Re: [PATCH 0/6] cgroup: add isolation_root flag, poor man's namespaces for cgroups

[Paul Menage <paul@paulmenage.org>]

On Thu, Oct 20, 2011 at 3:25 AM, Witold Krecicki <wpk@culm.net> wrote:
> I tried to make it as simple as possible - and this approach (looking at patch
> length) seemed to be the simplest (we really don't care about 'other' cgroups
> that might appear).

Right, this is a nicely simple approach that gets rid of some nasty
incompatibilities between containers and cgroups, so it's a great
first step. But it still limits what containers can do with cgroups
(in terms of combining subsystems in hierarchies), hence the idea that
we plan what we might want to do later, and at least make the API
something that could also accommodate the possible future. (In the
same sense that the cgroups mount API has always supported the
possibility of mounting a subsystem on multiple hierarchies at once,
even if the patches to implement it didn't appear for another year or
so and are still languishing and bit-rotting).

> Other approaches would probably require major rewrites of cgroups code.

Not major rewrites, really, but definitely some fiddly replumbing.

Paul