Index: fedd/federation/benito_access.py
===================================================================
--- fedd/federation/benito_access.py	(revision f7fc5512afd25db9123fd4db71522b1d20631577)
+++ 	(revision )
@@ -1,96 +1,0 @@
-#!/usr/local/bin/python
-
-import os,sys
-import stat # for chmod constants
-import re
-import random
-import string
-import copy
-import pickle
-import logging
-import subprocess
-import traceback
-
-from threading import *
-from M2Crypto.SSL import SSLError
-
-from emulab_access import access as emulab_access
-
-from util import *
-from deter import fedid, generate_fedid
-from authorizer import authorizer, abac_authorizer
-from service_error import service_error
-from remote_service import xmlrpc_handler, soap_handler, service_caller
-from proof import proof as access_proof
-
-import httplib
-import tempfile
-from urlparse import urlparse
-
-from deter import topdl
-import list_log
-import benito_segment
-
-
-# Make log messages disappear if noone configures a fedd logger
-class nullHandler(logging.Handler):
-    def emit(self, record): pass
-
-fl = logging.getLogger("fedd.access")
-fl.addHandler(nullHandler())
-
-class access(emulab_access):
-    """
-    The implementation of access control based on mapping users to projects.
-
-    Users can be mapped to existing projects or have projects created
-    dynamically.  This implements both direct requests and proxies.
-    """
-
-    max_name_len = 19
-
-    def __init__(self, config=None, auth=None):
-        """
-        Initializer.  Pulls parameters out of the ConfigParser's access section.
-        """
-	emulab_access.__init__(self, config, auth)
-
-	# Segment creation is where most of the differences are.
-	self.start_segment = benito_segment.start_segment
-	self.stop_segment = benito_segment.stop_segment
-	self.info_segment = benito_segment.info_segment
-
-    # These are subroutines for StartSegment
-    def generate_ns2(self, topo, expfn, softdir, connInfo):
-	"""
-	Benito is expecting a topdl file, so this routine is misnamed.  It does
-	clean up the topdl, removing elements benito doesn't understand and
-	writing out the file.
-	"""
-	# Main line of generate_ns2
-	t = topo.clone()
-
-	# Weed out the things we aren't going to instantiate: Segments, portal
-	# substrates, and portal interfaces.  (The copy in the for loop allows
-	# us to delete from e.elements in side the for loop).  While we're
-	# touching all the elements, we also adjust paths from the original
-	# testbed to local testbed paths 
-	for e in [e for e in t.elements]:
-	    if isinstance(e, topdl.Segment):
-		t.elements.remove(e)
-	    # Fix software paths
-	    for s in getattr(e, 'software', []):
-		s.location = re.sub("^.*/", softdir, s.location)
-
-	t.substrates = [ s.clone() for s in t.substrates ]
-	t.incorporate_elements()
-
-	# Convert to ns and write it out
-	expfile = topdl.topology_to_xml(t, top='experiment')
-	try:
-	    f = open(expfn, "w")
-	    print >>f, expfile
-	    f.close()
-	except EnvironmentError:
-	    raise service_error(service_error.internal,
-		    "Cannot write experiment file %s: %s" % (expfn,e))
Index: fedd/federation/benito_segment.py
===================================================================
--- fedd/federation/benito_segment.py	(revision f7fc5512afd25db9123fd4db71522b1d20631577)
+++ 	(revision )
@@ -1,195 +1,0 @@
-#!/usr/local/bin/python
-
-import sys, os
-import re
-import os.path
-
-import tempfile
-import subprocess
-import logging 
-import time
-import signal
-
-import util
-
-from deter import topdl
-
-from ssh_emulab_segment import ssh_emulab_segment
-from xmlrpc_emulab_segment import xmlrpc_emulab_segment
-
-
-class start_segment(ssh_emulab_segment, xmlrpc_emulab_segment):
-    def __init__(self, log=None, keyfile=None, debug=False, boss=None,
-	    ops=None, cert=None):
-	ssh_emulab_segment.__init__(self, log=log, keyfile=keyfile, debug=debug)
-	xmlrpc_emulab_segment.__init__(self, boss=boss, ops=ops, cert=cert)
-	self.start_mixed = '/share/benito/start_mixed %s %s %s'
-	self.start_qemu =  '/share/benito/start_qemu %s %s %s'
-
-    def get_mapping(self, pid, eid):
-	"""
-	Benito's info reporting is not sufficient to support this yet
-	"""
-	pass
-
-    def set_up_experiment_filespace(self, user, host, pid, eid, tmpdir):
-	"""
-	Send all the software and configuration files into the experiment's
-	file space.  To reduce the number of ssh connections, we script many
-	changes and execute the script.
-	"""
-	# Configuration directories on the remote machine
-	proj_dir = "/proj/%s/exp/%s/tmp" % (pid, eid)
-	softdir = "/proj/%s/software/%s" % (pid, eid)
-	# Local software dir
-	lsoftdir = "%s/software" % tmpdir
-
-	# Open up a temporary file to contain a script for setting up the
-	# filespace for the new experiment.
-	self.log.info("[start_segment]: creating script file")
-	try:
-	    sf, scriptname = tempfile.mkstemp()
-	    scriptfile = os.fdopen(sf, 'w')
-	except EnvironmentError:
-	    return False
-
-	scriptbase = os.path.basename(scriptname)
-
-	# Script the filesystem changes
-	print >>scriptfile, "/bin/rm -rf %s" % proj_dir
-	# Clear and create the software directory
-	print >>scriptfile, "/bin/rm -rf %s/*" % softdir
-	print >>scriptfile, 'mkdir -p %s' % proj_dir
-	if os.path.isdir(lsoftdir):
-	    print >>scriptfile, 'mkdir -p %s' % softdir
-	print >>scriptfile, "rm -f %s" % scriptbase
-	scriptfile.close()
-
-	# Move the script to the remote machine
-	# XXX: could collide tempfile names on the remote host
-	if self.scp_file(scriptname, user, host, scriptbase):
-	    os.remove(scriptname)
-	else:
-	    return False
-
-	# Execute the script (and the script's last line deletes it)
-	if not self.ssh_cmd(user, host, "sh -x %s" % scriptbase):
-	    return False
-
-	for f in os.listdir(tmpdir):
-	    if not os.path.isdir("%s/%s" % (tmpdir, f)):
-		if not self.scp_file("%s/%s" % (tmpdir, f), user, host,
-			"%s/%s" % (proj_dir, f)):
-		    return False
-	if os.path.isdir(lsoftdir):
-	    for f in os.listdir(lsoftdir):
-		if not os.path.isdir("%s/%s" % (lsoftdir, f)):
-		    if not self.scp_file("%s/%s" % (lsoftdir, f), 
-			    user, host, "%s/%s" % (softdir, f)):
-			return False
-	return True
-
-
-    def __call__(self, parent, eid, pid, user, tclfile, tmpdir, timeout=0, 
-	    gid=None):
-	"""
-	Start a sub-experiment on a federant.
-
-	Get the current state, and terminate the experiment if it exists. The
-	group membership of the experiment is difficult to determine or change,
-	so start with a clean slate.  Create a new one and ship data
-	and configs and start the experiment.  There are small ordering
-	differences based on the initial state of the sub-experiment.
-	"""
-
-	# benito listens to the filename extension.  tclfile here is really
-	# topdl, but we'll move it to a different filename.
-	if tclfile.endswith('.tcl'):
-	    topdlfile = os.path.join(tmpdir, 'experiment.xml')
-	    os.rename(tclfile, topdlfile)
-	else:
-	    topdlfile = tclfile
-
-
-	state = self.get_state(pid, eid)
-
-	if state != 'none':
-	    self.terminate_exp(pid, eid)
-
-	top = topdl.topology_from_xml(filename=topdlfile, top='experiment')
-	embedded = False
-	for e in top.elements:
-	    if isinstance(e, topdl.Computer) and \
-		    e.get_attribute('partition') is not None:
-		embedded = True
-		break
-	# on the for
-	else:
-	    embedded = False
-
-	if embedded:
-	    cmd = self.start_mixed  %  (pid, eid, topdlfile)
-	else:
-	    cmd = self.start_qemu % (pid, eid, topdlfile, 20)
-
-	if not self.ssh_cmd(user, self.ops, cmd):
-	    self.log.error("Cannot create benito experiment")
-	    return False
-
-	if not self.swap_exp(pid, eid, 'in'):
-	    self.log.error("swap in failed")
-	    return False
-	# Everything has gone OK.
-	self.get_mapping(pid,eid)
-	return True
-
-class stop_segment(ssh_emulab_segment, xmlrpc_emulab_segment):
-    def __init__(self, log=None, keyfile=None, debug=False, boss=None, 
-	    ops=None, cert=None):
-	ssh_emulab_segment.__init__(self, log=log, keyfile=keyfile, debug=debug)
-	xmlrpc_emulab_segment.__init__(self, boss=boss, ops=ops, cert=cert)
-
-    def __call__(self, parent, user, pid, eid, gid=None, terminate=False):
-	"""
-	Stop a sub experiment by calling swapexp on the federant
-	"""
-
-	self.log.info("[stop_segment]: Stopping %s" % eid)
-	rv = False
-	try:
-	    # Clean out tar files: we've gone over quota in the past
-	    self.ssh_cmd(user, self.ops, 
-		    "rm -rf /proj/%s/software/%s" % (pid, eid))
-	    rv = self.swap_exp(pid, eid, 'out')
-	    if terminate:
-		rv = self.terminate_exp(pid, eid)
-	except self.cmd_timeout:
-	    rv = False
-	return rv
-
-class info_segment(ssh_emulab_segment, xmlrpc_emulab_segment):
-    def __init__(self, log=None, keyfile=None, debug=False, boss=None, 
-	    ops=None, cert=None):
-	ssh_emulab_segment.__init__(self, log=log, keyfile=keyfile, debug=debug)
-	xmlrpc_emulab_segment.__init__(self, boss=boss, ops=ops, cert=cert)
-
-    def get_mapping(self, pid, eid):
-	"""
-	Benito's info reporting is not sufficient to support this yet
-	"""
-	pass
-
-    def __call__(self, parent, user, pid, eid):
-	self.log.info("[info_segment]: Getting info from %s" % eid)
-	self.get_mapping(pid,eid)
-	return True
-
-class operation_segment(ssh_emulab_segment, xmlrpc_emulab_segment):
-    def __init__(self, log=None, keyfile=None, debug=False, boss=None, 
-	    ops=None, cert=None):
-	ssh_emulab_segment.__init__(self, log=log, keyfile=keyfile, debug=debug)
-	xmlrpc_emulab_segment.__init__(self, boss=boss, ops=ops, cert=cert)
-
-    def __call__(self, parent, op, targets, param, top):
-	self.status.append('operations not yet supported')
-	return True
Index: fedd/federation/containers_access.py
===================================================================
--- fedd/federation/containers_access.py	(revision c261c0fcd5ffe94116ae5d3cb018e8f1519e4838)
+++ fedd/federation/containers_access.py	(revision c261c0fcd5ffe94116ae5d3cb018e8f1519e4838)
@@ -0,0 +1,101 @@
+#!/usr/local/bin/python
+
+import os,sys
+import stat # for chmod constants
+import re
+import random
+import string
+import copy
+import pickle
+import logging
+import subprocess
+import traceback
+
+from threading import *
+from M2Crypto.SSL import SSLError
+
+from emulab_access import access as emulab_access
+
+from util import *
+from deter import fedid, generate_fedid
+from authorizer import authorizer, abac_authorizer
+from service_error import service_error
+from remote_service import xmlrpc_handler, soap_handler, service_caller
+from proof import proof as access_proof
+
+import httplib
+import tempfile
+from urlparse import urlparse
+
+from deter import topdl
+import list_log
+import containers_segment
+
+
+# Make log messages disappear if noone configures a fedd logger
+class nullHandler(logging.Handler):
+    def emit(self, record): pass
+
+fl = logging.getLogger("fedd.access")
+fl.addHandler(nullHandler())
+
+class access(emulab_access):
+    """
+    The implementation of access control based on mapping users to projects.
+
+    Users can be mapped to existing projects or have projects created
+    dynamically.  This implements both direct requests and proxies.
+    """
+
+    max_name_len = 19
+
+    def __init__(self, config=None, auth=None):
+        """
+        Initializer.  Pulls parameters out of the ConfigParser's access section.
+        """
+	emulab_access.__init__(self, config, auth)
+
+	self.containerize = config.get('access', 'containerize')
+
+	# Segment creation is where most of the differences are.
+	self.start_segment = containers_segment.start_segment
+	self.stop_segment = containers_segment.stop_segment
+	self.info_segment = containers_segment.info_segment
+
+    # These are subroutines for StartSegment
+    def generate_ns2(self, topo, expfn, softdir, connInfo):
+	"""
+	Benito is expecting a topdl file, so this routine is misnamed.  It does
+	clean up the topdl, removing elements containers doesn't understand and
+	writing out the file.
+	"""
+	# Main line of generate_ns2
+	t = topo.clone()
+
+	# Weed out the things we aren't going to instantiate: Segments, portal
+	# substrates, and portal interfaces.  (The copy in the for loop allows
+	# us to delete from e.elements in side the for loop).  While we're
+	# touching all the elements, we also adjust paths from the original
+	# testbed to local testbed paths 
+	for e in [e for e in t.elements]:
+	    if isinstance(e, topdl.Segment):
+		t.elements.remove(e)
+	    if not isinstance(e, topdl.Computer): continue
+	    if e.get_attribute('portal'):
+		e.set_attribute('containers:node_type', 'embedded_pnode')
+	    # Fix software paths
+	    for s in getattr(e, 'software', []):
+		s.location = re.sub("^.*/", softdir, s.location)
+
+	t.substrates = [ s.clone() for s in t.substrates ]
+	t.incorporate_elements()
+
+	# Write it out
+	expfile = topdl.topology_to_xml(t, top='experiment')
+	try:
+	    f = open(expfn, "w")
+	    print >>f, expfile
+	    f.close()
+	except EnvironmentError:
+	    raise service_error(service_error.internal,
+		    "Cannot write experiment file %s: %s" % (expfn,e))
Index: fedd/federation/containers_segment.py
===================================================================
--- fedd/federation/containers_segment.py	(revision c261c0fcd5ffe94116ae5d3cb018e8f1519e4838)
+++ fedd/federation/containers_segment.py	(revision c261c0fcd5ffe94116ae5d3cb018e8f1519e4838)
@@ -0,0 +1,185 @@
+#!/usr/local/bin/python
+
+import sys, os
+import re
+import os.path
+
+import tempfile
+import subprocess
+import logging 
+import time
+import signal
+
+import util
+
+from deter import topdl
+
+from ssh_emulab_segment import ssh_emulab_segment
+from xmlrpc_emulab_segment import xmlrpc_emulab_segment
+
+
+class start_segment(ssh_emulab_segment, xmlrpc_emulab_segment):
+    def __init__(self, log=None, keyfile=None, debug=False, boss=None,
+	    ops=None, cert=None):
+	ssh_emulab_segment.__init__(self, log=log, keyfile=keyfile, debug=debug)
+	xmlrpc_emulab_segment.__init__(self, boss=boss, ops=ops, cert=cert)
+	# XXX: better way to work this...
+	self.containerize = '/share/containers-dev/containerize.py --config /share/containers-dev/site.conf %s %s %s'
+
+    def get_mapping(self, pid, eid):
+	"""
+	Containers's info reporting is not sufficient to support this yet
+	"""
+	pass
+
+    def set_up_experiment_filespace(self, user, host, pid, eid, tmpdir):
+	"""
+	Send all the software and configuration files into the experiment's
+	file space.  To reduce the number of ssh connections, we script many
+	changes and execute the script.
+	"""
+	# Configuration directories on the remote machine
+	proj_dir = "/proj/%s/exp/%s/tmp" % (pid, eid)
+	softdir = "/proj/%s/software/%s" % (pid, eid)
+	# Local software dir
+	lsoftdir = "%s/software" % tmpdir
+
+	# Open up a temporary file to contain a script for setting up the
+	# filespace for the new experiment.
+	self.log.info("[start_segment]: creating script file")
+	try:
+	    sf, scriptname = tempfile.mkstemp()
+	    scriptfile = os.fdopen(sf, 'w')
+	except EnvironmentError:
+	    return False
+
+	scriptbase = os.path.basename(scriptname)
+
+	# Script the filesystem changes
+	print >>scriptfile, "/bin/rm -rf %s" % proj_dir
+	# Clear and create the software directory
+	print >>scriptfile, "/bin/rm -rf %s/*" % softdir
+	print >>scriptfile, 'mkdir -p %s' % proj_dir
+	if os.path.isdir(lsoftdir):
+	    print >>scriptfile, 'mkdir -p %s' % softdir
+	print >>scriptfile, "rm -f %s" % scriptbase
+	scriptfile.close()
+
+	# Move the script to the remote machine
+	# XXX: could collide tempfile names on the remote host
+	if self.scp_file(scriptname, user, host, scriptbase):
+	    os.remove(scriptname)
+	else:
+	    return False
+
+	# Execute the script (and the script's last line deletes it)
+	if not self.ssh_cmd(user, host, "sh -x %s" % scriptbase):
+	    return False
+
+	for f in os.listdir(tmpdir):
+	    if not os.path.isdir("%s/%s" % (tmpdir, f)):
+		if not self.scp_file("%s/%s" % (tmpdir, f), user, host,
+			"%s/%s" % (proj_dir, f)):
+		    return False
+	if os.path.isdir(lsoftdir):
+	    for f in os.listdir(lsoftdir):
+		if not os.path.isdir("%s/%s" % (lsoftdir, f)):
+		    if not self.scp_file("%s/%s" % (lsoftdir, f), 
+			    user, host, "%s/%s" % (softdir, f)):
+			return False
+	return True
+
+
+    def __call__(self, parent, eid, pid, user, tclfile, tmpdir, timeout=0, 
+	    gid=None):
+	"""
+	Start a sub-experiment on a federant.
+
+	Get the current state, and terminate the experiment if it exists. The
+	group membership of the experiment is difficult to determine or change,
+	so start with a clean slate.  Create a new one and ship data
+	and configs and start the experiment.  There are small ordering
+	differences based on the initial state of the sub-experiment.
+	"""
+
+	# containers listens to the filename extension.  tclfile here is really
+	# topdl, but we'll move it to a different filename.
+	if tclfile.endswith('.tcl'):
+	    topdlfile = os.path.join(tmpdir, 'experiment.xml')
+	    self.ssh_cmd(user, self.ops, 'mv %s %s' % (tclfile, topdlfile))
+	else:
+	    topdlfile = tclfile
+
+
+	state = self.get_state(pid, eid)
+
+	if state != 'none':
+	    self.terminate_exp(pid, eid)
+
+	cmd = self.containerize  %  (pid, eid, topdlfile)
+
+	if not self.ssh_cmd(user, self.ops, cmd):
+	    self.log.error("Cannot create containers experiment")
+	    return False
+
+	if not self.set_up_experiment_filespace(user, self.ops, 
+		pid, eid, tmpdir):
+	    return False
+
+	if not self.swap_exp(pid, eid, 'in'):
+	    self.log.error("swap in failed")
+	    return False
+	# Everything has gone OK.
+	self.get_mapping(pid,eid)
+	return True
+
+class stop_segment(ssh_emulab_segment, xmlrpc_emulab_segment):
+    def __init__(self, log=None, keyfile=None, debug=False, boss=None, 
+	    ops=None, cert=None):
+	ssh_emulab_segment.__init__(self, log=log, keyfile=keyfile, debug=debug)
+	xmlrpc_emulab_segment.__init__(self, boss=boss, ops=ops, cert=cert)
+
+    def __call__(self, parent, user, pid, eid, gid=None, terminate=False):
+	"""
+	Stop a sub experiment by calling swapexp on the federant
+	"""
+
+	self.log.info("[stop_segment]: Stopping %s" % eid)
+	rv = False
+	try:
+	    # Clean out tar files: we've gone over quota in the past
+	    self.ssh_cmd(user, self.ops, 
+		    "rm -rf /proj/%s/software/%s" % (pid, eid))
+	    rv = self.swap_exp(pid, eid, 'out')
+	    if terminate:
+		rv = self.terminate_exp(pid, eid)
+	except self.cmd_timeout:
+	    rv = False
+	return rv
+
+class info_segment(ssh_emulab_segment, xmlrpc_emulab_segment):
+    def __init__(self, log=None, keyfile=None, debug=False, boss=None, 
+	    ops=None, cert=None):
+	ssh_emulab_segment.__init__(self, log=log, keyfile=keyfile, debug=debug)
+	xmlrpc_emulab_segment.__init__(self, boss=boss, ops=ops, cert=cert)
+
+    def get_mapping(self, pid, eid):
+	"""
+	Benito's info reporting is not sufficient to support this yet
+	"""
+	pass
+
+    def __call__(self, parent, user, pid, eid):
+	self.log.info("[info_segment]: Getting info from %s" % eid)
+	self.get_mapping(pid,eid)
+	return True
+
+class operation_segment(ssh_emulab_segment, xmlrpc_emulab_segment):
+    def __init__(self, log=None, keyfile=None, debug=False, boss=None, 
+	    ops=None, cert=None):
+	ssh_emulab_segment.__init__(self, log=log, keyfile=keyfile, debug=debug)
+	xmlrpc_emulab_segment.__init__(self, boss=boss, ops=ops, cert=cert)
+
+    def __call__(self, parent, op, targets, param, top):
+	self.status.append('operations not yet supported')
+	return True
Index: fedd/federation/deter_impl.py
===================================================================
--- fedd/federation/deter_impl.py	(revision f7fc5512afd25db9123fd4db71522b1d20631577)
+++ fedd/federation/deter_impl.py	(revision c261c0fcd5ffe94116ae5d3cb018e8f1519e4838)
@@ -7,5 +7,5 @@
 import protogeni_access
 import deter_internal_access
-import benito_access
+import containers_access
 import desktop_access
 import skeleton_access
@@ -88,6 +88,6 @@
 		    self.access = deter_internal_access.access(config,
 			    self.auth)
-		elif self.access_type == "benito":
-		    self.access = benito_access.access(config, self.auth)
+		elif self.access_type == "containers":
+		    self.access = containers_access.access(config, self.auth)
 		elif self.access_type == "desktop":
 		    self.access = desktop_access.access(config, self.auth)
