I have host running RHEL-7.2. Inside that running LXC. Inside LXC creating network namespaces. Inside the namespace changing sysctl variables was failing (as root):$ ip netns add testns$ ip netns exec testns bash$ sysctl net.ipv6.conf.all.disable_ipv6=1sysctl: setting key net.ipv6.conf.all.disable_ipv6: Read-only file systemIf I remount /proc/sys for RW in a shell and then sysctl -w inside same shell, then it does work.$ ip netns exec testns bash$ mount -o remount,rw /proc/sys$ sysctl net.ipv6.conf.all.disable_ipv6=1net.ipv6.conf.all.disable_ipv6 = 1I then start 2nd shell and enter netns and /proc/sys appears Read-ONLY for that shell, but remains writable within the 1sh shell. This puzzles me. The affect of changing values by first shell is visible to the second shell.I was trying to add remounting to the provisioning script, but this issue gets in the way.$ ip netns exec testns sysctl net.ipv6.conf.all.disable_ipv6=1sysctl: setting key net.ipv6.conf.all.disable_ipv6: Read-only file system$ ip netns exec testns sh -c \>   'mount -o remount,rw /proc/sys && sysctl net.ipv6.conf.all.disable_ipv6=1'net.ipv6.conf.all.disable_ipv6 = 1$ ip netns exec testns sysctl net.ipv6.conf.all.disable_ipv6=0sysctl: setting key net.ipv6.conf.all.disable_ipv6: Read-only file systemNote that I can do this sysctl change on host and in LXC's default namespace without any problems. If I create a namespace on the host directly I do not have this problem. I only run into /proc/sys being read-only inside the namespace inside LXC.My questions here are:Q1. I would like /proc/sys inside the namespace inside LXC to remain permanently mounted with RW so I can set sysctl vars anytime.Q2. I would like to understand why it behaves the way it does. It seems /proc/sys mount is somehow per process, or per setns system call? man ip-netns talks about bind mount for /etc/netns/<name>/file but I don't see anything about /proc. Did I miss something obvious?UpdateI found what is most likely to be the answer to my Q2.First experimentally and then in man ip-netns:ip netns exec automates handling of this configuration,  file convention for network namespace unaware applications,  by creating a mount namespace and bind mounting  all of the per network namespace configure files  into their traditional location in /etc.So every time ip netns exec creates a new mount namespace but /proc/sys happens to become the victim of whatever mount options it got where ever it got them from. My best guess is I need to find what causes ip netns exec to mount bind /proc/sys in read only mode under LXC, which probably will answer my question Q1.
Why remount of /proc/sys is not global or does not persist in network namespace inside LXC
proc;lxc;sysctl;network namespaces