Out of the box on Ubuntu oneiric, lxc-checkconfig produces the current output:
ubuntu@panda4:~$ lxc-checkconfig
--- Namespaces ---
Namespaces: enabled
Utsname namespace: enabled
Ipc namespace: enabled
Pid namespace: enabled
User namespace: enabled
Network namespace: enabled
Multiple /dev/pts instances: enabled
--- Control groups ---
Cgroup: enabled
Cgroup namespace: required
Cgroup device: enabled
Cgroup sched: enabled
Cgroup cpu account: enabled
Cgroup memory controller: enabled
Cgroup cpuset: enabled
--- Misc ---
Veth pair device: enabled
Macvlan: enabled
Vlan: enabled
File capabilities: missing
enabled
Note that cgroup_ns says 'Required'. cgroup_ns was replaced with clone_children (which is a mount option for cgroup lines; if this is done, then that line changes to clone_children is available).
Regardless of this 'Required' item being around, lxc-* still works, and you can still create and start instances. It appears that even though namespaces are unavailable. This suggests that LXC will run without warning even if full cgroup isolation is unavailable.
As part of the move to 3.0, we need to make it so LXC uses the clone_children as a replacement for cgroup_ns, and understand why LXC works without namespace support, and the security implications of this ...
Thanks for taking the time to submit this bug.
LXC will not run without warning if full cgroup isolation is unvailable - if that were the case this woudl be high priority, but it isn't so II'm changing the priority of this to wishlist.
The clone_children flag gets set by lxc at lxc-start. If clone_children were not available (by the kernel) then it would fail to start the containers.
The bug then, which is present but is wishlist priority, is that lxc-checklist reports ns cgroup as Required when it isn't. It should report whether either ns cgroup is available or cgroup.