From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel Lezcano Subject: Re: [PATCH 0/9] Multiple devpts instances Date: Thu, 19 Feb 2009 19:09:45 +0100 Message-ID: <499DA069.3040603@free.fr> References: <20081015053000.GA2039@us.ibm.com> <499D7E13.10601@free.fr> <499D97B1.1090902@zytor.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <499D97B1.1090902-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "H. Peter Anvin" Cc: kyle-hoO6YkzgTuCM0SS3m2neIg@public.gmane.org, "David C. Hansen" , bastian-yyjItF7Rl6lg9hUCZPvPmw@public.gmane.org, ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org, containers-qjLDD68F18O7TbgM5vRIOg@public.gmane.org, sukadev-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org, alan-qBU/x9rampVanCEyBjwyrvXRex20P6io@public.gmane.org, xemul-GEFAQzZX7r8dnm+yROfE0A@public.gmane.org List-Id: containers.vger.kernel.org H. Peter Anvin wrote: > Daniel Lezcano wrote: > >> sukadev-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org wrote: >> >>> Enable multiple instances of devpts filesystem so each container can >>> allocate >>> ptys independently. >>> >>> >> Hi suka, >> >> It looks like the /proc/sys/kernel/pty/max and nr are not virtualized. >> Modifying in the container the "max" pty, that impacts the init_pty. >> Same as nr which does not show the real number of pty allocated for the >> container. >> >> Are you planning to fix this ? >> >> > > That's a separate issue, i.e. a resource allocation > localization/globalization issue. The main reason for these limits is > top put a cap on the amount of low kernel memory used on 32-bit systems > especially, which is somewhat inherently global. > > Resource limit partitioning is a much bigger and orthogonal problem. > In this case we don't have the pty allocated independently, no ? I mean one container can allocate 4095 pty, making a pty starvation for others containers. Or imagine I am a vilain and I want to mess the other containers, I can do echo 0 > /proc/sys/kernel/pty/max. AFAIR, we said people making isolation of a resource is in charge (if it is relevant), to take into account the /proc/sys part. For example, making the network per namespace all the network configuration variable located in /proc/sys/net are per namespace too. When it is irrelevant the file is read-only or just not displayed. IMHO, pty/max and pty/nr is part of the "multiple devpts instances" feature.