From: Benny Amorsen <benny+usenet-sjWZyPj6pFx/SzgSGea1oA@public.gmane.org>
To: "Serge E. Hallyn"
<public-serue-r/Jw6+rmf7HQT0dZR+AlfA-z5DuStaUktnZ+VzJOa5vwg@public.gmane.org>
Cc: Grzegorz Nosek
<public-root-AfQBxy1nhrQ00sYp1HPQUA-z5DuStaUktnZ+VzJOa5vwg@public.gmane.org>,
public-containers-qjLDD68F18O7TbgM5vRIOg-z5DuStaUktnZ+VzJOa5vwg@public.gmane.org
Subject: Re: [RFC][PATCH] IP address restricting cgroup subsystem
Date: Thu, 08 Jan 2009 13:43:15 +0100 [thread overview]
Message-ID: <m34p0at1cs.fsf@ursa.amorsen.dk> (raw)
In-Reply-To: <20090107193234.GA22625-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org> (Serge E. Hallyn's message of "Wed\, 7 Jan 2009 13\:32\:34 -0600")
"Serge E. Hallyn" <serue-r/Jw6+rmf7HQT0dZR+AlfA-XMD5yJDbdMReXY1tMh2IBg@public.gmane.org>
writes:
> Does anyone else (Eric? Pavel?) have experience with hundreds
> or thousands of network namespaces?
Hundreds aren't a problem with OpenVZ (I do that in production) and
the vanilla kernel namespaces shouldn't be heavier. I don't think
performance is a good argument for the patch.
However, I do see the appeal of patch anyway. It would be tempting to
use cgroups inside a network namespace for administrative reasons,
like Grzegorz Nosek proposed. I am not sure if you can create name
spaces with the semantics he proposed:
- INADDR_LOOPBACK is explicitly allowed (a special case)
- INADDR_ANY is remapped to _the_ IP address
- _the_ IP address is passed through unharmed
- everything else causes -EPERM
If you can get those semantics (or something close) already, then the
patch isn't useful.
/Benny
next prev parent reply other threads:[~2009-01-08 12:43 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-01-06 23:05 [RFC][PATCH] IP address restricting cgroup subsystem Grzegorz Nosek
[not found] ` <20090106230554.GB25228-IaEwMO9oKu/77SC2UrCW1JJg/dWx8T/9@public.gmane.org>
2009-01-07 6:01 ` Li Zefan
[not found] ` <49644526.8030205-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2009-01-07 7:38 ` Grzegorz Nosek
2009-01-07 8:36 ` Li Zefan
2009-01-07 9:16 ` Grzegorz Nosek
2009-01-07 9:33 ` Li Zefan
2009-01-07 9:37 ` Grzegorz Nosek
2009-01-09 21:38 ` [Devel] " Paul Menage
2009-01-10 4:50 ` Li Zefan
2009-01-10 16:14 ` Paul Menage
2009-01-12 2:20 ` Li Zefan
2009-01-14 2:07 ` Paul Menage
2009-01-14 2:47 ` Li Zefan
2009-01-14 2:50 ` Paul Menage
2009-01-07 18:07 ` Serge E. Hallyn
[not found] ` <20090107180752.GA19153-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>
2009-01-07 19:15 ` Grzegorz Nosek
[not found] ` <20090107191536.GA15159-yp6mvK3Bdd2rDJvtcaxF/A@public.gmane.org>
2009-01-07 19:32 ` Serge E. Hallyn
[not found] ` <20090107193234.GA22625-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>
2009-01-08 12:43 ` Benny Amorsen [this message]
[not found] ` <20090109144122.GA9685@megiteam.pl>
[not found] ` <20090109162247.GA7925@us.ibm.com>
[not found] ` <20090109162247.GA7925-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>
2009-01-09 16:57 ` Grzegorz Nosek
2009-01-09 16:54 ` Dan Smith
[not found] ` <87priwifnu.fsf-FLMGYpZoEPULwtHQx/6qkW3U47Q5hpJU@public.gmane.org>
2009-01-09 17:43 ` Guenter Roeck
[not found] ` <20090109174334.GA4526-gvzKVTG1yJJBDgjK7y7TUQ@public.gmane.org>
2009-01-09 18:12 ` Dan Smith
[not found] ` <87ljtkic1j.fsf-FLMGYpZoEPULwtHQx/6qkW3U47Q5hpJU@public.gmane.org>
2009-01-09 22:37 ` Guenter Roeck
[not found] ` <20090109223756.GA22738-gvzKVTG1yJJBDgjK7y7TUQ@public.gmane.org>
2009-01-09 22:47 ` Serge E. Hallyn
[not found] ` <20090109224742.GA15227-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>
2009-01-09 23:37 ` Guenter Roeck
2009-01-09 18:30 ` Serge E. Hallyn
[not found] ` <20090109183046.GA14063-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>
2009-01-13 16:23 ` Dan Smith
2009-01-09 21:58 ` [Devel] " Paul Menage
[not found] ` <6599ad830901091358m11effdbegeff6cbb7ee28e262-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2009-01-10 11:20 ` Grzegorz Nosek
[not found] ` <20090110112009.GA12336-yp6mvK3Bdd2rDJvtcaxF/A@public.gmane.org>
2009-01-10 16:21 ` Paul Menage
[not found] ` <6599ad830901100821q2c943d38i314c00f7db51b4f0-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2009-01-11 0:25 ` Benny Amorsen
2009-01-11 10:19 ` Grzegorz Nosek
[not found] ` <20090111101946.GA14325-yp6mvK3Bdd2rDJvtcaxF/A@public.gmane.org>
2009-01-14 2:21 ` Paul Menage
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=m34p0at1cs.fsf@ursa.amorsen.dk \
--to=benny+usenet-sjwzypj6pfx/szgsgea1oa@public.gmane.org \
--cc=public-containers-qjLDD68F18O7TbgM5vRIOg-z5DuStaUktnZ+VzJOa5vwg@public.gmane.org \
--cc=public-root-AfQBxy1nhrQ00sYp1HPQUA-z5DuStaUktnZ+VzJOa5vwg@public.gmane.org \
--cc=public-serue-r/Jw6+rmf7HQT0dZR+AlfA-z5DuStaUktnZ+VzJOa5vwg@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.