[patch 2/2] Remove the ns_cgroup

Paul Menage menage at google.com
Wed Jan 6 16:38:45 PST 2010


On Mon, Dec 28, 2009 at 3:36 PM, Serge E. Hallyn <serue at us.ibm.com> wrote:
> Quoting Daniel Lezcano (daniel.lezcano at free.fr):
>> The ns_cgroup is an annoying cgroup at the namespace / cgroup frontier.
>
> True.  However, it remains - apart from using smack or SELinux - the
> only way to truly lock a container into a cgroup configuration.  That's
> unlikely to change until we finally support user namespaces in the VFS.
>
> Do we worry about that?

I think we worry about the fact that we don't have a good way to do
this. I don't think we worry about removing a bad way to do it :-)

Paul


More information about the Containers mailing list