From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755598Ab3AYJ7S (ORCPT ); Fri, 25 Jan 2013 04:59:18 -0500 Received: from out03.mta.xmission.com ([166.70.13.233]:35505 "EHLO out03.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753520Ab3AYJ7P (ORCPT ); Fri, 25 Jan 2013 04:59:15 -0500 From: ebiederm@xmission.com (Eric W. Biederman) To: "Michael Kerrisk \(man-pages\)" Cc: Linux Containers , Date: Fri, 25 Jan 2013 01:59:05 -0800 Message-ID: <87ip6llh1y.fsf@xmission.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-AID: U2FsdGVkX1+Kfn79Pp6SUIYwcdPrIYA7WdUcDwMeGmE= X-SA-Exim-Connect-IP: 98.207.153.68 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * -3.0 BAYES_00 BODY: Bayes spam probability is 0 to 1% * [score: 0.0044] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa06 1397; Body=1 Fuz1=1 Fuz2=1] X-Spam-DCC: XMission; sa06 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ;"Michael Kerrisk \(man-pages\)" X-Spam-Relay-Country: Subject: User namespaces and the memory control group X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org For anyone who cares about resource control setting up the memory control group in combination with user namespaces is strongly recommended. User namespaces are a particular problem when it comes to resource control. Not all of the resources you can create with a user namespace currently have ordinary resource limits. When you can switch uids the ordinary resource limits don't mean much. The memory control group is capable of limiting all of those things today. So if you care about keeping rude users of your system under control and you enable user namespaces setting up memory control groups is to limit them is strongly recommended. Eric