent.com/u/2230599?v=3","gravatar_id":"","url":"https://api.github.com/users/stgraber","html_url":"https://github.com/stgraber","followers_url":"https://api.github.com/users/stgraber/followers","following_url":"https://api.github.com/users/stgraber/following{/other_user}","gists_url":"https://api.github.com/users/stgraber/gists{/gist_id}","starred_url":"https://api.github.com/users/stgraber/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stgraber/subscriptions","organizations_url":"https://api.github.com/users/stgraber/orgs","repos_url":"https://api.github.com/users/stgraber/repos","events_url":"https://api.github.com/users/stgraber/events{/privacy}","received_events_url":"https://api.github.com/users/stgraber/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/lxc/lxc/labels/Bug","name":"Bug","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-02-19T17:25:21Z","updated_at":"2016-02-19T21:45:06Z","closed_at":null,"body":"LXC should warn (WARN) but not fail (ERROR) when asked to give the containers more devices access than it itself have.\r\n\r\nLXD by default has a cgroup policy much stricter than LXC's default one. As a result, nesting LXC containers inside a privileged LXD containers fails.\r\n\r\nUnprivileged LXD containers don't suffer from that problem as the devices cgroup policy isn't applied to unprivileged containers.\r\n\r\nNor does LXD in LXD as the policies then match.\r\n\r\nThere is no security risk in moving forward in such a case, the only potential problem is that the user won't be able to interact with the device they requested, but a WARN should be enough for them to realize that without breaking most users."},"comment":{"url":"https://api.github.com/repos/lxc/lxc/issues/comments/186421705","html_url":"https://github.com/lxc/lxc/issues/827#issuecomment-186421705","issue_url":"https://api.github.com/repos/lxc/lxc/issues/827","id":186421705,"user":{"login":"hallyn","id":1359441,"avatar_url":"https://avatars.githubusercontent.com/u/1359441?v=3","gravatar_id":"","url":"https://api.github.com/users/hallyn","html_url":"https://github.com/hallyn","followers_url":"https://api.github.com/users/hallyn/followers","following_url":"https://api.github.com/users/hallyn/following{/other_user}","gists_url":"https://api.github.com/users/hallyn/gists{/gist_id}","starred_url":"https://api.github.com/users/hallyn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hallyn/subscriptions","organizations_url":"https://api.github.com/users/hallyn/orgs","repos_url":"https://api.github.com/users/hallyn/repos","events_url":"https://api.github.com/users/hallyn/events{/privacy}","received_events_url":"https://api.github.com/users/hallyn/received_events","type":"User","site_admin":false},"created_at":"2016-02-19T21:45:06Z","updated_at":"2016-02-19T21:45:06Z","body":"Oh, right, this is for unprivileged containers."}}