CGroup Namespaces Support Set For Linux 4.6 Kernel
Following the cgroup pull request for the Linux 4.6 merge window, Tejun Heo sent in a second pull request and it goes ahead to provide cgroup namespaces support for the kernel.
The cgroup namespaces support has been in development for over two years and is now being mainlined. This feature comes down to just over 600 lines of new code in the kernel.
In terms of the cgroup namespaces use-case, an earlier patch series describes it as, "Cgroups and Namespaces are used together to create 'virtual' containers that isolates the host environment from the processes running in container. But since cgroups themselves are not 'virtualized', the task is always able to see global cgroups view through cgroupfs mount and via /proc/self/cgroup file."
Another cgroup NS patch went on to explain, "The main purpose of cgroup namespace is to virtualize the contents of /proc/self/cgroup file. Processes inside a cgroup namespace are only able to see paths relative to their namespace root (unless they are moved outside of their cgroupns-root, at which point they will see a relative path from their cgroupns-root). For a correctly setup container this enables container-tools (like libcontainer, lxc, lmctfy, etc.) to create completely virtualized containers without leaking system level cgroup hierarchy to the task."
The pull request with the cgroup namespaces support for Linux 4.6 can be found here.
1 Comment
