From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Serge E. Hallyn" Subject: udev in containers Date: Fri, 28 Jan 2011 08:48:27 -0600 Message-ID: <20110128144827.GA4981@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Eric W. Biederman" , Oren Laadan , Daniel Lezcano , containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Tej List-Id: containers.vger.kernel.org Hi, Now that we are allowing udev to run in containers, Daniel has noticed that updates to sysfs uevent files will trigger a flurry of activity in all containers on the host. While not a problem with just a few containers, this can severaly impact performance with hundreds or more containers. (Daniel, would it be possible for you to get some measurements on host and in a container versus # of active containers, with and without udev? Do you have a otehrwise unused machien you could try that on?) Is there anything we can/should do about this? Two approaches, neither sufficiently thought out yet, would be to generalize the directory tagging currently used for /sys/class/net, and full-fledged implementation of a device namespace. The directory tagging would probably only work if we can assign multiple tags to a device, but we could for instance make /sys/block tagged, and really no container probably needs to see /sys/block/sda. The device namespace would be similar, except I suspect it would not only hide certain devices from certain namespaces, but it would actually virtualize the device major:minor mapping, for checkpoint/restart, so that /dev/sda could be redirected to another device more completely than simply fudging the nodes under /dev. Comments? Designs? Plans? thanks, -serge