Update 'README.md'

Ref https://github.com/fgrehm/vagrant-lxc/issues/492

.gitignore

@@ -19,6 +19,7 @@ doc/
 
 /tags
 /gems.tags
+/Gemfile.lock
 
 .vagrant
 /cache

.travis.yml

@@ -1,8 +1,10 @@
 language: ruby
 rvm:
-  - 2.0.0
+  - 2.2
-  - 2.1.1
+  - 2.3
-matrix:
+  - 2.4
-  allow_failures:
+  - 2.5
-    - rvm: 2.1.1
+install:
+  - gem install -v 1.12.5 bundler
+  - bundle _1.12.5_ install --jobs=3 --retry=3
 script: "bundle exec rake ci"

CHANGELOG.md

@@ -1,15 +1,88 @@
+## [1.4.2](https://github.com/fgrehm/vagrant-lxc/compare/v1.4.1...v1.4.2) (Jul 17, 2018)
+
+FIXES:
+  - Fix problems with `redir` 3.x command line. [[GH-467]]
+
+## [1.4.1](https://github.com/fgrehm/vagrant-lxc/compare/v1.4.0...v1.4.1) (Apr 30, 2018)
+
+FEATURES:
+  - Add support for LXC v3.0
+  - Add support for `redir` 3.x command line. [[GH-460]]
+
+[GH-460]: https://github.com/fgrehm/vagrant-lxc/issues/460
+
+## [1.4.0](https://github.com/fgrehm/vagrant-lxc/compare/v1.3.1...v1.4.0) (Mar 04, 2018)
+
+FEATURES:
+  - Add support for unprivileged containers. [[GH-312]]
+
+[GH-312]: https://github.com/fgrehm/vagrant-lxc/issues/312
+
+## [1.3.1](https://github.com/fgrehm/vagrant-lxc/compare/v1.3.0...v1.3.1) (Fev 06, 2018)
+
+FIXES:
+  - Fix problems with `tmpfs` fiddling in v1.3.0. [[GH-455]]
+
+[GH-455]: https://github.com/fgrehm/vagrant-lxc/pull/455
+
+## [1.3.0](https://github.com/fgrehm/vagrant-lxc/compare/v1.2.4...v1.3.0) (Jan 20, 2018)
+
+FEATURES:
+  - lxc-template: make runnable by unprivileged users [[GH-447]]
+  - Use `lxc-info` instead of `lxc-attach` to retrieve container IP
+  - Add support for LXC v2.1+ [[GH-445]]
+  - Remove 2Gb limitation on `/tmp`. [[GH-406]]
+
+OTHERS:
+  - Bump Vagrant requirements to v1.8+
+  - Bump LXC requirements to v1.0+
+
+
+[GH-447]: https://github.com/fgrehm/vagrant-lxc/pull/447
+[GH-445]: https://github.com/fgrehm/vagrant-lxc/pull/445
+[GH-406]: https://github.com/fgrehm/vagrant-lxc/pull/406
+
+## [1.2.4](https://github.com/fgrehm/vagrant-lxc/compare/v1.2.3...v1.2.4) (Dec 20, 2017)
+
+BUGFIX:
+  - Support alternative `lxcpath` [[GH-413]]
+  - Update `pipework` regexp in sudo wrapper for Vagrant 1.9+ [[GH-438]]
+  - Work around restrictive `umask` values [[GH-435]]
+  - Make `--config` in `lxc-template` optional [[GH-421]]
+  - Fix sudo wrapper binpath construction logic [[GH-410]]
+  - Fix bug causing CTRL-C on `vagrant up` to destroy the VM [[GH-449]]
+
+[GH-413]: https://github.com/fgrehm/vagrant-lxc/pull/413
+[GH-438]: https://github.com/fgrehm/vagrant-lxc/pull/438
+[GH-435]: https://github.com/fgrehm/vagrant-lxc/pull/435
+[GH-421]: https://github.com/fgrehm/vagrant-lxc/pull/421
+[GH-410]: https://github.com/fgrehm/vagrant-lxc/pull/410
+[GH-449]: https://github.com/fgrehm/vagrant-lxc/pull/449
+
+## [1.2.3](https://github.com/fgrehm/vagrant-lxc/compare/v1.2.2...v1.2.3) (Dec 20, 2016)
+
+  - Fix bug in Gemfile.lock
+
 ## [1.2.2](https://github.com/fgrehm/vagrant-lxc/compare/v1.2.1...v1.2.2) (Dec 20, 2016)
 
+BUGFIX:
   - Make the timeout for fetching container IP's configurable [[GH-426]]
   - Load locale file only once [[GH-423]]
   - Preserve xattrs in container filesystems [[GH-411]]
   - Forward port latest pipework script [[GH-408]]
   - Fix handling of non-fatal lxc-stop return code [[GH-405]]
 
+[GH-426]: https://github.com/fgrehm/vagrant-lxc/pull/426
+[GH-423]: https://github.com/fgrehm/vagrant-lxc/pull/423
+[GH-411]: https://github.com/fgrehm/vagrant-lxc/pull/411
+[GH-408]: https://github.com/fgrehm/vagrant-lxc/pull/408
+[GH-405]: https://github.com/fgrehm/vagrant-lxc/pull/405
+
 ## [1.2.1](https://github.com/fgrehm/vagrant-lxc/compare/v1.2.0...v1.2.1) (Sep 24, 2015)
 
 BUGFIX:
   - Fix sudo Wrapper [[GH-393]]
+ 
 [GH-393]: https://github.com/fgrehm/vagrant-lxc/pull/393
 
 ## [1.2.0](https://github.com/fgrehm/vagrant-lxc/compare/v1.1.0...v1.2.0) (Sep 15, 2015)
@@ -27,6 +100,7 @@ IMPROVEMENTS:
   - Fix shebangs to be more portable [[GH-376]]
   - Fix removal of lxcbr0/virbr0 when using private networking [[GH-383]]
   - Improve /tmp handling by using tmpfs [[GH-362]]
+
 [GH-301]: https://github.com/fgrehm/vagrant-lxc/issues/301
 [GH-355]: https://github.com/fgrehm/vagrant-lxc/pull/355
 [GH-357]: https://github.com/fgrehm/vagrant-lxc/pull/357

Gemfile

@@ -1,16 +1,16 @@
 source 'https://rubygems.org'
 
 group :development do
-  gem 'vagrant', git: 'https://github.com/mitchellh/vagrant.git', tag: 'v1.7.4'
+  gem 'vagrant', git: 'https://github.com/mitchellh/vagrant.git'
   gem 'guard'
   gem 'guard-rspec'
   gem 'rb-inotify'
 end
 
 group :development, :test do
-  gem 'rake'
+  gem 'rake', '~> 10.4.2'
-  gem 'rspec',        '2.99.0'
+  gem 'rspec', '~> 3.5.0'
-  gem 'coveralls',    require: (ENV['COVERAGE'] == 'true')
+  gem 'coveralls', '~> 0.7.2', require: (ENV['COVERAGE'] == 'true')
   gem 'vagrant-spec', git: 'https://github.com/mitchellh/vagrant-spec.git'
 end
 

Gemfile.lock

@@ -1,182 +0,0 @@
-GIT
-  remote: https://github.com/fgrehm/vagrant-cachier.git
-  revision: 40dddfb368526948e769492a00a7937c5a044a4d
-  specs:
-    vagrant-cachier (1.2.2)
-
-GIT
-  remote: https://github.com/fgrehm/vagrant-pristine.git
-  revision: 6d044265db17451c606f000bf43437e95a742bb4
-  specs:
-    vagrant-pristine (0.3.0)
-
-GIT
-  remote: https://github.com/mitchellh/vagrant-spec.git
-  revision: 1df5a3af81cb7cce568b2eac52b8f6822bcb1d8e
-  specs:
-    vagrant-spec (0.0.1)
-      childprocess (~> 0.5.0)
-      log4r (~> 1.1.9)
-      rspec (~> 2.14)
-      thor (~> 0.18.1)
-
-GIT
-  remote: https://github.com/mitchellh/vagrant.git
-  revision: 78ea5e4a78ce644717ab16d8001ab77430168f0f
-  tag: v1.7.4
-  specs:
-    vagrant (1.7.4)
-      bundler (>= 1.5.2, <= 1.10.5)
-      childprocess (~> 0.5.0)
-      erubis (~> 2.7.0)
-      hashicorp-checkpoint (~> 0.1.1)
-      i18n (>= 0.6.0, <= 0.8.0)
-      listen (~> 3.0.2)
-      log4r (~> 1.1.9, < 1.1.11)
-      net-scp (~> 1.1.0)
-      net-sftp (~> 2.1)
-      net-ssh (>= 2.6.6, < 2.10.0)
-      nokogiri (= 1.6.3.1)
-      rb-kqueue (~> 0.2.0)
-      rest-client (>= 1.6.0, < 2.0)
-      wdm (~> 0.1.0)
-      winrm (~> 1.3)
-      winrm-fs (~> 0.2.0)
-
-PATH
-  remote: .
-  specs:
-    vagrant-lxc (1.2.1)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    builder (3.2.2)
-    childprocess (0.5.6)
-      ffi (~> 1.0, >= 1.0.11)
-    coderay (1.1.0)
-    coveralls (0.7.2)
-      multi_json (~> 1.3)
-      rest-client (= 1.6.7)
-      simplecov (>= 0.7)
-      term-ansicolor (= 1.2.2)
-      thor (= 0.18.1)
-    diff-lcs (1.2.5)
-    docile (1.1.5)
-    erubis (2.7.0)
-    ffi (1.9.10)
-    formatador (0.2.5)
-    gssapi (1.2.0)
-      ffi (>= 1.0.1)
-    guard (2.12.8)
-      formatador (>= 0.2.4)
-      listen (>= 2.7, <= 4.0)
-      lumberjack (~> 1.0)
-      nenv (~> 0.1)
-      notiffany (~> 0.0)
-      pry (>= 0.9.12)
-      shellany (~> 0.0)
-      thor (>= 0.18.1)
-    guard-compat (1.2.1)
-    guard-rspec (4.6.2)
-      guard (~> 2.1)
-      guard-compat (~> 1.1)
-      rspec (>= 2.99.0, < 4.0)
-    gyoku (1.3.1)
-      builder (>= 2.1.2)
-    hashicorp-checkpoint (0.1.4)
-    httpclient (2.6.0.1)
-    i18n (0.7.0)
-    json (1.8.3)
-    listen (3.0.2)
-      rb-fsevent (>= 0.9.3)
-      rb-inotify (>= 0.9)
-    little-plugger (1.1.3)
-    log4r (1.1.10)
-    logging (1.8.2)
-      little-plugger (>= 1.1.3)
-      multi_json (>= 1.8.4)
-    lumberjack (1.0.9)
-    method_source (0.8.2)
-    mime-types (2.6.1)
-    mini_portile (0.6.0)
-    multi_json (1.11.2)
-    nenv (0.2.0)
-    net-scp (1.1.2)
-      net-ssh (>= 2.6.5)
-    net-sftp (2.1.2)
-      net-ssh (>= 2.6.5)
-    net-ssh (2.9.2)
-    nokogiri (1.6.3.1)
-      mini_portile (= 0.6.0)
-    nori (2.6.0)
-    notiffany (0.0.6)
-      nenv (~> 0.1)
-      shellany (~> 0.0)
-    pry (0.10.1)
-      coderay (~> 1.1.0)
-      method_source (~> 0.8.1)
-      slop (~> 3.4)
-    rake (10.4.2)
-    rb-fsevent (0.9.5)
-    rb-inotify (0.9.5)
-      ffi (>= 0.5.0)
-    rb-kqueue (0.2.4)
-      ffi (>= 0.5.0)
-    rest-client (1.6.7)
-      mime-types (>= 1.16)
-    rspec (2.99.0)
-      rspec-core (~> 2.99.0)
-      rspec-expectations (~> 2.99.0)
-      rspec-mocks (~> 2.99.0)
-    rspec-core (2.99.2)
-    rspec-expectations (2.99.2)
-      diff-lcs (>= 1.1.3, < 2.0)
-    rspec-mocks (2.99.4)
-    rubyntlm (0.4.0)
-    rubyzip (1.1.7)
-    shellany (0.0.1)
-    simplecov (0.10.0)
-      docile (~> 1.1.0)
-      json (~> 1.8)
-      simplecov-html (~> 0.10.0)
-    simplecov-html (0.10.0)
-    slop (3.6.0)
-    term-ansicolor (1.2.2)
-      tins (~> 0.8)
-    thor (0.18.1)
-    tins (0.13.2)
-    uuidtools (2.1.5)
-    vagrant-omnibus (1.4.1)
-    wdm (0.1.1)
-    winrm (1.3.3)
-      builder (>= 2.1.2)
-      gssapi (~> 1.2)
-      gyoku (~> 1.0)
-      httpclient (~> 2.2, >= 2.2.0.2)
-      logging (~> 1.6, >= 1.6.1)
-      nori (~> 2.0)
-      rubyntlm (~> 0.4.0)
-      uuidtools (~> 2.1.2)
-    winrm-fs (0.2.0)
-      erubis (~> 2.7)
-      logging (~> 1.6, >= 1.6.1)
-      rubyzip (~> 1.1)
-      winrm (~> 1.3.0)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  coveralls
-  guard
-  guard-rspec
-  rake
-  rb-inotify
-  rspec (= 2.99.0)
-  vagrant!
-  vagrant-cachier!
-  vagrant-lxc!
-  vagrant-omnibus
-  vagrant-pristine!
-  vagrant-spec!

README.md

@@ -1,8 +1,12 @@
+🟢 We plan to support and maintain vagrant-lxc, as well as clean it up.<br/>
+🟢 Please feel free to contribute Issues and pull requests.<br/>
+🟢 P.S: Thanks [Fabio Rehm](https://fabiorehm.com) for the amazing initial project.
+
 # vagrant-lxc
 
 [![Build Status](https://travis-ci.org/fgrehm/vagrant-lxc.png?branch=master)](https://travis-ci.org/fgrehm/vagrant-lxc) [![Gem Version](https://badge.fury.io/rb/vagrant-lxc.png)](http://badge.fury.io/rb/vagrant-lxc) [![Code Climate](https://codeclimate.com/github/fgrehm/vagrant-lxc.png)](https://codeclimate.com/github/fgrehm/vagrant-lxc) [![Coverage Status](https://coveralls.io/repos/fgrehm/vagrant-lxc/badge.png?branch=master)](https://coveralls.io/r/fgrehm/vagrant-lxc) [![Gitter chat](https://badges.gitter.im/fgrehm/vagrant-lxc.png)](https://gitter.im/fgrehm/vagrant-lxc)
 
-[LXC](http://lxc.sourceforge.net/) provider for [Vagrant](http://www.vagrantup.com/) 1.6+
+[LXC](http://lxc.sourceforge.net/) provider for [Vagrant](http://www.vagrantup.com/) 1.9+
 
 This is a Vagrant plugin that allows it to control and provision Linux Containers
 as an alternative to the built in VirtualBox provider for Linux hosts. Check out
@@ -12,22 +16,19 @@ to see it in action.
 ## Features
 
 * Provides the same workflow as the Vagrant VirtualBox provider
-* Port forwarding via [`redir`](http://linux.die.net/man/1/redir)
+* Port forwarding via [`redir`](https://github.com/troglobit/redir)
 * Private networking via [`pipework`](https://github.com/jpetazzo/pipework)
 
 ## Requirements
 
-* [Vagrant 1.5+](http://www.vagrantup.com/downloads.html) (tested with 1.7.2)
+* [Vagrant 1.9+](http://www.vagrantup.com/downloads.html)
-* lxc 0.7.5+
+* lxc >=2.1
-* tar 1.27 (the lxc-template script uses the --xattrs option)
 * `redir` (if you are planning to use port forwarding)
 * `brctl` (if you are planning to use private networks, on Ubuntu this means `apt-get install bridge-utils`)
-* A [kernel != 3.5.0-17.28](https://github.com/fgrehm/vagrant-lxc/wiki/Troubleshooting#wiki-im-unable-to-restart-containers)
 
 The plugin is known to work better and pretty much out of the box on Ubuntu 14.04+
-hosts and installing the dependencies on it basically means a `apt-get install lxc lxc-templates cgroup-lite redir`
+hosts and installing the dependencies on it basically means a
-(older LXC versions like 0.7.5 shipped with Ubuntu 12.04 by default might require
+`apt-get install lxc lxc-templates cgroup-lite redir`. For setting up other
-[additional configurations to work](#backingstore-options)). For setting up other
 types of hosts please have a look at the [Wiki](https://github.com/fgrehm/vagrant-lxc/wiki).
 
 If you are on a Mac or Windows machine, you might want to have a look at [this](http://the.taoofmac.com/space/HOWTO/Vagrant)
@@ -54,8 +55,9 @@ _More information about skipping the `--provider` argument can be found at the
 
 ## Base boxes
 
-Base boxes can be found on [Atlas](https://atlas.hashicorp.com/boxes/search?provider=lxc)
+Base boxes provided on Atlas haven't been refreshed for a good while and shouldn't be relied on.
-and some scripts to build your own are available at [fgrehm/vagrant-lxc-base-boxes](https://github.com/fgrehm/vagrant-lxc-base-boxes).
+Your best best is to build your boxes yourself. Some scripts to build your own are available at
+[hsoft/vagrant-lxc-base-boxes](https://github.com/hsoft/vagrant-lxc-base-boxes).
 
 If you want to build your own boxes, please have a look at [`BOXES.md`](https://github.com/fgrehm/vagrant-lxc/tree/master/BOXES.md)
 for more information.
@@ -81,7 +83,7 @@ prior to starting it.
 
 For other configuration options, please check the [lxc.conf manpages](http://manpages.ubuntu.com/manpages/precise/man5/lxc.conf.5.html).
 
-### Private Networks [EXPERIMENTAL]
+### Private Networks
 
 Starting with vagrant-lxc 1.1.0, there is some rudimentary support for configuring
 [Private Networks](https://docs.vagrantup.com/v2/networking/private_network.html)
@@ -140,31 +142,33 @@ Vagrant.configure("2") do |config|
 end
 ```
 
-For old versions of lxc (like 0.7.5 shipped with Ubuntu 12.04 by default) that
+## Unprivileged containers support
-does not support `best` for the backingstore option, changing it to `none` is
+
-required and a default for all Vagrant environments can be set from your
+Since v1.4.0, `vagrant-lxc` gained support for unprivileged containers. For now, since it's a new
-`~/.vagrant.d/Vagrantfile` using the same `provider` block:
+feature, privileged containers are still the default, but you can have your `Vagrantfile` use
+unprivileged containers with the `privileged` flag (which defaults to `true`). Example:
 
 ```ruby
 Vagrant.configure("2") do |config|
   config.vm.provider :lxc do |lxc|
-    lxc.backingstore = 'none'
+    lxc.privileged = false
   end
 end
 ```
 
+For unprivileged containers to work with `vagrant-lxc`, you need a properly configured system. On
+some distros, it can be somewhat of a challenge. Your journey to configuring your system can start
+with [Stéphane Graber's blog post about it](https://stgraber.org/2014/01/17/lxc-1-0-unprivileged-containers/).
+
 ## Avoiding `sudo` passwords
 
-This plugin requires **a lot** of `sudo`ing since [user namespaces](https://wiki.ubuntu.com/UserNamespace)
+If you're not using unprivileged containers, this plugin requires **a lot** of `sudo`ing To work
-is not supported yet. To work around that, you can use the `vagrant lxc sudoers`
+around that, you can use the `vagrant lxc sudoers` command which will create a file under
-command which will create a file under `/etc/sudoers.d/vagrant-lxc` whitelisting
+`/etc/sudoers.d/vagrant-lxc` whitelisting all commands required by `vagrant-lxc` to run.
-all commands required by `vagrant-lxc` to run.
 
 If you are interested on what will be generated by that command, please check
 [this code](lib/vagrant-lxc/command/sudoers.rb).
 
-_vagrant-lxc < 1.0.0 users, please check this [Wiki page](https://github.com/fgrehm/vagrant-lxc/wiki/Avoiding-%27sudo%27-passwords)_
-
 
 ## More information
 

lib/vagrant-lxc.rb

@@ -6,9 +6,5 @@ module Vagrant
     def self.source_root
       @source_root ||= Pathname.new(File.dirname(__FILE__)).join('..').expand_path
     end
-
-    def self.sudo_wrapper_path
-      "/usr/local/bin/vagrant-lxc-wrapper"
-    end
   end
 end

lib/vagrant-lxc/action.rb

@@ -4,8 +4,7 @@ require 'vagrant-lxc/action/create'
 require 'vagrant-lxc/action/destroy'
 require 'vagrant-lxc/action/destroy_confirm'
 require 'vagrant-lxc/action/compress_rootfs'
-require 'vagrant-lxc/action/fetch_ip_with_lxc_attach'
+require 'vagrant-lxc/action/fetch_ip_with_lxc_info'
-require 'vagrant-lxc/action/fetch_ip_from_dnsmasq_leases'
 require 'vagrant-lxc/action/forced_halt'
 require 'vagrant-lxc/action/forward_ports'
 require 'vagrant-lxc/action/gc_private_network_bridges'
@@ -182,8 +181,7 @@ module Vagrant
       def self.action_ssh_ip
         Builder.new.tap do |b|
           b.use Builtin::Call, Builtin::ConfigValidate do |env, b2|
-            b2.use FetchIpWithLxcAttach if env[:machine].provider.driver.supports_attach?
+            b2.use FetchIpWithLxcInfo
-            b2.use FetchIpFromDnsmasqLeases
           end
         end
       end

lib/vagrant-lxc/action/boot.rb

@@ -8,11 +8,15 @@ module Vagrant
 
         def call(env)
           @env = env
-
+          driver = env[:machine].provider.driver
           config = env[:machine].provider_config
 
           utsname = env[:machine].config.vm.hostname || env[:machine].id
-          config.customize 'utsname', utsname
+          if driver.supports_new_config_format
+            config.customize 'uts.name', utsname
+          else
+            config.customize 'utsname', utsname
+          end
 
           # Fix apparmor issues when starting Ubuntu 14.04 containers
           # See https://github.com/fgrehm/vagrant-lxc/issues/278 for more information
@@ -26,11 +30,13 @@ module Vagrant
             config.customize 'mount.entry', '/sys/fs/selinux sys/fs/selinux none bind,ro 0 0'
           end
 
-          # Make /tmp a tmpfs to prevent init scripts from nuking synced folders mounted in here
+          if config.tmpfs_mount_size && !config.tmpfs_mount_size.empty?
-          config.customize 'mount.entry', 'tmpfs tmp tmpfs nodev,nosuid,size=2G 0 0'
+            # Make /tmp a tmpfs to prevent init scripts from nuking synced folders mounted in here
+            config.customize 'mount.entry', "tmpfs tmp tmpfs nodev,nosuid,size=#{config.tmpfs_mount_size} 0 0"
+          end
 
           env[:ui].info I18n.t("vagrant_lxc.messages.starting")
-          env[:machine].provider.driver.start(config.customizations)
+          driver.start(config.customizations)
 
           @app.call env
         end

lib/vagrant-lxc/action/create.rb

@@ -19,14 +19,28 @@ module Vagrant
               container_name = generate_container_name(env)
           end
 
-          env[:machine].provider.driver.create(
+          backingstore = config.backingstore
+          if backingstore.nil?
+            backingstore = config.privileged ? "best" : "dir"
+          end
+          driver = env[:machine].provider.driver
+          template_options = env[:lxc_template_opts]
+          if driver.supports_new_config_format
+            if env[:lxc_box_config]
+              driver.update_config_keys(env[:lxc_box_config])
+            end
+          else
+            template_options['--oldconfig'] = ''
+          end
+          driver.create(
             container_name,
-            config.backingstore,
+            backingstore,
             config.backingstore_options,
             env[:lxc_template_src],
             env[:lxc_template_config],
-            env[:lxc_template_opts]
+            template_options
           )
+          driver.update_config_keys
 
           env[:machine].id = container_name
 

lib/vagrant-lxc/action/fetch_ip_from_dnsmasq_leases.rb

@@ -1,49 +0,0 @@
-module Vagrant
-  module LXC
-    module Action
-      class FetchIpFromDnsmasqLeases
-        def initialize(app, env)
-          @app    = app
-          @logger = Log4r::Logger.new("vagrant::lxc::action::fetch_ip_from_dnsmasq_leases")
-        end
-
-        def call(env)
-          env[:machine_ip] ||= assigned_ip(env)
-          @app.call(env)
-        end
-
-        def assigned_ip(env)
-          mac_address = env[:machine].provider.driver.mac_address
-          ip = nil
-          10.times do
-            dnsmasq_leases = read_dnsmasq_leases
-            @logger.debug "Attempting to load ip from dnsmasq leases (mac: #{mac_address})"
-            @logger.debug dnsmasq_leases
-            if dnsmasq_leases =~ /#{Regexp.escape mac_address.to_s}\s+([0-9.]+)\s+/i
-              ip = $1.to_s
-              break
-            else
-              @logger.debug 'Ip could not be parsed from dnsmasq leases file'
-              sleep 2
-            end
-          end
-          ip
-        end
-
-        LEASES_PATHS = %w(
-          /var/lib/misc/dnsmasq.*.leases
-          /var/lib/misc/dnsmasq.leases
-          /var/lib/dnsmasq/dnsmasq.leases
-          /var/db/dnsmasq.leases
-          /var/lib/libvirt/dnsmasq/*.leases
-        )
-
-        def read_dnsmasq_leases
-          Dir["{#{LEASES_PATHS.join(',')}}"].map do |file|
-            File.read(file)
-          end.join("\n")
-        end
-      end
-    end
-  end
-end

lib/vagrant-lxc/action/fetch_ip_with_lxc_info.rb

@@ -1,19 +1,17 @@
 module Vagrant
   module LXC
     module Action
-      class FetchIpWithLxcAttach
+      class FetchIpWithLxcInfo
         # Include this so we can use `Subprocess` more easily.
         include Vagrant::Util::Retryable
 
         def initialize(app, env)
           @app    = app
-          @logger = Log4r::Logger.new("vagrant::lxc::action::fetch_ip_with_lxc_attach")
+          @logger = Log4r::Logger.new("vagrant::lxc::action::fetch_ip_with_lxc_info")
         end
 
         def call(env)
           env[:machine_ip] ||= assigned_ip(env)
-        rescue LXC::Errors::NamespacesNotSupported
-          @logger.info 'The `lxc-attach` command available does not support the --namespaces parameter, falling back to dnsmasq leases to fetch container ip'
         ensure
           @app.call(env)
         end
@@ -23,10 +21,11 @@ module Vagrant
           fetch_ip_tries = config.fetch_ip_tries
           driver = env[:machine].provider.driver
           ip = ''
+          return config.ssh_ip_addr if not config.ssh_ip_addr.nil?
           retryable(:on => LXC::Errors::ExecuteError, :tries => fetch_ip_tries, :sleep => 3) do
             unless ip = get_container_ip_from_ip_addr(driver)
               # retry
-              raise LXC::Errors::ExecuteError, :command => "lxc-attach"
+              raise LXC::Errors::ExecuteError, :command => "lxc-info"
             end
           end
           ip
@@ -34,8 +33,8 @@ module Vagrant
 
         # From: https://github.com/lxc/lxc/blob/staging/src/python-lxc/lxc/__init__.py#L371-L385
         def get_container_ip_from_ip_addr(driver)
-          output = driver.attach '/sbin/ip', '-4', 'addr', 'show', 'scope', 'global', 'eth0', namespaces: ['network', 'mount']
+          output = driver.info '-iH'
-          if output =~ /^\s+inet ([0-9.]+)\/[0-9]+\s+/
+          if output =~ /^([0-9.]+)/
             return $1.to_s
           end
         end

lib/vagrant-lxc/action/forward_ports.rb

@@ -1,3 +1,5 @@
+require 'open3'
+
 module Vagrant
   module LXC
     module Action
@@ -78,8 +80,12 @@ module Vagrant
         end
 
         def redirect_port(host_ip, host_port, guest_ip, guest_port)
-          params = %W( --lport=#{host_port} --caddr=#{guest_ip} --cport=#{guest_port} )
+          if redir_version >= 3
-          params.unshift "--laddr=#{host_ip}" if host_ip
+            params = %W( -n #{host_ip}:#{host_port} #{guest_ip}:#{guest_port} )
+          else
+            params = %W( --lport=#{host_port} --caddr=#{guest_ip} --cport=#{guest_port} )
+            params.unshift "--laddr=#{host_ip}" if host_ip
+          end
           params << '--syslog' if ENV['REDIR_LOG']
           if host_port < 1024
             redir_cmd = "sudo redir #{params.join(' ')} 2>/dev/null"
@@ -99,6 +105,13 @@ module Vagrant
           end
         end
 
+        def redir_version
+          stdout, stderr, _ = Open3.capture3 "redir --version"
+          # For some weird reason redir printed version information in STDERR prior to 3.2
+          version = stdout.empty? ? stderr : stdout
+          version.split('.')[0].to_i
+        end
+
         def redir_installed?
           system "which redir > /dev/null"
         end

lib/vagrant-lxc/action/handle_box_metadata.rb

@@ -33,8 +33,10 @@ module Vagrant
           end
 
           if template_config_file.exist?
+            @env[:lxc_box_config] = template_config_file.to_s
             @env[:lxc_template_opts].merge!('--config' => template_config_file.to_s)
           elsif old_template_config_file.exist?
+            @env[:lxc_box_config] = old_template_config_file.to_s
             @env[:lxc_template_config] = old_template_config_file.to_s
           end
 

lib/vagrant-lxc/command/sudoers.rb

@@ -1,5 +1,8 @@
 require 'tempfile'
 
+require "vagrant-lxc/driver"
+require "vagrant-lxc/sudo_wrapper"
+
 module Vagrant
   module LXC
     module Command
@@ -25,7 +28,7 @@ module Vagrant
           argv = parse_options(opts)
           return unless argv
 
-          wrapper_path = Vagrant::LXC.sudo_wrapper_path
+          wrapper_path = SudoWrapper.dest_path
           wrapper = create_wrapper!
           sudoers = create_sudoers!(options[:user], wrapper_path)
 
@@ -43,12 +46,14 @@ module Vagrant
 
         # This requires vagrant 1.5.2+ https://github.com/mitchellh/vagrant/commit/3371c3716278071680af9b526ba19235c79c64cb
         def create_wrapper!
+          lxc_base_path = Driver.new("").containers_path
           wrapper = Tempfile.new('lxc-wrapper').tap do |file|
             template = Vagrant::Util::TemplateRenderer.new(
               'sudoers.rb',
               :template_root  => Vagrant::LXC.source_root.join('templates').to_s,
               :cmd_paths      => build_cmd_paths_hash,
-              :pipework_regex => "#{ENV['HOME']}/\.vagrant\.d/gems/gems/vagrant-lxc.+/scripts/pipework"
+              :lxc_base_path  => lxc_base_path,
+              :pipework_regex => "#{ENV['HOME']}/\.vagrant\.d/gems/(?:\\d+?\\.\\d+?\\.\\d+?/)?gems/vagrant-lxc.+/scripts/pipework"
             )
             file.puts template.render
           end
@@ -80,9 +85,9 @@ module Vagrant
         def build_cmd_paths_hash
           {}.tap do |hash|
             %w( which cat mkdir cp chown chmod rm tar chown ip ifconfig brctl ).each do |cmd|
-              hash[cmd] = `which #{cmd}`.strip
+              hash[cmd] = `sudo which #{cmd}`.strip
             end
-            hash['lxc_bin'] = Pathname(`which lxc-create`.strip).parent.to_s
+            hash['lxc_bin'] = Pathname(`sudo which lxc-create`.strip).parent.to_s
             hash['ruby'] = Gem.ruby
           end
         end

lib/vagrant-lxc/config.rb

@@ -18,15 +18,29 @@ module Vagrant
       # machine name, set this to :machine
       attr_accessor :container_name
 
+      # Size (as a string like '400M') of the tmpfs to mount at /tmp on boot.
+      # Set to false or nil to disable the tmpfs mount altogether. Defaults to '2G'.
+      attr_accessor :tmpfs_mount_size
+
       attr_accessor :fetch_ip_tries
 
+      attr_accessor :ssh_ip_addr
+
+      # Whether the container needs to be privileged. Defaults to true (unprivileged containers
+      # is a very new feature in vagrant-lxc). If false, will try creating an unprivileged
+      # container. If it can't, will revert to the old "sudo wrapper" method to create a privileged
+      # container.
+      attr_accessor :privileged
+
       def initialize
         @customizations = []
         @backingstore = UNSET_VALUE
         @backingstore_options = []
-        @sudo_wrapper   = UNSET_VALUE
         @container_name = UNSET_VALUE
+        @tmpfs_mount_size = UNSET_VALUE
         @fetch_ip_tries = UNSET_VALUE
+        @ssh_ip_addr = UNSET_VALUE
+        @privileged = UNSET_VALUE
       end
 
       # Customize the container by calling `lxc-start` with the given
@@ -50,11 +64,13 @@ module Vagrant
       end
 
       def finalize!
-        @sudo_wrapper = nil if @sudo_wrapper == UNSET_VALUE
         @container_name = nil if @container_name == UNSET_VALUE
-        @backingstore = "best" if @backingstore == UNSET_VALUE
+        @backingstore = nil if @backingstore == UNSET_VALUE
         @existing_container_name = nil if @existing_container_name == UNSET_VALUE
+        @tmpfs_mount_size = '2G' if @tmpfs_mount_size == UNSET_VALUE
         @fetch_ip_tries = 10 if @fetch_ip_tries == UNSET_VALUE
+        @ssh_ip_addr = nil if @ssh_ip_addr == UNSET_VALUE
+        @privileged = true if @privileged == UNSET_VALUE
       end
     end
   end

lib/vagrant-lxc/driver.rb

@@ -3,6 +3,7 @@ require "vagrant/util/subprocess"
 
 require "vagrant-lxc/errors"
 require "vagrant-lxc/driver/cli"
+require "vagrant-lxc/sudo_wrapper"
 
 require "etc"
 
@@ -16,15 +17,13 @@ module Vagrant
       class ContainerNotFound < StandardError; end
 
       # Default root folder where container configs are stored
-      DEFAULT_CONTAINERS_PATH = '/var/lib/lxc'
-
       attr_reader :container_name,
                   :customizations
 
-      def initialize(container_name, sudo_wrapper, cli = nil)
+      def initialize(container_name, sudo_wrapper = nil, cli = nil, privileged: true)
         @container_name = container_name
-        @sudo_wrapper   = sudo_wrapper
+        @sudo_wrapper   = sudo_wrapper || SudoWrapper.new(privileged: privileged)
-        @cli            = cli || CLI.new(sudo_wrapper, container_name)
+        @cli            = cli || CLI.new(@sudo_wrapper, container_name)
         @logger         = Log4r::Logger.new("vagrant::provider::lxc::driver")
         @customizations = []
       end
@@ -35,7 +34,7 @@ module Vagrant
 
       # Root folder where container configs are stored
       def containers_path
-        @containers_path ||= @cli.support_config_command? ? @cli.config('lxc.lxcpath') : DEFAULT_CONTAINERS_PATH
+        @containers_path ||= @cli.config('lxc.lxcpath')
       end
 
       def all_containers
@@ -46,21 +45,25 @@ module Vagrant
         Pathname.new("#{containers_path}/#{@container_name}")
       end
 
+      def config_path
+        base_path.join('config').to_s
+      end 
+
       def rootfs_path
-        config_entry = config_string.match(/^lxc\.rootfs\s+=\s+(.+)$/)[1]
+        pathtype, path = config_string.match(/^lxc\.rootfs(?:\.path)?\s+=\s+(.+:)?(.+)$/)[1..2]
-        case config_entry
+        case pathtype
-        when /^overlayfs:/
+        when 'overlayfs:'
           # Split on colon (:), ignoring any colon escaped by an escape character ( \ )
           # Pays attention to when the escape character is itself escaped.
-          fs_type, master_path, overlay_path = config_entry.split(/(?<!\\)(?:\\\\)*:/)
+          _, overlay_path = config_entry.split(/(?<!\\)(?:\\\\)*:/)
           if overlay_path
             Pathname.new(overlay_path)
           else
             # Malformed: fall back to prior behaviour
-            Pathname.new(config_entry)
+            Pathname.new(path)
           end
         else
-          Pathname.new(config_entry)
+          Pathname.new(path)
         end
       end
 
@@ -73,13 +76,14 @@ module Vagrant
       end
 
       def config_string
-        @sudo_wrapper.run('cat', base_path.join('config').to_s)
+        @sudo_wrapper.run('cat', config_path)
       end
 
       def create(name, backingstore, backingstore_options, template_path, config_file, template_options = {})
         @cli.name = @container_name = name
 
         @logger.debug "Creating container..."
+
         @cli.create template_path, backingstore, backingstore_options, config_file, template_options
       end
 
@@ -118,14 +122,14 @@ module Vagrant
         @cli.destroy
       end
 
-      def supports_attach?
-        @cli.supports_attach?
-      end
-
       def attach(*command)
         @cli.attach(*command)
       end
 
+      def info(*command)
+        @cli.info(*command)
+      end
+
       def configure_private_network(bridge_name, bridge_ip, container_name, address_type, ip)
         @logger.info "Configuring network interface for #{container_name} using #{ip} and bridge #{bridge_name}"
         if ip
@@ -207,6 +211,10 @@ module Vagrant
         @version ||= @cli.version
       end
 
+      def supports_new_config_format
+        Gem::Version.new(version) >= Gem::Version.new('2.1.0')
+      end
+
       # TODO: This needs to be reviewed and specs needs to be written
       def compress_rootfs
         # TODO: Pass in tmpdir so we can clean up from outside
@@ -237,6 +245,13 @@ module Vagrant
         write_config(contents)
       end
 
+      def update_config_keys(path = nil)
+        path = path || config_path
+        @cli.update_config(path)
+      rescue Errors::ExecuteError
+        # not on LXC 2.1+. Doesn't matter, ignore.
+      end
+
       protected
 
       def write_customizations(customizations)
@@ -253,12 +268,21 @@ module Vagrant
       end
 
       def write_config(contents)
-        Tempfile.new('lxc-config').tap do |file|
+        confpath = base_path.join('config').to_s
-          file.chmod 0644
+        begin
-          file.write contents
+          File.open(confpath, File::RDWR) do |file|
-          file.close
+            file.write contents
-          @sudo_wrapper.run 'cp', '-f', file.path, base_path.join('config').to_s
+          end
-          @sudo_wrapper.run 'chown', 'root:root', base_path.join('config').to_s
+        rescue
+          # We don't have permissions to write in the conf file. That's probably because it's a
+          # privileged container. Work around that through sudo_wrapper.
+          Tempfile.new('lxc-config').tap do |file|
+            file.chmod 0644
+            file.write contents
+            file.close
+            @sudo_wrapper.run 'cp', '-f', file.path, confpath
+            @sudo_wrapper.run 'chown', 'root:root', confpath
+          end
         end
       end
     end

lib/vagrant-lxc/driver/cli.rb

@@ -29,7 +29,7 @@ module Vagrant
 
         def version
           return @version if @version
-          @version = support_version_command? ? run(:version) : run(:create, '--version')
+          @version = run(:create, '--version')
           if @version =~ /(lxc version:\s+|)(.+)\s*$/
             @version = $2.downcase
           else
@@ -39,11 +39,11 @@ module Vagrant
         end
 
         def config(param)
-          if support_config_command?
+          run(:config, param).gsub("\n", '')
-            run(:config, param).gsub("\n", '')
+        end
-          else
+
-            raise Errors::CommandNotSupported, name: 'config', available_version: '> 1.x.x', version: version
+        def update_config(path)
-          end
+          run('update-config', '-c', path)
         end
 
         def state
@@ -59,7 +59,7 @@ module Vagrant
             config_opts = ['-f', config_file]
           end
 
-          extra = template_opts.to_a.flatten
+          extra = template_opts.to_a.flatten.reject { |elem| elem.empty? }
           extra.unshift '--' unless extra.empty?
 
           run :create,
@@ -89,14 +89,13 @@ module Vagrant
         # Man Page:
         # 2      The specified container exists but was not running.
         def stop
-          attach '/sbin/halt' if supports_attach?
           begin
             run :stop, '--name', @name
           rescue LXC::Errors::ExecuteError => e
             if e.exitcode == 2
-               @logger.debug "Machine already stopped, lxc-stop returned 2"
+              @logger.debug "Machine already stopped, lxc-stop returned 2"
             else
-		raise e
+              raise e
             end
           end
         end
@@ -114,17 +113,17 @@ module Vagrant
             end
 
             if namespaces
-              if supports_attach_with_namespaces?
+              extra = ['--namespaces', namespaces]
-                extra = ['--namespaces', namespaces]
-              else
-                raise LXC::Errors::NamespacesNotSupported
-              end
             end
           end
 
           run :attach, '--name', @name, *((extra || []) + cmd)
         end
 
+        def info(*cmd)
+          run(:info, '--name', @name, *cmd)
+        end
+
         def transition_to(target_state, tries = 30, timeout = 1, &block)
           raise TransitionBlockNotProvided unless block_given?
 
@@ -142,42 +141,11 @@ module Vagrant
           end
         end
 
-        def supports_attach?
-          unless defined?(@supports_attach)
-            begin
-              @supports_attach = true
-              run(:attach, '--name', @name, '--', '/bin/true')
-            rescue LXC::Errors::ExecuteError
-              @supports_attach = false
-            end
-          end
-
-          return @supports_attach
-        end
-
-        def support_config_command?
-          version[0].to_i >= 1
-        end
-
-        def support_version_command?
-          @sudo_wrapper.run('which', 'lxc-version').strip.chomp != ''
-        rescue Vagrant::LXC::Errors::ExecuteError
-          return false
-        end
-
         private
 
         def run(command, *args)
           @sudo_wrapper.run("lxc-#{command}", *args)
         end
-
-        def supports_attach_with_namespaces?
-          unless defined?(@supports_attach_with_namespaces)
-            @supports_attach_with_namespaces = run(:attach, '-h', :show_stderr => true).values.join.include?('--namespaces')
-          end
-
-          return @supports_attach_with_namespaces
-        end
       end
     end
   end

lib/vagrant-lxc/errors.rb

@@ -16,9 +16,15 @@ module Vagrant
         end
       end
 
-      class NamespacesNotSupported < Vagrant::Errors::VagrantError
+      # Raised when user interrupts a subprocess
+      class SubprocessInterruptError < Vagrant::Errors::VagrantError
+        error_key(:lxc_interrupt_error)
+        def initialize(message, *args)
+          super
+        end
       end
 
+
       class LxcLinuxRequired < Vagrant::Errors::VagrantError
         error_key(:lxc_linux_required)
       end

lib/vagrant-lxc/plugin.rb

@@ -10,7 +10,7 @@ module Vagrant
       EOF
 
       provider(:lxc, parallel: true, priority: 7) do
-        require File.expand_path("../provider", __FILE__)
+        require_relative 'provider'
         init!
         Provider
       end
@@ -22,13 +22,13 @@ module Vagrant
       end
 
       config(:lxc, :provider) do
-        require File.expand_path("../config", __FILE__)
+        require_relative 'config'
         init!
         Config
       end
 
       synced_folder(:lxc) do
-        require File.expand_path("../synced_folder", __FILE__)
+        require_relative 'synced_folder'
         SyncedFolder
       end
 

lib/vagrant-lxc/provider.rb

@@ -2,7 +2,6 @@ require "log4r"
 
 require "vagrant-lxc/action"
 require "vagrant-lxc/driver"
-require "vagrant-lxc/sudo_wrapper"
 
 module Vagrant
   module LXC
@@ -25,18 +24,9 @@ module Vagrant
         machine_id_changed
       end
 
-      def sudo_wrapper
-        @shell ||= begin
-          wrapper = Pathname.new(LXC.sudo_wrapper_path).exist? &&
-            LXC.sudo_wrapper_path || nil
-          @logger.debug("Found sudo wrapper : #{wrapper}") if wrapper
-          SudoWrapper.new(wrapper)
-        end
-      end
-
       def ensure_lxc_installed!
         begin
-          sudo_wrapper.run("which", "lxc-create")
+          SudoWrapper.new(privileged: @machine.provider_config.privileged).run("which", "lxc-create")
         rescue Vagrant::LXC::Errors::ExecuteError
           raise Errors::LxcNotInstalled
         end
@@ -49,7 +39,7 @@ module Vagrant
 
         begin
           @logger.debug("Instantiating the container for: #{id.inspect}")
-          @driver = Driver.new(id, self.sudo_wrapper)
+          @driver = Driver.new(id, privileged: @machine.provider_config.privileged)
           @driver.validate!
         rescue Driver::ContainerNotFound
           # The container doesn't exist, so we probably have a stale

lib/vagrant-lxc/sudo_wrapper.rb

@@ -6,18 +6,40 @@ module Vagrant
 
       attr_reader :wrapper_path
 
-      def initialize(wrapper_path = nil)
+      def self.dest_path
-        @wrapper_path = wrapper_path
+        "/usr/local/bin/vagrant-lxc-wrapper"
+      end
+
+      def initialize(privileged: true)
+        @wrapper_path = Pathname.new(SudoWrapper.dest_path).exist? && SudoWrapper.dest_path || nil
+        @privileged   = privileged
         @logger       = Log4r::Logger.new("vagrant::lxc::sudo_wrapper")
       end
 
       def run(*command)
         options = command.last.is_a?(Hash) ? command.last : {}
-        if @wrapper_path && !options[:no_wrapper]
+
-          command.unshift @wrapper_path
+        # Avoid running LXC commands with a restrictive umask.
-          execute *(['sudo'] + command)
+        # Otherwise disasters occur, like the container root directory
-        else
+        # having permissions `rwxr-x---` which prevents the `vagrant`
-          execute *(['sudo', '/usr/bin/env'] + command)
+        # user from accessing its own home directory; among other
+        # problems, SSH cannot then read `authorized_keys`!
+        old_mask = File.umask
+        File.umask(old_mask & 022)  # allow all `r` and `x` bits
+
+        begin
+          if @privileged
+            if @wrapper_path && !options[:no_wrapper]
+              command.unshift @wrapper_path
+              execute *(['sudo'] + command)
+            else
+              execute *(['sudo', '/usr/bin/env'] + command)
+            end
+          else
+            execute *(['/usr/bin/env'] + command)
+          end
+        ensure
+          File.umask(old_mask)
         end
       end
 
@@ -46,7 +68,7 @@ module Vagrant
           # nicely handled by Vagrant.
           if r.exit_code != 0
             if @interrupted
-              @logger.info("Exit code != 0, but interrupted. Ignoring.")
+              raise LXC::Errors::SubprocessInterruptError, command.inspect
             else
               raise LXC::Errors::ExecuteError,
                 command: command.inspect, stderr: r.stderr, stdout: r.stdout, exitcode: r.exit_code

lib/vagrant-lxc/version.rb

@@ -1,5 +1,5 @@
 module Vagrant
   module LXC
-    VERSION = "1.2.2"
+    VERSION = "1.4.2"
   end
 end

locales/en.yml

@@ -40,6 +40,9 @@ en:
           preparing: Setting up mount entries for shared folders...
 
     errors:
+      lxc_interrupt_error: |-
+        Interrupted
+
       lxc_execute_error: |-
         There was an error executing %{command}
 

scripts/lxc-template

@@ -33,8 +33,10 @@ LXC_PATH=
 LXC_ROOTFS=
 LXC_TARBALL=
 LXC_CONFIG=
+LXC_USE_OLDCONFIG=
 LXC_STRIP_COMPONENTS=2
 
+
 usage() {
     cat <<EOF
 vagrant-lxc default template
@@ -44,6 +46,7 @@ Required arguments:
 
 Optional arguments:
 [ --config ]: Configuration file to be used when building the container
+[ --oldconfig ]: Use pre LXC 2.1 config format
 [ -h | --help ]: This help message
 
 LXC internal arguments (do not pass manually!):
@@ -57,7 +60,7 @@ EOF
     return 0
 }
 
-options=$(getopt -o h -l tarball:,config:,help:,name:,path:,rootfs:,mapped-uid:,mapped-gid:,strip-components: -- "$@")SS
+options=$(getopt -o h -l tarball:,config:,oldconfig,help:,name:,path:,rootfs:,mapped-uid:,mapped-gid:,strip-components: -- "$@")SS
 
 if [ $? -ne 0 ]; then
     usage $(basename $0)
@@ -70,6 +73,7 @@ do
     case "$1" in
         -h|--help)          usage $0 && exit 0;;
         --config)           LXC_CONFIG=$2; shift 2;;
+        --oldconfig)        LXC_USE_OLDCONFIG=1; shift 1;;
         --tarball)          LXC_TARBALL=$2; shift 2;;
         --name)             LXC_NAME=$2; shift 2;;
         --path)             LXC_PATH=$2; shift 2;;
@@ -96,11 +100,6 @@ if [ -z "${LXC_PATH}" ]; then
     exit 1
 fi
 
-if [ -z "${LXC_CONFIG}" ]; then
-    echo "'config' parameter is required"
-    exit 1
-fi
-
 # if $LXC_ROOTFS exists here, it was passed in with --rootfs
 if [ -z "${LXC_ROOTFS}" ]; then
     config=${LXC_PATH}/config
@@ -115,7 +114,6 @@ fi
 # Unpack the rootfs
 echo "Unpacking the rootfs"
 
-mkdir -p /var/lock/subsys
 (
     flock -x 200
     if [ $? -ne 0 ]; then
@@ -124,13 +122,14 @@ mkdir -p /var/lock/subsys
     fi
 
     mkdir -p ${LXC_ROOTFS}
-    (cd ${LXC_ROOTFS} && tar xfz ${LXC_TARBALL} --strip-components=${LXC_STRIP_COMPONENTS} --xattrs --xattrs-include=*)
+    (cd ${LXC_ROOTFS} && tar xfz ${LXC_TARBALL} --strip-components=${LXC_STRIP_COMPONENTS} --xattrs --xattrs-include=* || true)
-    if [ $? -ne 0 ]; then
+    if [ ! -f ${LXC_ROOTFS}/bin/true ]; then
         echo "Failed to extract rootfs"
         exit 1
     fi
 
-) 200>/var/lock/subsys/lxc
+) 200>${LXC_PATH}/vagrant_lock
+rm ${LXC_PATH}/vagrant_lock
 
 mkdir -p ${LXC_ROOTFS}/dev/pts/
 
@@ -149,7 +148,12 @@ if [ -e "${LXC_PATH}/config-auto" ]; then
     cat ${LXC_PATH}/config-auto >> ${LXC_PATH}/config
     rm ${LXC_PATH}/config-auto
 fi
-echo "lxc.utsname = ${LXC_NAME}" >> ${LXC_PATH}/config
+
+if [ $LXC_USE_OLDCONFIG ]; then
+    echo "lxc.utsname = ${LXC_NAME}" >> ${LXC_PATH}/config
+else
+    echo "lxc.uts.name = ${LXC_NAME}" >> ${LXC_PATH}/config
+fi
 
 ## Re-add the previously removed network config
 if [ -e "${LXC_PATH}/config-network" ]; then
@@ -160,11 +164,13 @@ if [ -e "${LXC_PATH}/config-network" ]; then
     rm ${LXC_PATH}/config-network
 fi
 
-## Append the defaults
+if [ -n "${LXC_CONFIG}" ]; then
-echo "" >> ${LXC_PATH}/config
+    ## Append the defaults
-echo "##############################################" >> ${LXC_PATH}/config
+    echo "" >> ${LXC_PATH}/config
-echo "# vagrant-lxc base box specific configuration" >> ${LXC_PATH}/config
+    echo "##############################################" >> ${LXC_PATH}/config
-cat ${LXC_CONFIG} >> ${LXC_PATH}/config
+    echo "# vagrant-lxc base box specific configuration" >> ${LXC_PATH}/config
+    cat ${LXC_CONFIG} >> ${LXC_PATH}/config
+fi
 
 # Empty section for lxc.customize calls from vagrantfile
 echo "" >> ${LXC_PATH}/config

scripts/pipework

@@ -390,7 +390,7 @@ else
       ;;
     "")
       if installed ipcalc; then
-        eval $(ipcalc -b $IPADDR)
+        eval "$(ipcalc -b $IPADDR)"
         ip netns exec "$NSPID" ip addr add "$IPADDR" brd "$BROADCAST" dev "$CONTAINER_IFNAME"
       else
         ip netns exec "$NSPID" ip addr add "$IPADDR" dev "$CONTAINER_IFNAME"

spec/Vagrantfile

@@ -15,10 +15,6 @@ Vagrant.configure("2") do |config|
 
   config.cache.auto_detect = true
 
-  config.vm.provider :lxc do |lxc|
-    # lxc.sudo_wrapper = '/usr/bin/lxc-vagrant-wrapper'
-  end
-
   config.vm.provision :shell,
     inline: 'mkdir -p /vagrant/tmp && echo -n "Provisioned" > /vagrant/tmp/provisioning'
 

spec/unit/action/forward_ports_spec.rb

@@ -24,6 +24,7 @@ describe Vagrant::LXC::Action::ForwardPorts do
     machine.stub_chain(:config, :vm, :networks).and_return(networks)
     machine.stub(provider: provider, data_dir: data_dir)
 
+    subject.stub(redir_version: 3)
     subject.stub(exec: true)
     subject.stub(spawn: pid)
   end
@@ -34,7 +35,7 @@ describe Vagrant::LXC::Action::ForwardPorts do
     subject.stub(system: true)
     subject.call(env)
     expect(subject).to have_received(:spawn).with(
-      "redir --laddr=#{host_ip} --lport=#{host_port} --caddr=#{container_ip} --cport=#{guest_port} 2>/dev/null"
+      "redir -n #{host_ip}:#{host_port} #{container_ip}:#{guest_port} 2>/dev/null"
     )
   end
 
@@ -43,7 +44,7 @@ describe Vagrant::LXC::Action::ForwardPorts do
     subject.stub(system: true)
     subject.call(env)
     expect(subject).to have_received(:spawn).with(
-      "redir --laddr=127.0.0.1 --lport=#{host_port} --caddr=#{container_ip} --cport=#{guest_port} 2>/dev/null"
+      "redir -n 127.0.0.1:#{host_port} #{container_ip}:#{guest_port} 2>/dev/null"
     )
   end
 
@@ -52,7 +53,7 @@ describe Vagrant::LXC::Action::ForwardPorts do
     subject.stub(system: true)
     subject.call(env)
     expect(subject).to have_received(:spawn).with(
-      "redir --laddr=127.0.0.1 --lport=#{host_port} --caddr=#{container_ip} --cport=#{guest_port} 2>/dev/null"
+      "redir -n 127.0.0.1:#{host_port} #{container_ip}:#{guest_port} 2>/dev/null"
     )
   end
 
@@ -70,6 +71,15 @@ describe Vagrant::LXC::Action::ForwardPorts do
     expect(subject).not_to have_received(:spawn)
   end
 
+  it 'uses redir 2.x command line interface' do
+    subject.stub(system: true)
+    subject.stub(redir_version: 2)
+    subject.call(env)
+    expect(subject).to have_received(:spawn).with(
+      "redir --laddr=#{host_ip} --lport=#{host_port} --caddr=#{container_ip} --cport=#{guest_port} 2>/dev/null"
+    )
+  end
+
   it 'raises RedirNotInstalled error if `redir` is not installed' do
     subject.stub(system: false)
     expect { subject.call(env) }.to raise_error(Vagrant::LXC::Errors::RedirNotInstalled)
@@ -82,7 +92,7 @@ describe Vagrant::LXC::Action::ForwardPorts do
       subject.stub(system: true)
       subject.call(env)
       expect(subject).to have_received(:spawn).with(
-        "sudo redir --laddr=#{host_ip} --lport=#{host_port} --caddr=#{container_ip} --cport=#{guest_port} 2>/dev/null"
+        "sudo redir -n #{host_ip}:#{host_port} #{container_ip}:#{guest_port} 2>/dev/null"
       )
     end
 
@@ -91,7 +101,7 @@ describe Vagrant::LXC::Action::ForwardPorts do
       subject.stub(system: true)
       subject.call(env)
       expect(subject).to have_received(:spawn).with(
-        "sudo redir --laddr=127.0.0.1 --lport=#{host_port} --caddr=#{container_ip} --cport=#{guest_port} 2>/dev/null"
+        "sudo redir -n 127.0.0.1:#{host_port} #{container_ip}:#{guest_port} 2>/dev/null"
       )
     end
 
@@ -100,7 +110,7 @@ describe Vagrant::LXC::Action::ForwardPorts do
       subject.stub(system: true)
       subject.call(env)
       expect(subject).to have_received(:spawn).with(
-        "sudo redir --laddr=127.0.0.1 --lport=#{host_port} --caddr=#{container_ip} --cport=#{guest_port} 2>/dev/null"
+        "sudo redir -n 127.0.0.1:#{host_port} #{container_ip}:#{guest_port} 2>/dev/null"
       )
     end
   end

spec/unit/driver/cli_spec.rb

@@ -30,16 +30,7 @@ describe Vagrant::LXC::Driver::CLI do
 
   describe 'version' do
     before do
-      allow(subject).to receive(:support_version_command?).and_return(true)
+      allow(subject).to receive(:run).with(:create, '--version').and_return(lxc_version_out)
-      allow(subject).to receive(:run).with(:version).and_return(lxc_version_out)
-    end
-
-    describe 'lxc version before 1.x.x' do
-      let(:lxc_version_out) { "lxc version:  0.x.y-rc1\n" }
-
-      it 'parses the version from the output' do
-        expect(subject.version).to eq('0.x.y-rc1')
-      end
     end
 
     describe 'lxc version after 1.x.x' do
@@ -53,24 +44,11 @@ describe Vagrant::LXC::Driver::CLI do
 
   describe 'config' do
     before do
-      allow(subject).to receive(:support_version_command?).and_return(support_version_command?)
       allow(subject).to receive(:run).with(:config, 'lxc.lxcpath').and_return(lxc_config_out)
-      allow(subject).to receive(:run).with(:version).and_return(lxc_version_out)
       allow(subject).to receive(:run).with(:create, '--version').and_return(lxc_version_out)
     end
 
-    describe 'lxc version before 1.x.x' do
+    describe 'lxc version after 1.x.x'do
-      let(:support_version_command?) { true }
-      let(:lxc_config_out)           { "/var/lib/lxc\n" }
-      let(:lxc_version_out)          { "lxc version:  0.x.y-rc1\n" }
-
-      it 'not supported' do
-        expect{subject.config('lxc.lxcpath')}.to raise_error(Vagrant::LXC::Errors::CommandNotSupported)
-      end
-    end
-
-    describe 'lxc version before after 1.x.x'do
-      let(:support_version_command?) { false }
       let(:lxc_config_out)           { "/var/lib/lxc\n" }
       let(:lxc_version_out)          { "1.0.0\n" }
 
@@ -156,36 +134,11 @@ describe Vagrant::LXC::Driver::CLI do
 
     before do
       allow(subject).to receive(:run)
+      subject.stop
     end
 
-    context 'lxc-attach is supported' do
+    it 'issues a lxc-stop with provided container name' do
-      before do
+      expect(subject).to have_received(:run).with(:stop, '--name', name)
-        subject.stub(attach: true, supports_attach?: true)
-        subject.stop
-      end
-
-      it 'runs a /sbin/halt within the container' do
-        expect(subject).to have_received(:attach).with('/sbin/halt')
-      end
-
-      it 'issues a lxc-stop with provided container name' do
-        expect(subject).to have_received(:run).with(:stop, '--name', name)
-      end
-    end
-
-    context 'lxc-attach is not supported' do
-      before do
-        subject.stub(attach: false, supports_attach?: false)
-        subject.stop
-      end
-
-      it 'runs a /sbin/halt within the container' do
-        expect(subject).to_not have_received(:attach)
-      end
-
-      it 'issues a lxc-stop with provided container name' do
-        expect(subject).to have_received(:run).with(:stop, '--name', name)
-      end
     end
   end
 
@@ -232,13 +185,6 @@ describe Vagrant::LXC::Driver::CLI do
       subject.attach *(command + [{namespaces: ['network', 'mount']}])
       expect(subject).to have_received(:run).with(:attach, '--name', name, '--namespaces', 'NETWORK|MOUNT', '--', *command)
     end
-
-    it 'raises a NamespacesNotSupported error if not supported' do
-      allow(subject).to receive(:run).with(:attach, '-h', :show_stderr => true).and_return({:stdout => '', :stderr => 'not supported'})
-      expect {
-        subject.attach *(command + [{namespaces: ['network', 'mount']}])
-      }.to raise_error(Vagrant::LXC::Errors::NamespacesNotSupported)
-    end
   end
 
   describe 'transition block' do
@@ -260,33 +206,4 @@ describe Vagrant::LXC::Driver::CLI do
 
     skip 'waits for the expected container state'
   end
-
-  describe 'check for whether lxc-attach is supported' do
-    let(:name) { 'a-running-container' }
-    subject    { described_class.new(sudo_wrapper, name) }
-
-    context 'lxc-attach is present on system' do
-      before { subject.stub(run: true) }
-
-      it 'returns true if `lxc-attach --name CNAME -- /bin/true` works' do
-        expect(subject.supports_attach?).to be_truthy
-        expect(subject).to have_received(:run).with(
-          :attach, '--name', name, '--', '/bin/true'
-        )
-      end
-    end
-
-    context 'lxc-attach is not present on system' do
-      before do
-        allow(subject).to receive(:run).and_raise(Vagrant::LXC::Errors::ExecuteError.new('msg'))
-      end
-
-      it 'returns true if `lxc-attach --name CNAME -- /bin/true` works' do
-        expect(subject.supports_attach?).to be_falsy
-        expect(subject).to have_received(:run).with(
-          :attach, '--name', name, '--', '/bin/true'
-        )
-      end
-    end
-  end
 end

spec/unit/driver_spec.rb

@@ -75,21 +75,10 @@ describe Vagrant::LXC::Driver do
     end
   end
 
-  describe 'supports_attach?' do
-    let(:cli) { double(Vagrant::LXC::Driver::CLI, supports_attach?: true) }
-
-    subject { described_class.new('name', nil, cli) }
-
-    it 'delegates to cli object' do
-      expect(subject.supports_attach?).to be_truthy
-      expect(cli).to have_received(:supports_attach?)
-    end
-  end
-
   describe 'start' do
     let(:customizations)         { [['a', '1'], ['b', '2']] }
     let(:internal_customization) { ['internal', 'customization'] }
-    let(:cli)                    { double(Vagrant::LXC::Driver::CLI, start: true, support_config_command?: false) }
+    let(:cli)                    { double(Vagrant::LXC::Driver::CLI, start: true) }
     let(:sudo)                   { double(Vagrant::LXC::SudoWrapper) }
 
     subject { described_class.new('name', sudo, cli) }
@@ -99,6 +88,7 @@ describe Vagrant::LXC::Driver do
         and_return('# CONFIGURATION')
       sudo.should_receive(:run).twice.with('cp', '-f', %r{/(run|tmp)/.*}, '/var/lib/lxc/name/config')
       sudo.should_receive(:run).twice.with('chown', 'root:root', '/var/lib/lxc/name/config')
+      expect(cli).to receive(:config).with("lxc.lxcpath").and_return("/var/lib/lxc")
 
       subject.customizations << internal_customization
       subject.start(customizations)
@@ -152,21 +142,11 @@ describe Vagrant::LXC::Driver do
   end
 
   describe 'containers_path' do
-    let(:cli) { double(Vagrant::LXC::Driver::CLI, config: cli_config_value, support_config_command?: cli_support_config_command_value) }
+    let(:cli) { double(Vagrant::LXC::Driver::CLI, config: cli_config_value) }
 
     subject { described_class.new('name', nil, cli) }
 
-    describe 'lxc version before 1.x.x' do
-      let(:cli_support_config_command_value) { false }
-      let(:cli_config_value)                 { '/var/lib/lxc' }
-
-      it 'delegates to cli' do
-        expect(subject.containers_path).to eq(cli_config_value)
-      end
-    end
-
     describe 'lxc version after 1.x.x' do
-      let(:cli_support_config_command_value) { true }
       let(:cli_config_value)                 { '/etc/lxc' }
 
       it 'delegates to cli' do
@@ -220,9 +200,9 @@ describe Vagrant::LXC::Driver do
           # Blah blah comment
           lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
           lxc.mount.entry = sysfs sys sysfs defaults  0 0
-          lxc.tty = 4
+          lxc.tty.max = 4
-          lxc.pts = 1024
+          lxc.pty.max = 1024
-          lxc.rootfs = #{rootfs_path}
+          lxc.rootfs.path = #{rootfs_path}
           # VAGRANT-BEGIN
           lxc.network.type=veth
           lxc.network.name=eth1
@@ -250,9 +230,9 @@ describe Vagrant::LXC::Driver do
           # Blah blah comment
           lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
           lxc.mount.entry = sysfs sys sysfs defaults  0 0
-          lxc.tty = 4
+          lxc.tty.max = 4
-          lxc.pts = 1024
+          lxc.pty.max = 1024
-          lxc.rootfs = overlayfs:/path/to/master/directory:#{rootfs_path}
+          lxc.rootfs.path = overlayfs:/path/to/master/directory:#{rootfs_path}
           # VAGRANT-BEGIN
           lxc.network.type=veth
           lxc.network.name=eth1

templates/sudoers.rb.erb

@@ -78,7 +78,7 @@ class Whitelist
   end
 end
 
-base = "/var/lib/lxc"
+base = "<%= lxc_base_path %>"
 base_path = %r{\A#{base}/.*\z}
 
 ##
@@ -109,6 +109,7 @@ Whitelist.add_regex %r{<%= pipework_regex %>}, '**'
 Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-version'
 Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-ls'
 Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-info', '--name', /.*/
+Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-info', '--name', /.*/, '-iH'
 Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-create', '-B', /.*/, '--template', /.*/, '--name', /.*/, '**'
 Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-create', '--version'
 Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-destroy', '--name', /.*/
@@ -118,6 +119,7 @@ Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-shutdown', '--name', /.*/
 Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-attach', '--name', /.*/, '**'
 Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-attach', '-h'
 Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-config', 'lxc.lxcpath'
+Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-update-config', '-c', /.*/
 
 ##
 # Commands from driver/action/remove_temporary_files.rb