[Devel] Re: cgroup attach/fork hooks consistency with the ns_cgroup

[Paul Menage]

On Wed, Jun 17, 2009 at 2:26 PM, Serge E. Hallyn<serue at us.ibm.com> wrote:
>
> The ns cgroup is really only good for preventing root in a container
> from escaping its cgroup-imposed limits.  The same can be done today
> using smack or selinux, and eventually will be possible using user
> namespaces.  Would anyone object to removing ns_cgroup?

Sounds reasonable to me. It feels to me that there ought to be some
good way to integrate namespaces and cgroups, but I'm not quite sure
exactly how, and ns_cgroup sort of hovers in the "toy" category rather
than something very useful.

Paul
_______________________________________________
Containers mailing list
Containers at lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containers