`<div dir="ltr">On Sun, Aug 14, 2016 at 6:27 PM, Dan McDonald <span dir="ltr"><<a href="mailto:danmcd@omniti.com" target="_blank">danmcd@omniti.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
> On Aug 14, 2016, at 1:20 PM, Michael Rasmussen <<a href="mailto:mir@miras.org">mir@miras.org</a>> wrote:<br>
><br>
> - All network configuration can be done outside the zone giving the<br>
> opportunity to hand out LX zones to users with a locked down network<br>
> configuration.<br>
<br>
</span>That's naive. An admin on even a SmartOS zone can invoke:<br>
<br>
/native/sbin/ifconfig <stuff><br>
<br>
and wreak havoc. :)<span class=""><br></span></blockquote><div><br></div><div>Modulo any ip-spoofing protections in place.<br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
> - Admins can script everything and have total control of LX zones<br>
<br>
</span>Also, by "admins" you mean "global zone admins", right?<br></blockquote></div><br></div><div class="gmail_extra">It's unfortunate that the lx brand doesn't support shared-ip stacks.<br></div><div class="gmail_extra">I can't see whether there's a fundamental technical reason, but having<br></div><div class="gmail_extra">shared-ip does make it much easier to simply configure everything in<br></div><div class="gmail_extra">the global zone and prevent the zone fiddling with it.<br><br></div><div class="gmail_extra">The problem with exclusive-ip is that you can't manage it from the global<br>zone at all. If the zone isn't running, you obviously can't do anything, but<br></div><div class="gmail_extra">as soon as the zone is running (or even ready) it steals the interface away<br></div><div class="gmail_extra">so the global zone can do nothing.<br><br></div><div class="gmail_extra">(Docker networking behaves like traditional shared-ip, from what I can see.)<br></div><div class="gmail_extra"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature">-Peter Tribble<br><a href="http://www.petertribble.co.uk/" target="_blank">http://www.petertribble.co.uk/</a> - <a href="http://ptribble.blogspot.com/" target="_blank">http://ptribble.blogspot.com/</a></div>
</div></div>
`