From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Daniel P. Berrange" Subject: Mapping between host & container PIDs ? Date: Tue, 27 Nov 2012 10:15:55 +0000 Message-ID: <20121127101555.GE24370@redhat.com> Reply-To: "Daniel P. Berrange" Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Linux Containers List-Id: containers.vger.kernel.org I'm trying to find out if there is a way to map between host and container PIDs, at minimum in the host -> container direction. My use case is to be able to kill processes associated with a container, based on the host PID, in a race free manner. Given a host PID, I can read the 'tasks' file for the container's cgroup to verify that the PID is associated with the container in question. Then I can kill the PID with a signal. There is a small race condition in there, where the PID could die & a new process could be born using the original PID. Now this might not be very likely but I was thinking that if it is possible to map from a host PID to a container PID, you can do it more safely. eg Lookup the container PID associted with the host PID, then setns() into the container and kill the container PID. Now although there is still a race condition, you are guaranteed that if the race hits you'll only kill a process within the same container, not the host at large, which is good when the user invoking the API is unprivileged. Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|