[lkml]   [2005]   [Dec]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [ckrm-tech] Re: [RFC][patch 00/21] PID Virtualization: Overview and Patches
On Fri, 2005-12-16 at 18:47 -0500, Hubertus Franke wrote:
> On Fri, 2005-12-16 at 09:35 -0800, Dave Hansen wrote:
> > I've been talking a lot lately about how important filesystem isolation
> > between containers is to implement containers properly. Isolating the
> > filesystem namespaces makes it much easier to do things like fs-based
> > shared memory during a checkpoint/resume. If we want to allow tasks to
> > move around, we'll have to throw out this entire concept. That means
> > that a _lot_ of things get a notch closer to the too-costly-to-implement
> > category.
> >
> Not only that, as the example of pids already show, while at the surface
> these might seem as desirable features ( particular since they came up
> wrt to the CKRM discussion ), there are significant technical limitation
> to these.

Perhaps merging the container process grouping functionality is not a
good idea.

However, I think CKRM could be made minimally consistent with
containers using a few small modifications. I suspect all that is
necessary is:

1) Expanding the pid syntax accepted and reported when accessing the
members file to include an optional container id:

# classify init in container 0 to a class
echo 0:1 >> ${RCFS}/class_foo/members
echo :1 >> ${RCFS}/class_foo/members

# while in container 0 classify init in container 0 to a class
echo 1 >> ${RCFS}/class_foo/members

# while in container 0 classify init in container 3 to a class
echo 3:1 >> ${RCFS}/class_foo/bar_class/members

Then pids in container 0 would show up as cid:pid
$ cat ${RCFS}/class_foo/members

Processes listing members in container n would only see the pid
and only pids in that container.

2) Limiting the pids and container ids accepted as input to the members
file from processes doing classification from within containers:

# classify init in the current container to a class
echo :1 >> ${RCFS}/class_foo/members
echo 1 >> ${RCFS}/class_foo/members

# returns an error when not in container 0
echo 0:1 >> ${RCFS}/class_foo/members
# returns an error when not in container 1
echo 1:1 >> ${RCFS}/class_foo/members

(Incidentally these kind of details are what I was referring to earlier
in this thread as "visibility boundaries")

I think this would be sufficient to make CKRM and containers play
nicely with each other. I suspect further kernel-enforced constraints
between CKRM and containers may constitute policy and not functionality.

<shameless_plug>I also suspect that with the right userspace
classification engine a wide variety of useful container resource
management policies could be enforced based on these simple

-Matt Helsley

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-12-17 02:28    [W:0.079 / U:8.700 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site