[PATCH] Document signal-semantics changes of container-init
sukadev at linux.vnet.ibm.com
Sat Mar 14 16:23:53 PDT 2009
The kernel changes corresponding to his update were added to -mm
on 2009-02-19. Please review and let me know if other man pages
should be updated to document these semantics.
From: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
Date: Sat, 14 Mar 2009 16:08:42 -0700
Subject: [PATCH] Document signal-semantics changes of container-init
Container-inits have some special signal semantics depending on
whether the signal was sent from the same container or a parent
container. These changes were implemented by the patchset:
Signed-off-by: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
man2/clone.2 | 7 ++++++-
man2/kill.2 | 27 +++++++++++++++++++++++++++
2 files changed, 33 insertions(+), 1 deletions(-)
diff --git a/man2/clone.2 b/man2/clone.2
index 5d07f7c..975b321 100644
@@ -396,7 +396,8 @@ will produce processes with PIDs that are unique within the namespace.
The first process created in a new namespace
(i.e., the process created using the
-flag) has the PID 1, and is the "init" process for the namespace.
+flag) has the PID 1, and is the "init" process for the namespace,
+also referred to as "container-init" process.
Children that are orphaned within the namespace will be reparented
to this process rather than
.BR init (8).
@@ -405,6 +406,10 @@ Unlike the traditional
process, the "init" process of a PID namespace can terminate,
and if it does, all of the processes in the namespace are terminated.
+See NOTES section of
+for special signal semantics of the "container-init" process.
PID namespaces form a hierarchy.
When a PID new namespace is created,
the processes in that namespace are visible
diff --git a/man2/kill.2 b/man2/kill.2
index 5cfa9a4..d0ba8bb 100644
@@ -128,6 +128,33 @@ has explicitly installed signal handlers.
This is done to assure the
system is not brought down accidentally.
+process (i.e a process created by a call to
+flag) is also similarly immune to 'unhandled' signals
+sent by a descendant process.
+recieves the unhandled signal and may terminate, if the signal is sent
+by a process in the parent namespace of the
+appears like an
+process to its descendant process and they cannot accidentally terminate
+and thereby, the entire pid-namespace.
+appears like a normal process to another process in its parent-pid-namespace,
+allowing an administrator to terminate any run-away
POSIX.1-2001 requires that \fIkill(\-1,sig)\fP send \fIsig\fP
to all processes that the calling process may send signals to,
except possibly for some implementation-defined system processes.
More information about the Containers