Constraining the memory used by an unprivilged mount of tmpfs.

[Glauber Costa]

On 01/17/2013 11:01 PM, Eric W. Biederman wrote:
> What are the practical problems with control groups that makes them
> undesirable/hard to use with namespaces?
> 
> What would it take to fix the problems with control groups?
There aren't, from my PoV.
When I run containers, for instance, I basically join all namespaces,
configure all groups, and everything I can.

I do know, however, that not every use case is like that, and those
things tends to be very loosely coupled.

So what I am worried about, is not a valid container usage where you
have your constraints configured. But if I login into a box as a normal
user, and that now allows me to create a userns, and maliciously fire a
big tmpfs from there, cgroups will not gonna be there for me - it's not
a container box, is just something I am trying to break.