Messages in this thread |  | | Date | Mon, 14 Dec 2015 19:52:40 +0000 | | From | One Thousand Gnomes <> | | Subject | Re: [PATCH 1/7] mm: memcontrol: charge swap to cgroup2 |
| |
> Anyway, if you don't trust a container you'd better set the hard memory > limit so that it can't hurt others no matter what it runs and how it > tweaks its sub-tree knobs.
If you don't trust it put it in a VM. If it's got access to GEM graphics ioctls/nodes or some other kernel interfaces then it can blow up the kernel without trying hard unless its constrained within a VM. VMs can be extremely light weight if you avoid KVM emulating an entire PC.
Alan
|  |