Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1404578

Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new cgroup namespaces

Show all headers | View raw

On Fri, 2016-05-20 at 09:17 -0700, Tejun Heo wrote:
> Hello, James.
> 
> On Fri, May 20, 2016 at 12:09:10PM -0400, James Bottomley wrote:
> > I think it's just different definitions.  If you take on our 
> > definition of being able to set up a container without any admin 
> > intervention, do you see our problem: we can't get the initial 
> > delegation of the hierarchy.
> 
> Yeah, I can see the difference but we can't solve that by special
> casing NS case.

Great, we agree on the problem definition ... as I said, I'm not saying
this patch is the solution, but it gives us a starting point for
exploring whether there is a solution.

>   This is stemming from the fact that an unpriv application can't 
> create its sub-cgroups without explicit delegation from the root and
> that has always been an explicit design choice.
> It's tied to who's responsible for cleanup afterwards and what 
> happens when the process gets migrated to a different cgroup.  The 
> latter is an important issue on v1 hierarchies because migrating 
> tasks sometimes is used as a way to control resource distribution.

OK, so is the only problem cleanup?  If so, what if I proposed that a
cgroup directory could only be created by the owner of the userns
(which would be any old unprivileged user) iff they create a cgroup ns
and the cgroup ns would be responsible for removing it again, so the
cgroup subdirectory would be tied to the cgroup namespace as its holder
and we'd use release of the cgroup to remove all the directories?

James

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v4 0/2] cgroup: allow management of subtrees by new cgroup namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-14 05:30 +0200
  [PATCH v4 2/2] cgroup: implement subtree creation on copy_cgroup_ns() Aleksa Sarai <asarai@suse.de> - 2016-05-14 05:30 +0200
  Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-20 16:50 +0200
    Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-20 17:30 +0200
      Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-05-20 17:40 +0200
        Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-20 18:10 +0200
          Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-05-20 18:10 +0200
            Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-20 18:20 +0200
              Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-05-20 18:30 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-20 18:40 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-20 19:10 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-05-20 19:30 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-20 19:50 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new cgroup namespaces Aleksa Sarai <cyphar@cyphar.com> - 2016-05-28 07:20 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces "W. Trevor King" <wking@tremily.us> - 2016-05-20 19:50 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new cgroup namespaces Aditya Kali <adityakali@google.com> - 2016-05-20 19:40 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-05-20 20:00 +0200

csiph-web