From mboxrd@z Thu Jan 1 00:00:00 1970 From: "H. Peter Anvin" Subject: Re: [RFC][PATCH 0/7] Clone PTS namespace Date: Wed, 09 Apr 2008 11:01:16 -0700 Message-ID: <47FD046C.6070804@zytor.com> References: <20080408215333.GA8799@us.ibm.com> <47FC138B.4070408@zytor.com> <20080409162353.GA14044@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20080409162353.GA14044-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: sukadev-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org Cc: Containers , clg-NmTC/0ZBporQT0dZR+AlfA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Pavel Emelyanov List-Id: containers.vger.kernel.org sukadev-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org wrote: > We want to provide isolation between containers, meaning PTYs in container > C1 should not be accessible to processes in C2 (unless C2 is an ancestor). Yes, I certainly can understand the desire for isolation. That wasn't what my question was about. > The other reason for this in the longer term is for checkpoint/restart. > When restarting an application we want to make sure that the PTY indices > it was using is available and isolated. OK, this would be the motivation for index isolation. > A complete device-namespace could solve this, but IIUC, is being planned > in the longer term. We are hoping this would provide the isolation in the > near-term without being too intrusive or impeding the implementation of > the device namespace. I'm just worried about the accumulation of what feels like ad hoc namespaces, causing a very large combination matrix, a lot of which don't make sense. -hpa