gentoo resync : 14.07.2018

13 files changed, 978 insertions, 0 deletions

diff --git a/app-emulation/lxc/Manifest b/app-emulation/lxc/Manifest
new file mode 100644
index 000000000000..b9ce1e275878
--- /dev/null
+++ b/app-emulation/lxc/Manifest
@@ -0,0 +1,15 @@
+AUX lxc-2.0.5-omit-sysconfig.patch 259 BLAKE2B 977e151fbb8c9d98e89aaa5ee0426e64ab4286b4440af1582086a0ced8c6568efb470ccf68786da6ea52c82d1f4e81feac45bec411febc04fc31d108f05ccde2 SHA512 0aed9aca687accc6df79e97f48ab333043256e8ae68c8643f2b2452cc8013191238867d64ec71f7d399c59a43d3ba698b35d965090c5cb149b4f41302432e6e7
+AUX lxc-2.0.6-bash-completion.patch 919 BLAKE2B a364398ad6fe44213ba1097e961813d4cbc71efbaf25f90a44201dc95151b7676dbe1c086b3a34fb38ffb9ef2a5ebb25f9885e809c11ec1b1e9a6516f48a3ae1 SHA512 caa90c8bad2a79b4e42b781f00d6f2a7be37fc5c5301592b026c88db2652c90871be940c86a9156f03bc186f76cf2068a2d3084e9abc7a5896ea081885085d41
+AUX lxc-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch 5145 BLAKE2B 5e4c73811b6f912cc721606603ba69b225655c343eb51ecec7110e8bc477ddd08704aa4b892203cfe539c441cc7437959606e0a196ec26e313859253d088c007 SHA512 49494eb1a7d21c3755a5301cc3bec75832588ba9bd598f0d40be90b84426332567c6b525ca089b77a92629b953b89f42a2e4ed2834e5a125e6079a35e1a17a04
+AUX lxc-2.1.1-fix-cgroup2-detection.patch 856 BLAKE2B e877e8a968d059c2034a2b5c23946241a6b45172f893e313bff30a7f798e3b1440e5a1e8ee277816308fb509901b52584a44021a156a91671e299964dd69b1bd SHA512 eb0fc8dee5a59d1641e8b3024bf79be2273aa15131fd7eaee98d80585c39ddb93d8d9cfe98c7f866ab2461fe8c6c7e3c038ec1a1263a6f9b02ed323a267b87f2
+AUX lxc-3.0.0-bash-completion.patch 915 BLAKE2B 8bb879e391cec349d211b47d321c64ea091c8475ac9a8c4adfb45918c044f6c49d9b9bce546082907d696f697baf0870893c4427abeafa496db89f99190cd091 SHA512 2f3728fcf5e88eecc1ae05bf038ef83baa375194c5bef0d0ef68feaf4d8092cdd8efef6b3c27207c4abd28b085f087af517242c65747b47d0a8fa840f6b9d279
+AUX lxc.initd.7 3468 BLAKE2B 37b0d044594f1c66631f991315e49c4ceea4640bf6c459e6bba713fb76ef9a8ee1fcbc49da68bd0f1e2929cf9904e0113a3b321166f7c3d360fcebeab6665e5a SHA512 c5841cff7d8b58d4283a26719e8a5db1be2c4add0f31065393b863b6626460180d91632106bc50cde4d3e74ae46a57d581fa1f01140dfa95522aba12277f9eaa
+AUX lxc_at.service 232 BLAKE2B 12dd7142330cbaeda69d5f4c6ef14dae6ab435d2668e4a3279d8d54dac05f54a877afdc1705aa5a18db1855d6bcf68518f86431aa5105058598e97604fe00133 SHA512 4c3bab4f2cc9aea8b0753dcaf2fd7ed5f1cd7d97d286d6204b2fc17505b6edaac2f536bbda5c1466856311d0e93d75de91dec51e9b0f665d67afedbf40c19170
+AUX lxc_at.service.4 265 BLAKE2B 4454528e69a5c986c23c0c4ccc10ebe03a0650e47cd30208355d2f4a70a4cb46392473eccddd736988f1b72954948876601aaf99977d8e6014a7c774a416160f SHA512 d61e7103e90e6ffb3202533e7d7555d8c02b943f06ec6c0d673713c1c0ede58641312c65d6dd6a15907c1171522e6148c2313d7b11acbd85d59fe65758cd52b3
+DIST lxc-2.1.1.tar.gz 1378640 BLAKE2B 5fca516540a886729434579ff99acf3baa06977fa0e0b6f24dbf15094626335fc073597d308276e3dd20e27ceabf1477cc8e99d1fd24cf50b9aed2720b887b69 SHA512 2989d57acddfe091adcf8031721c3c9a2f8eff5476bd6155366b76ea7511e0f6120e669276e056e3963863e0f0acf3b095d44c36fa6652e67c197671f28cbdd4
+DIST lxc-3.0.0.tar.gz 1233316 BLAKE2B ba726a07f48b1d32366012c8d885a853e33f88d8c45c910b061d9deecf472d940f7d45a1e742c8194517ba3231e1875a49bbf303b2c3fd2c9ece33b941670bb7 SHA512 21372e6fe4d38e2cf54707fab4133137793deff1dd500ed7ed02c03bbaa809de56c7490971594cddbdcb2b96f0c03ab5dfb43a8582a584598a12c5943b7ca490
+DIST lxc-3.0.1.tar.gz 1239920 BLAKE2B 7be668c11d7211540fe7e2fb6318d38eac0d8d493914f4705d097fca4c004a8d2191609d02bd9e1d9204c3c0b9ea937084d3f9050fc841f6d777768067af3d19 SHA512 f51b0844f61f64d4efc530454eae1fa499f7f1b908bd3b40d7031e7f311a402893a7504bddbc53f2ef9da2b3154d1b047fc4d876b99f0d487d7c79de64eea505
+EBUILD lxc-2.1.1.ebuild 6763 BLAKE2B a4d6e09451ebb728147e1ebeca98292422472040eea4a7664e8659d2d00774933b16e264b2af3a0ad6a90750586369a02cc6149959bb3a218a528f4f8f0aa773 SHA512 e5838b9a63d096284905d3f000c268a6c398835c2054c2d0bb92e3e6ed2d0b3aaeb2a417d2c04b8182ced7447a47fa9e1340e89f92d0fd6dd48238544684a727
+EBUILD lxc-3.0.0.ebuild 5546 BLAKE2B dbb5955ff8aa1a3de063548c6447f90d4f050ab08fe252662d5eaf29a64336660d40108aab32bcdf19d250d118c7ea39e7b3b567aea19aaa6ca942711874eb52 SHA512 395ae0dff135e503d20cdeb65782b67510c1fed00e21d88b00ebfd76457ae7506dd66d77ce7ad142b32c57de7faa074a807f486cdd6519197cec3c22093272ae
+EBUILD lxc-3.0.1.ebuild 5139 BLAKE2B 680faa18d1cc190114b57463edbef7a6d74a3656c5a8189212b39245243299dbd64832163de7505629c77914b7526b6bee8cae16a9ad22e8bad27d040b6a8abb SHA512 75ac0fc7c240581991ea7b27b3aa3bc31f08861cca2cd715e4c44397451c1df2ebf969133fd3b805e9a71cf756b2bd6101cfd96070708543be611719d5b1f271
+MISC metadata.xml 670 BLAKE2B 1318dc9a17178a46375589bcc92685e1a49146cd7384e36d996e675875a55c8402e2a037546dadd2ce1399557b77366f03179d8ef51cdbe106e9b27c3f3dbff9 SHA512 c1d3d15e52953b8dcd280c90d73467258cdf41d6f6505f231c0c031f40b0a467147798651bb327b498dd4ac694783441896584941a0c05d34e45af8dc9c6db70
diff --git a/app-emulation/lxc/files/lxc-2.0.5-omit-sysconfig.patch b/app-emulation/lxc/files/lxc-2.0.5-omit-sysconfig.patch
new file mode 100644
index 000000000000..3ec81356499e
--- /dev/null
+++ b/app-emulation/lxc/files/lxc-2.0.5-omit-sysconfig.patch
@@ -0,0 +1,5 @@
+--- /config/Makefile.am.orig	2016-05-19 02:56:11.891113982 +0000
++++ /config/Makefile.am	2016-05-19 02:56:32.596115476 +0000
+@@ -1 +1 @@
+-SUBDIRS = apparmor bash etc init selinux templates yum sysconfig
++SUBDIRS = apparmor bash etc init selinux templates yum
diff --git a/app-emulation/lxc/files/lxc-2.0.6-bash-completion.patch b/app-emulation/lxc/files/lxc-2.0.6-bash-completion.patch
new file mode 100644
index 000000000000..6033e36c7985
--- /dev/null
+++ b/app-emulation/lxc/files/lxc-2.0.6-bash-completion.patch
@@ -0,0 +1,27 @@
+diff --git a/config/bash/lxc.in b/config/bash/lxc.in
+index 7dcf302..5927fe2 100644
+--- a/config/bash/lxc.in
++++ b/config/bash/lxc.in
+@@ -1,4 +1,3 @@
+-_have lxc-start && {
+     _lxc_names() {
+         COMPREPLY=( $( compgen -W "$( lxc-ls )" "$cur" ) )
+     }
+@@ -100,4 +99,3 @@ _have lxc-start && {
+ 
+     complete -o default -F _lxc_generic_o lxc-copy
+     complete -o default -F _lxc_generic_o lxc-start-ephemeral
+-}
+diff --git a/configure.ac b/configure.ac
+index 4640c0d..14ccdd3 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -478,7 +478,7 @@ AM_CONDITIONAL([ENABLE_BASH], [test "x$enable_bash" = "xyes"])
+ AM_COND_IF([ENABLE_BASH],
+ 	[AC_MSG_CHECKING([bash completion directory])
+ 	PKG_CHECK_VAR(bashcompdir, [bash-completion], [completionsdir], ,
+-		bashcompdir="${sysconfdir}/bash_completion.d")
++		bashcompdir="$datadir/bash-completion/completions")
+ 	AC_MSG_RESULT([$bashcompdir])
+ 	AC_SUBST(bashcompdir)
+ 	])
diff --git a/app-emulation/lxc/files/lxc-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch b/app-emulation/lxc/files/lxc-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch
new file mode 100644
index 000000000000..8493491d0d65
--- /dev/null
+++ b/app-emulation/lxc/files/lxc-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch
@@ -0,0 +1,164 @@
+From b635e92d21d2a4d71a553388f18cfa08f44bf1ba Mon Sep 17 00:00:00 2001
+From: Christian Brauner <christian.brauner@ubuntu.com>
+Date: Mon, 30 Oct 2017 14:16:46 +0100
+Subject: [PATCH] cgroups: enable container without CAP_SYS_ADMIN
+
+In case cgroup namespaces are supported but we do not have CAP_SYS_ADMIN we
+need to mount cgroups for the container. This patch enables both privileged and
+unprivileged containers without CAP_SYS_ADMIN.
+
+Closes #1737.
+
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+---
+ src/lxc/cgroups/cgfs.c   |  3 ++-
+ src/lxc/cgroups/cgfsng.c | 52 +++++++++++++++++++++++++++++++++++++++++++++---
+ src/lxc/cgroups/cgroup.c |  2 +-
+ src/lxc/conf.c           |  3 ---
+ src/lxc/conf.h           |  1 +
+ 5 files changed, 53 insertions(+), 8 deletions(-)
+
+diff --git a/src/lxc/cgroups/cgfs.c b/src/lxc/cgroups/cgfs.c
+index bcbd6613..efd627f0 100644
+--- a/src/lxc/cgroups/cgfs.c
++++ b/src/lxc/cgroups/cgfs.c
+@@ -1418,11 +1418,12 @@ static bool cgroupfs_mount_cgroup(void *hdata, const char *root, int type)
+ 	struct cgfs_data *cgfs_d;
+ 	struct cgroup_process_info *info, *base_info;
+ 	int r, saved_errno = 0;
++	struct lxc_handler *handler = hdata;
+ 
+ 	if (cgns_supported())
+ 		return true;
+ 
+-	cgfs_d = hdata;
++	cgfs_d = handler->cgroup_data;
+ 	if (!cgfs_d)
+ 		return false;
+ 	base_info = cgfs_d->info;
+diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
+index e43edd7d..ec6440c1 100644
+--- a/src/lxc/cgroups/cgfsng.c
++++ b/src/lxc/cgroups/cgfsng.c
+@@ -50,6 +50,7 @@
+ #include <linux/types.h>
+ #include <linux/kdev_t.h>
+ 
++#include "caps.h"
+ #include "cgroup.h"
+ #include "cgroup_utils.h"
+ #include "commands.h"
+@@ -1616,17 +1617,49 @@ do_secondstage_mounts_if_needed(int type, struct hierarchy *h,
+ 	return 0;
+ }
+ 
++static int mount_cgroup_cgns_supported(struct hierarchy *h, const char *controllerpath)
++{
++	 int ret;
++	 char *controllers = NULL;
++	 char *type = "cgroup2";
++
++	if (!h->is_cgroup_v2) {
++		controllers = lxc_string_join(",", (const char **)h->controllers, false);
++		if (!controllers)
++			return -ENOMEM;
++		type = "cgroup";
++	}
++
++	ret = mount("cgroup", controllerpath, type, MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RELATIME, controllers);
++	free(controllers);
++	if (ret < 0) {
++		SYSERROR("Failed to mount %s with cgroup filesystem type %s", controllerpath, type);
++		return -1;
++	}
++
++	DEBUG("Mounted %s with cgroup filesystem type %s", controllerpath, type);
++	return 0;
++}
++
+ static bool cgfsng_mount(void *hdata, const char *root, int type)
+ {
+-	struct cgfsng_handler_data *d = hdata;
++	int i;
+ 	char *tmpfspath = NULL;
+ 	bool retval = false;
+-	int i;
++	struct lxc_handler *handler = hdata;
++	struct cgfsng_handler_data *d = handler->cgroup_data;
++	bool has_cgns = false, has_sys_admin = true;
+ 
+ 	if ((type & LXC_AUTO_CGROUP_MASK) == 0)
+ 		return true;
+ 
+-	if (cgns_supported())
++	has_cgns = cgns_supported();
++	if (!lxc_list_empty(&handler->conf->keepcaps))
++		has_sys_admin = in_caplist(CAP_SYS_ADMIN, &handler->conf->keepcaps);
++	else
++		has_sys_admin = !in_caplist(CAP_SYS_ADMIN, &handler->conf->caps);
++
++	if (has_cgns && has_sys_admin)
+ 		return true;
+ 
+ 	tmpfspath = must_make_path(root, "/sys/fs/cgroup", NULL);
+@@ -1662,6 +1695,19 @@ static bool cgfsng_mount(void *hdata, const char *root, int type)
+ 			free(controllerpath);
+ 			goto bad;
+ 		}
++
++		if (has_cgns && !has_sys_admin) {
++			/* If cgroup namespaces are supported but the container
++			 * will not have CAP_SYS_ADMIN after it has started we
++			 * need to mount the cgroups manually.
++			 */
++			r = mount_cgroup_cgns_supported(h, controllerpath);
++			free(controllerpath);
++			if (r < 0)
++				goto bad;
++			continue;
++		}
++
+ 		if (mount_cgroup_full(type, h, controllerpath, d->container_cgroup) < 0) {
+ 			free(controllerpath);
+ 			goto bad;
+diff --git a/src/lxc/cgroups/cgroup.c b/src/lxc/cgroups/cgroup.c
+index 674e3090..36a665b1 100644
+--- a/src/lxc/cgroups/cgroup.c
++++ b/src/lxc/cgroups/cgroup.c
+@@ -166,7 +166,7 @@ bool cgroup_chown(struct lxc_handler *handler)
+ bool cgroup_mount(const char *root, struct lxc_handler *handler, int type)
+ {
+ 	if (ops)
+-		return ops->mount_cgroup(handler->cgroup_data, root, type);
++		return ops->mount_cgroup(handler, root, type);
+ 
+ 	return false;
+ }
+diff --git a/src/lxc/conf.c b/src/lxc/conf.c
+index d2fab945..44d97843 100644
+--- a/src/lxc/conf.c
++++ b/src/lxc/conf.c
+@@ -210,9 +210,6 @@ __thread struct lxc_conf *current_config;
+ struct lxc_conf *current_config;
+ #endif
+ 
+-/* Declare this here, since we don't want to reshuffle the whole file. */
+-static int in_caplist(int cap, struct lxc_list *caps);
+-
+ static struct mount_opt mount_opt[] = {
+ 	{ "async",         1, MS_SYNCHRONOUS },
+ 	{ "atime",         1, MS_NOATIME     },
+diff --git a/src/lxc/conf.h b/src/lxc/conf.h
+index c61f861e..63e71e2d 100644
+--- a/src/lxc/conf.h
++++ b/src/lxc/conf.h
+@@ -402,5 +402,6 @@ extern unsigned long add_required_remount_flags(const char *s, const char *d,
+ 						unsigned long flags);
+ extern int run_script(const char *name, const char *section, const char *script,
+ 		      ...);
++extern int in_caplist(int cap, struct lxc_list *caps);
+ 
+ #endif /* __LXC_CONF_H */
+-- 
+2.13.6
+
diff --git a/app-emulation/lxc/files/lxc-2.1.1-fix-cgroup2-detection.patch b/app-emulation/lxc/files/lxc-2.1.1-fix-cgroup2-detection.patch
new file mode 100644
index 000000000000..c16d28ac3033
--- /dev/null
+++ b/app-emulation/lxc/files/lxc-2.1.1-fix-cgroup2-detection.patch
@@ -0,0 +1,26 @@
+From cdfe90a49f516b0f1210d181980f14a4765e10da Mon Sep 17 00:00:00 2001
+From: Christian Brauner <christian.brauner@ubuntu.com>
+Date: Mon, 30 Oct 2017 14:17:20 +0100
+Subject: [PATCH] cgfsng: fix cgroup2 detection
+
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+---
+ src/lxc/cgroups/cgfsng.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
+index 897336f0..e43edd7d 100644
+--- a/src/lxc/cgroups/cgfsng.c
++++ b/src/lxc/cgroups/cgfsng.c
+@@ -815,7 +815,7 @@ static void add_controller(char **clist, char *mountpoint, char *base_cgroup)
+ 	new->fullcgpath = NULL;
+ 
+ 	/* record if this is the cgroup v2 hierarchy */
+-	if (!strcmp(base_cgroup, "cgroup2"))
++	if (clist && !strcmp(*clist, "cgroup2"))
+ 		new->is_cgroup_v2 = true;
+ 	else
+ 		new->is_cgroup_v2 = false;
+-- 
+2.13.6
+
diff --git a/app-emulation/lxc/files/lxc-3.0.0-bash-completion.patch b/app-emulation/lxc/files/lxc-3.0.0-bash-completion.patch
new file mode 100644
index 000000000000..2a08eedb1c2d
--- /dev/null
+++ b/app-emulation/lxc/files/lxc-3.0.0-bash-completion.patch
@@ -0,0 +1,27 @@
+diff --git a/config/bash/lxc.in b/config/bash/lxc.in
+index 43056882..0a22d4ad 100644
+--- a/config/bash/lxc.in
++++ b/config/bash/lxc.in
+@@ -1,4 +1,3 @@
+-_have lxc-start && {
+     _lxc_names() {
+         COMPREPLY=( $( compgen -W "$( lxc-ls )" "$cur" ) )
+     }
+@@ -108,4 +107,3 @@ _have lxc-start && {
+     complete -o default -F _lxc_generic_t lxc-create
+ 
+     complete -o default -F _lxc_generic_o lxc-copy
+-}
+diff --git a/configure.ac b/configure.ac
+index 50c99836..0569caec 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -395,7 +395,7 @@ AM_CONDITIONAL([ENABLE_BASH], [test "x$enable_bash" = "xyes"])
+ AM_COND_IF([ENABLE_BASH],
+ 	[AC_MSG_CHECKING([bash completion directory])
+ 	PKG_CHECK_VAR(bashcompdir, [bash-completion], [completionsdir], ,
+-		bashcompdir="${sysconfdir}/bash_completion.d")
++		bashcompdir="$datadir/bash-completion/completions")
+ 	AC_MSG_RESULT([$bashcompdir])
+ 	AC_SUBST(bashcompdir)
+ 	])
diff --git a/app-emulation/lxc/files/lxc.initd.7 b/app-emulation/lxc/files/lxc.initd.7
new file mode 100644
index 000000000000..6a42b6aac520
--- /dev/null
+++ b/app-emulation/lxc/files/lxc.initd.7
@@ -0,0 +1,124 @@
+#!/sbin/openrc-run
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+CONTAINER=${SVCNAME#*.}
+
+LXC_PATH=`lxc-config lxc.lxcpath`
+
+lxc_get_configfile() {
+	if [ -f "${LXC_PATH}/${CONTAINER}.conf" ]; then
+		echo "${LXC_PATH}/${CONTAINER}.conf"
+	elif [ -f "${LXC_PATH}/${CONTAINER}/config" ]; then
+		echo "${LXC_PATH}/${CONTAINER}/config"
+	else
+		eerror "Unable to find a suitable configuration file."
+		eerror "If you set up the container in a non-standard"
+		eerror "location, please set the CONFIGFILE variable."
+		return 1
+	fi
+}
+
+[ $CONTAINER != $SVCNAME ] && CONFIGFILE=${CONFIGFILE:-$(lxc_get_configfile)}
+
+lxc_get_var() {
+	awk 'BEGIN { FS="[ \t]*=[ \t]*" } $1 == "'$1'" { print $2; exit }' ${CONFIGFILE}
+}
+
+lxc_get_net_link_type() {
+	awk 'BEGIN { FS="[ \t]*=[ \t]*"; _link=""; _type="" }
+		$1 == "lxc.network.type" {_type=$2;}
+		$1 == "lxc.network.link" {_link=$2;}
+		match($1, /lxc\.net\.[[:digit:]]+\.type/) {_type=$2;}
+		match($1, /lxc\.net\.[[:digit:]]+\.link/) {_link=$2;}
+		{if(_link != "" && _type != ""){
+			printf("%s:%s\n", _link, _type );
+			_link=""; _type="";
+		}; }' <${CONFIGFILE}
+}
+
+checkconfig() {
+	if [ ${CONTAINER} = ${SVCNAME} ]; then
+		eerror "You have to create an init script for each container:"
+		eerror " ln -s lxc /etc/init.d/lxc.container"
+		return 1
+	fi
+
+	# no need to output anything, the function takes care of that.
+	[ -z "${CONFIGFILE}" ] && return 1
+
+	utsname=$(lxc_get_var lxc.uts.name)
+	if [ -z "$utsname" ] ; then
+		utsname=$(lxc_get_var lxc.utsname)
+	fi
+
+	if [ "${CONTAINER}" != "${utsname}" ]; then
+	    eerror "You should use the same name for the service and the"
+	    eerror "container. Right now the container is called ${utsname}"
+	    return 1
+	fi
+}
+
+depend() {
+	# be quiet, since we have to run depend() also for the
+	# non-muxed init script, unfortunately.
+	checkconfig 2>/dev/null || return 0
+
+	config ${CONFIGFILE}
+	need localmount
+	use lxcfs
+
+	local _x _if
+	for _x in $(lxc_get_net_link_type); do
+		_if=${_x%:*}
+		case "${_x##*:}" in
+			# when the network type is set to phys, we can make use of a
+			# network service (for instance to set it up before we disable
+			# the net_admin capability), but we might also not set it up
+			# at all on the host and leave the net_admin capable service
+			# to take care of it.
+			phys)	use net.${_if} ;;
+			*)	need net.${_if} ;;
+		esac
+	done
+}
+
+start() {
+	checkconfig || return 1
+	rm -f /var/log/lxc/${CONTAINER}.log
+
+	rootpath=$(lxc_get_var lxc.rootfs)
+
+	# Check the format of our init and the chroot's init, to see
+	# if we have to use linux32 or linux64; always use setarch
+	# when required, as that makes it easier to deal with
+	# x32-based containers.
+	case $(scanelf -BF '%a#f' ${rootpath}/sbin/init) in
+		EM_X86_64)	setarch=linux64;;
+		EM_386)		setarch=linux32;;
+	esac
+
+	ebegin "Starting ${CONTAINER}"
+	env -i ${setarch} $(which lxc-start) -l WARN -n ${CONTAINER} -f ${CONFIGFILE} -d -o /var/log/lxc/${CONTAINER}.log
+	sleep 1
+
+	# lxc-start -d will _always_ report a correct startup, even if it
+	# failed, so rather than trust that, check that the cgroup exists.
+	[ -d /sys/fs/cgroup/cpuset/lxc/${CONTAINER} ]
+	eend $?
+}
+
+stop() {
+	checkconfig || return 1
+
+
+	if ! [ -d /sys/fs/cgroup/cpuset/lxc/${CONTAINER} ]; then
+	    ewarn "${CONTAINER} doesn't seem to be started."
+	    return 0
+	fi
+
+	# 10s should be enough to shut everything down
+	ebegin "Stopping ${CONTAINER}"
+	lxc-stop -t 10 -n ${CONTAINER}
+	eend $?
+}
diff --git a/app-emulation/lxc/files/lxc_at.service b/app-emulation/lxc/files/lxc_at.service
new file mode 100644
index 000000000000..1ef449775306
--- /dev/null
+++ b/app-emulation/lxc/files/lxc_at.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Linux Container %I
+After=network.target
+
+[Service]
+Restart=always
+ExecStart=/usr/sbin/lxc-start -n %i
+ExecReload=/usr/sbin/lxc-restart -n %i
+ExecStop=/usr/sbin/lxc-stop -n %i
+
+[Install]
+WantedBy=multi-user.target
diff --git a/app-emulation/lxc/files/lxc_at.service.4 b/app-emulation/lxc/files/lxc_at.service.4
new file mode 100644
index 000000000000..64ae7457096c
--- /dev/null
+++ b/app-emulation/lxc/files/lxc_at.service.4
@@ -0,0 +1,14 @@
+[Unit]
+Description=Linux Container %I
+After=network.target
+Wants=lxcfs.service
+
+[Service]
+Restart=always
+ExecStart=/usr/bin/lxc-start -n %i -F
+ExecReload=/usr/bin/lxc-restart -n %i
+ExecStop=/usr/bin/lxc-stop -n %i
+Delegate=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/app-emulation/lxc/lxc-2.1.1.ebuild b/app-emulation/lxc/lxc-2.1.1.ebuild
new file mode 100644
index 000000000000..a3c804d01763
--- /dev/null
+++ b/app-emulation/lxc/lxc-2.1.1.ebuild
@@ -0,0 +1,214 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+PYTHON_COMPAT=( python3_{4,5,6} )
+DISTUTILS_OPTIONAL=1
+
+inherit autotools bash-completion-r1 distutils-r1 linux-info versionator flag-o-matic systemd readme.gentoo-r1
+DESCRIPTION="LinuX Containers userspace utilities"
+HOMEPAGE="https://linuxcontainers.org/"
+SRC_URI="https://linuxcontainers.org/downloads/lxc/${P}.tar.gz"
+
+KEYWORDS="amd64 ~arm ~arm64 ppc64 x86"
+
+LICENSE="LGPL-3"
+SLOT="0"
+IUSE="cgmanager examples lua python seccomp selinux"
+
+RDEPEND="
+	net-libs/gnutls
+	sys-libs/libcap
+	cgmanager? ( app-admin/cgmanager )
+	lua? ( >=dev-lang/lua-5.1:= )
+	python? ( ${PYTHON_DEPS} )
+	seccomp? ( sys-libs/libseccomp )
+	selinux? ( sys-libs/libselinux )"
+
+DEPEND="${RDEPEND}
+	app-text/docbook-sgml-utils
+	>=sys-kernel/linux-headers-3.2"
+
+RDEPEND="${RDEPEND}
+	sys-apps/util-linux
+	app-misc/pax-utils
+	virtual/awk"
+
+CONFIG_CHECK="~CGROUPS ~CGROUP_DEVICE
+	~CPUSETS ~CGROUP_CPUACCT
+	~CGROUP_SCHED
+
+	~NAMESPACES
+	~IPC_NS ~USER_NS ~PID_NS
+
+	~NETLINK_DIAG ~PACKET_DIAG
+	~INET_UDP_DIAG ~INET_TCP_DIAG
+	~UNIX_DIAG ~CHECKPOINT_RESTORE
+
+	~CGROUP_FREEZER
+	~UTS_NS ~NET_NS
+	~VETH ~MACVLAN
+
+	~POSIX_MQUEUE
+	~!NETPRIO_CGROUP
+
+	~!GRKERNSEC_CHROOT_MOUNT
+	~!GRKERNSEC_CHROOT_DOUBLE
+	~!GRKERNSEC_CHROOT_PIVOT
+	~!GRKERNSEC_CHROOT_CHMOD
+	~!GRKERNSEC_CHROOT_CAPS
+	~!GRKERNSEC_PROC
+	~!GRKERNSEC_SYSFS_RESTRICT
+"
+
+ERROR_DEVPTS_MULTIPLE_INSTANCES="CONFIG_DEVPTS_MULTIPLE_INSTANCES:  needed for pts inside container"
+
+ERROR_CGROUP_FREEZER="CONFIG_CGROUP_FREEZER:  needed to freeze containers"
+
+ERROR_UTS_NS="CONFIG_UTS_NS:  needed to unshare hostnames and uname info"
+ERROR_NET_NS="CONFIG_NET_NS:  needed for unshared network"
+
+ERROR_VETH="CONFIG_VETH:  needed for internal (host-to-container) networking"
+ERROR_MACVLAN="CONFIG_MACVLAN:  needed for internal (inter-container) networking"
+
+ERROR_NETLINK_DIAG="CONFIG_NETLINK_DIAG:  needed for lxc-checkpoint"
+ERROR_PACKET_DIAG="CONFIG_PACKET_DIAG:  needed for lxc-checkpoint"
+ERROR_INET_UDP_DIAG="CONFIG_INET_UDP_DIAG:  needed for lxc-checkpoint"
+ERROR_INET_TCP_DIAG="CONFIG_INET_TCP_DIAG:  needed for lxc-checkpoint"
+ERROR_UNIX_DIAG="CONFIG_UNIX_DIAG:  needed for lxc-checkpoint"
+ERROR_CHECKPOINT_RESTORE="CONFIG_CHECKPOINT_RESTORE:  needed for lxc-checkpoint"
+
+ERROR_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE:  needed for lxc-execute command"
+
+ERROR_NETPRIO_CGROUP="CONFIG_NETPRIO_CGROUP:  as of kernel 3.3 and lxc 0.8.0_rc1 this causes LXCs to fail booting."
+
+ERROR_GRKERNSEC_CHROOT_MOUNT="CONFIG_GRKERNSEC_CHROOT_MOUNT:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_CHROOT_DOUBLE="CONFIG_GRKERNSEC_CHROOT_DOUBLE:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_CHROOT_PIVOT="CONFIG_GRKERNSEC_CHROOT_PIVOT:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_CHROOT_CHMOD="CONFIG_GRKERNSEC_CHROOT_CHMOD:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_CHROOT_CAPS="CONFIG_GRKERNSEC_CHROOT_CAPS:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_PROC="CONFIG_GRKERNSEC_PROC:  this GRSEC feature is incompatible with unprivileged containers"
+ERROR_GRKERNSEC_SYSFS_RESTRICT="CONFIG_GRKERNSEC_SYSFS_RESTRICT:  this GRSEC feature is incompatible with unprivileged containers"
+
+DOCS=(AUTHORS CONTRIBUTING MAINTAINERS NEWS README doc/FAQ.txt)
+
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+pkg_setup() {
+	kernel_is -lt 4 7 && CONFIG_CHECK="${CONFIG_CHECK} ~DEVPTS_MULTIPLE_INSTANCES"
+	linux-info_pkg_setup
+}
+
+src_prepare() {
+	eapply "${FILESDIR}"/${PN}-2.0.6-bash-completion.patch
+	#558854
+	eapply "${FILESDIR}"/${PN}-2.0.5-omit-sysconfig.patch
+	eapply "${FILESDIR}"/${PN}-2.1.1-fix-cgroup2-detection.patch
+	eapply "${FILESDIR}"/${PN}-2.1.1-cgroups-enable-container-without-CAP_SYS_ADMIN.patch
+	eapply_user
+	eautoreconf
+}
+
+src_configure() {
+	append-flags -fno-strict-aliasing
+
+	if use python; then
+		#541932
+		python_setup "python3*"
+		export PKG_CONFIG_PATH="${T}/${EPYTHON}/pkgconfig:${PKG_CONFIG_PATH}"
+	fi
+
+	# I am not sure about the --with-rootfs-path
+	# /var/lib/lxc is probably more appropriate than
+	# /usr/lib/lxc.
+	# Note by holgersson: Why is apparmor disabled?
+
+	# --enable-doc is for manpages which is why we don't link it to a "doc"
+	# USE flag. We always want man pages.
+	econf \
+		--localstatedir=/var \
+		--bindir=/usr/bin \
+		--sbindir=/usr/bin \
+		--with-config-path=/var/lib/lxc	\
+		--with-rootfs-path=/var/lib/lxc/rootfs \
+		--with-distro=gentoo \
+		--with-runtime-path=/run \
+		--disable-apparmor \
+		--disable-werror \
+		--enable-doc \
+		$(use_enable cgmanager) \
+		$(use_enable examples) \
+		$(use_enable lua) \
+		$(use_enable python) \
+		$(use_enable seccomp) \
+		$(use_enable selinux)
+}
+
+python_compile() {
+	distutils-r1_python_compile build_ext -I.. -L../lxc/.libs --no-pkg-config
+}
+
+src_compile() {
+	default
+
+	if use python; then
+		pushd "${S}/src/python-${PN}" > /dev/null
+		distutils-r1_src_compile
+		popd > /dev/null
+	fi
+}
+
+src_install() {
+	default
+
+	mv "${ED}"/usr/share/bash-completion/completions/${PN} "${ED}"/$(get_bashcompdir)/${PN}-start || die
+	# start-ephemeral is no longer a command but removing it here
+	# generates QA warnings (still in upstream completion script)
+	bashcomp_alias ${PN}-start \
+		${PN}-{attach,cgroup,copy,console,create,destroy,device,execute,freeze,info,monitor,snapshot,start-ephemeral,stop,unfreeze,wait}
+
+	if use python; then
+		pushd "${S}/src/python-lxc" > /dev/null
+		# Unset DOCS. This has been handled by the default target
+		unset DOCS
+		distutils-r1_src_install
+		popd > /dev/null
+	fi
+
+	keepdir /etc/lxc /var/lib/lxc/rootfs /var/log/lxc
+
+	find "${D}" -name '*.la' -delete
+
+	# Gentoo-specific additions!
+	newinitd "${FILESDIR}/${PN}.initd.7" ${PN}
+
+	# Remember to compare our systemd unit file with the upstream one
+	# config/init/systemd/lxc.service.in
+	systemd_newunit "${FILESDIR}"/${PN}_at.service.4 "lxc@.service"
+
+	DOC_CONTENTS="
+	Starting from version ${PN}-1.1.0-r3, the default lxc path has been
+	moved from /etc/lxc to /var/lib/lxc. If you still want to use /etc/lxc
+	please add the following to your /etc/lxc/lxc.conf
+
+	  lxc.lxcpath = /etc/lxc
+
+	For openrc, there is an init script provided with the package.
+	You _should_ only need to symlink /etc/init.d/lxc to
+	/etc/init.d/lxc.configname to start the container defined in
+	/etc/lxc/configname.conf.
+
+	Correspondingly, for systemd a service file lxc@.service is installed.
+	Enable and start lxc@configname in order to start the container defined
+	in /etc/lxc/configname.conf.
+
+	If you want checkpoint/restore functionality, please install criu
+	(sys-process/criu)."
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}
diff --git a/app-emulation/lxc/lxc-3.0.0.ebuild b/app-emulation/lxc/lxc-3.0.0.ebuild
new file mode 100644
index 000000000000..4122c2e8599d
--- /dev/null
+++ b/app-emulation/lxc/lxc-3.0.0.ebuild
@@ -0,0 +1,170 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit autotools bash-completion-r1 linux-info flag-o-matic systemd readme.gentoo-r1 pam
+
+DESCRIPTION="LinuX Containers userspace utilities"
+HOMEPAGE="https://linuxcontainers.org/"
+SRC_URI="https://linuxcontainers.org/downloads/lxc/${P}.tar.gz"
+
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~x86"
+
+LICENSE="LGPL-3"
+SLOT="0"
+IUSE="examples pam seccomp selinux"
+
+RDEPEND="
+	net-libs/gnutls
+	sys-libs/libcap
+	pam? ( virtual/pam )
+	seccomp? ( sys-libs/libseccomp )
+	selinux? ( sys-libs/libselinux )"
+
+DEPEND="${RDEPEND}
+	>=app-text/docbook-sgml-utils-0.6.14-r2
+	>=sys-kernel/linux-headers-3.2"
+
+RDEPEND="${RDEPEND}
+	sys-apps/util-linux
+	app-misc/pax-utils
+	virtual/awk"
+
+CONFIG_CHECK="~CGROUPS ~CGROUP_DEVICE
+	~CPUSETS ~CGROUP_CPUACCT
+	~CGROUP_SCHED
+
+	~NAMESPACES
+	~IPC_NS ~USER_NS ~PID_NS
+
+	~NETLINK_DIAG ~PACKET_DIAG
+	~INET_UDP_DIAG ~INET_TCP_DIAG
+	~UNIX_DIAG ~CHECKPOINT_RESTORE
+
+	~CGROUP_FREEZER
+	~UTS_NS ~NET_NS
+	~VETH ~MACVLAN
+
+	~POSIX_MQUEUE
+	~!NETPRIO_CGROUP
+
+	~!GRKERNSEC_CHROOT_MOUNT
+	~!GRKERNSEC_CHROOT_DOUBLE
+	~!GRKERNSEC_CHROOT_PIVOT
+	~!GRKERNSEC_CHROOT_CHMOD
+	~!GRKERNSEC_CHROOT_CAPS
+	~!GRKERNSEC_PROC
+	~!GRKERNSEC_SYSFS_RESTRICT
+"
+
+ERROR_DEVPTS_MULTIPLE_INSTANCES="CONFIG_DEVPTS_MULTIPLE_INSTANCES:  needed for pts inside container"
+
+ERROR_CGROUP_FREEZER="CONFIG_CGROUP_FREEZER:  needed to freeze containers"
+
+ERROR_UTS_NS="CONFIG_UTS_NS:  needed to unshare hostnames and uname info"
+ERROR_NET_NS="CONFIG_NET_NS:  needed for unshared network"
+
+ERROR_VETH="CONFIG_VETH:  needed for internal (host-to-container) networking"
+ERROR_MACVLAN="CONFIG_MACVLAN:  needed for internal (inter-container) networking"
+
+ERROR_NETLINK_DIAG="CONFIG_NETLINK_DIAG:  needed for lxc-checkpoint"
+ERROR_PACKET_DIAG="CONFIG_PACKET_DIAG:  needed for lxc-checkpoint"
+ERROR_INET_UDP_DIAG="CONFIG_INET_UDP_DIAG:  needed for lxc-checkpoint"
+ERROR_INET_TCP_DIAG="CONFIG_INET_TCP_DIAG:  needed for lxc-checkpoint"
+ERROR_UNIX_DIAG="CONFIG_UNIX_DIAG:  needed for lxc-checkpoint"
+ERROR_CHECKPOINT_RESTORE="CONFIG_CHECKPOINT_RESTORE:  needed for lxc-checkpoint"
+
+ERROR_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE:  needed for lxc-execute command"
+
+ERROR_NETPRIO_CGROUP="CONFIG_NETPRIO_CGROUP:  as of kernel 3.3 and lxc 0.8.0_rc1 this causes LXCs to fail booting."
+
+ERROR_GRKERNSEC_CHROOT_MOUNT="CONFIG_GRKERNSEC_CHROOT_MOUNT:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_CHROOT_DOUBLE="CONFIG_GRKERNSEC_CHROOT_DOUBLE:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_CHROOT_PIVOT="CONFIG_GRKERNSEC_CHROOT_PIVOT:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_CHROOT_CHMOD="CONFIG_GRKERNSEC_CHROOT_CHMOD:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_CHROOT_CAPS="CONFIG_GRKERNSEC_CHROOT_CAPS:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_PROC="CONFIG_GRKERNSEC_PROC:  this GRSEC feature is incompatible with unprivileged containers"
+ERROR_GRKERNSEC_SYSFS_RESTRICT="CONFIG_GRKERNSEC_SYSFS_RESTRICT:  this GRSEC feature is incompatible with unprivileged containers"
+
+DOCS=(AUTHORS CONTRIBUTING MAINTAINERS NEWS README doc/FAQ.txt)
+
+pkg_setup() {
+	kernel_is -lt 4 7 && CONFIG_CHECK="${CONFIG_CHECK} ~DEVPTS_MULTIPLE_INSTANCES"
+	linux-info_pkg_setup
+}
+
+src_prepare() {
+	eapply "${FILESDIR}"/${PN}-3.0.0-bash-completion.patch
+	#558854
+	eapply "${FILESDIR}"/${PN}-2.0.5-omit-sysconfig.patch
+	eapply_user
+	eautoreconf
+}
+
+src_configure() {
+	append-flags -fno-strict-aliasing
+
+	# I am not sure about the --with-rootfs-path
+	# /var/lib/lxc is probably more appropriate than
+	# /usr/lib/lxc.
+	# Note by holgersson: Why is apparmor disabled?
+
+	# --enable-doc is for manpages which is why we don't link it to a "doc"
+	# USE flag. We always want man pages.
+	econf \
+		--localstatedir=/var \
+		--bindir=/usr/bin \
+		--sbindir=/usr/bin \
+		--with-config-path=/var/lib/lxc	\
+		--with-rootfs-path=/var/lib/lxc/rootfs \
+		--with-distro=gentoo \
+		--with-runtime-path=/run \
+		--disable-apparmor \
+		--disable-werror \
+		--enable-doc \
+		$(use_enable examples) \
+		$(use_enable pam) \
+		$(use_with pam pamdir $(getpam_mod_dir)) \
+		$(use_enable seccomp) \
+		$(use_enable selinux)
+}
+
+src_install() {
+	default
+
+	mv "${ED}"/usr/share/bash-completion/completions/${PN} "${ED}"/$(get_bashcompdir)/${PN}-start || die
+	bashcomp_alias ${PN}-start \
+		${PN}-{attach,cgroup,copy,console,create,destroy,device,execute,freeze,info,monitor,snapshot,stop,unfreeze,wait}
+
+	keepdir /etc/lxc /var/lib/lxc/rootfs /var/log/lxc
+	rmdir "${D}"/var/cache/lxc "${D}"/var/cache || die "rmdir failed"
+
+	find "${D}" -name '*.la' -delete
+
+	# Gentoo-specific additions!
+	newinitd "${FILESDIR}/${PN}.initd.7" ${PN}
+
+	# Remember to compare our systemd unit file with the upstream one
+	# config/init/systemd/lxc.service.in
+	systemd_newunit "${FILESDIR}"/${PN}_at.service.4 "lxc@.service"
+
+	DOC_CONTENTS="
+	For openrc, there is an init script provided with the package.
+	You _should_ only need to symlink /etc/init.d/lxc to
+	/etc/init.d/lxc.configname to start the container defined in
+	/etc/lxc/configname.conf.
+
+	Correspondingly, for systemd a service file lxc@.service is installed.
+	Enable and start lxc@configname in order to start the container defined
+	in /etc/lxc/configname.conf.
+
+	If you want checkpoint/restore functionality, please install criu
+	(sys-process/criu)."
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}
diff --git a/app-emulation/lxc/lxc-3.0.1.ebuild b/app-emulation/lxc/lxc-3.0.1.ebuild
new file mode 100644
index 000000000000..a13e4267ee57
--- /dev/null
+++ b/app-emulation/lxc/lxc-3.0.1.ebuild
@@ -0,0 +1,162 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit autotools bash-completion-r1 linux-info flag-o-matic systemd readme.gentoo-r1 pam
+
+DESCRIPTION="LinuX Containers userspace utilities"
+HOMEPAGE="https://linuxcontainers.org/"
+SRC_URI="https://linuxcontainers.org/downloads/lxc/${P}.tar.gz"
+
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~x86"
+
+LICENSE="LGPL-3"
+SLOT="0"
+IUSE="examples pam python seccomp selinux +templates"
+
+RDEPEND="
+	net-libs/gnutls
+	sys-libs/libcap
+	pam? ( virtual/pam )
+	seccomp? ( sys-libs/libseccomp )
+	selinux? ( sys-libs/libselinux )"
+
+DEPEND="${RDEPEND}
+	>=app-text/docbook-sgml-utils-0.6.14-r2
+	>=sys-kernel/linux-headers-3.2"
+
+RDEPEND="${RDEPEND}
+	sys-apps/util-linux
+	app-misc/pax-utils
+	virtual/awk"
+
+PDEPEND="templates? ( app-emulation/lxc-templates )
+	python? ( dev-python/python3-lxc )"
+
+CONFIG_CHECK="~CGROUPS ~CGROUP_DEVICE
+	~CPUSETS ~CGROUP_CPUACCT
+	~CGROUP_SCHED
+
+	~NAMESPACES
+	~IPC_NS ~USER_NS ~PID_NS
+
+	~CGROUP_FREEZER
+	~UTS_NS ~NET_NS
+	~VETH ~MACVLAN
+
+	~POSIX_MQUEUE
+	~!NETPRIO_CGROUP
+
+	~!GRKERNSEC_CHROOT_MOUNT
+	~!GRKERNSEC_CHROOT_DOUBLE
+	~!GRKERNSEC_CHROOT_PIVOT
+	~!GRKERNSEC_CHROOT_CHMOD
+	~!GRKERNSEC_CHROOT_CAPS
+	~!GRKERNSEC_PROC
+	~!GRKERNSEC_SYSFS_RESTRICT
+"
+
+ERROR_DEVPTS_MULTIPLE_INSTANCES="CONFIG_DEVPTS_MULTIPLE_INSTANCES:  needed for pts inside container"
+
+ERROR_CGROUP_FREEZER="CONFIG_CGROUP_FREEZER:  needed to freeze containers"
+
+ERROR_UTS_NS="CONFIG_UTS_NS:  needed to unshare hostnames and uname info"
+ERROR_NET_NS="CONFIG_NET_NS:  needed for unshared network"
+
+ERROR_VETH="CONFIG_VETH:  needed for internal (host-to-container) networking"
+ERROR_MACVLAN="CONFIG_MACVLAN:  needed for internal (inter-container) networking"
+
+ERROR_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE:  needed for lxc-execute command"
+
+ERROR_NETPRIO_CGROUP="CONFIG_NETPRIO_CGROUP:  as of kernel 3.3 and lxc 0.8.0_rc1 this causes LXCs to fail booting."
+
+ERROR_GRKERNSEC_CHROOT_MOUNT="CONFIG_GRKERNSEC_CHROOT_MOUNT:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_CHROOT_DOUBLE="CONFIG_GRKERNSEC_CHROOT_DOUBLE:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_CHROOT_PIVOT="CONFIG_GRKERNSEC_CHROOT_PIVOT:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_CHROOT_CHMOD="CONFIG_GRKERNSEC_CHROOT_CHMOD:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_CHROOT_CAPS="CONFIG_GRKERNSEC_CHROOT_CAPS:  some GRSEC features make LXC unusable see postinst notes"
+ERROR_GRKERNSEC_PROC="CONFIG_GRKERNSEC_PROC:  this GRSEC feature is incompatible with unprivileged containers"
+ERROR_GRKERNSEC_SYSFS_RESTRICT="CONFIG_GRKERNSEC_SYSFS_RESTRICT:  this GRSEC feature is incompatible with unprivileged containers"
+
+DOCS=(AUTHORS CONTRIBUTING MAINTAINERS NEWS README doc/FAQ.txt)
+
+pkg_setup() {
+	kernel_is -lt 4 7 && CONFIG_CHECK="${CONFIG_CHECK} ~DEVPTS_MULTIPLE_INSTANCES"
+	linux-info_pkg_setup
+}
+
+src_prepare() {
+	eapply "${FILESDIR}"/${PN}-3.0.0-bash-completion.patch
+	#558854
+	eapply "${FILESDIR}"/${PN}-2.0.5-omit-sysconfig.patch
+	eapply_user
+	eautoreconf
+}
+
+src_configure() {
+	append-flags -fno-strict-aliasing
+
+	# I am not sure about the --with-rootfs-path
+	# /var/lib/lxc is probably more appropriate than
+	# /usr/lib/lxc.
+	# Note by holgersson: Why is apparmor disabled?
+
+	# --enable-doc is for manpages which is why we don't link it to a "doc"
+	# USE flag. We always want man pages.
+	econf \
+		--localstatedir=/var \
+		--bindir=/usr/bin \
+		--sbindir=/usr/bin \
+		--with-config-path=/var/lib/lxc	\
+		--with-rootfs-path=/var/lib/lxc/rootfs \
+		--with-distro=gentoo \
+		--with-runtime-path=/run \
+		--disable-apparmor \
+		--disable-werror \
+		--enable-doc \
+		$(use_enable examples) \
+		$(use_enable pam) \
+		$(use_with pam pamdir $(getpam_mod_dir)) \
+		$(use_enable seccomp) \
+		$(use_enable selinux)
+}
+
+src_install() {
+	default
+
+	mv "${ED}"/usr/share/bash-completion/completions/${PN} "${ED}"/$(get_bashcompdir)/${PN}-start || die
+	bashcomp_alias ${PN}-start \
+		${PN}-{attach,cgroup,copy,console,create,destroy,device,execute,freeze,info,monitor,snapshot,stop,unfreeze,wait}
+
+	keepdir /etc/lxc /var/lib/lxc/rootfs /var/log/lxc
+	rmdir "${D}"/var/cache/lxc "${D}"/var/cache || die "rmdir failed"
+
+	find "${D}" -name '*.la' -delete
+
+	# Gentoo-specific additions!
+	newinitd "${FILESDIR}/${PN}.initd.7" ${PN}
+
+	# Remember to compare our systemd unit file with the upstream one
+	# config/init/systemd/lxc.service.in
+	systemd_newunit "${FILESDIR}"/${PN}_at.service.4 "lxc@.service"
+
+	DOC_CONTENTS="
+	For openrc, there is an init script provided with the package.
+	You _should_ only need to symlink /etc/init.d/lxc to
+	/etc/init.d/lxc.configname to start the container defined in
+	/etc/lxc/configname.conf.
+
+	Correspondingly, for systemd a service file lxc@.service is installed.
+	Enable and start lxc@configname in order to start the container defined
+	in /etc/lxc/configname.conf.
+
+	If you want checkpoint/restore functionality, please install criu
+	(sys-process/criu)."
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}
diff --git a/app-emulation/lxc/metadata.xml b/app-emulation/lxc/metadata.xml
new file mode 100644
index 000000000000..8ec672d923c4
--- /dev/null
+++ b/app-emulation/lxc/metadata.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>vdupras@gentoo.org</email>
+  </maintainer>
+  <maintainer type="project">
+    <email>virtualization@gentoo.org</email>
+    <name>Gentoo Virtualization Project</name>
+  </maintainer>
+  <use>
+    <flag name="cgmanager">Enable support for cgroup management using <pkg>app-admin/cgmanager</pkg></flag>
+    <flag name="templates">Install old style templates through <pkg>app-emulation/lxc-templates</pkg></flag>
+  </use>
+  <upstream>
+    <remote-id type="github">lxc/lxc</remote-id>
+  </upstream>
+</pkgmetadata>