From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf0-f175.google.com ([209.85.192.175]:35917 "EHLO mail-pf0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751755AbeCNSAo (ORCPT ); Wed, 14 Mar 2018 14:00:44 -0400 Received: by mail-pf0-f175.google.com with SMTP id 68so1742966pfx.3 for ; Wed, 14 Mar 2018 11:00:44 -0700 (PDT) Date: Wed, 14 Mar 2018 11:00:39 -0700 From: Alexei Starovoitov To: David Ahern Cc: Alexei Starovoitov , davem@davemloft.net, daniel@iogearbox.net, netdev@vger.kernel.org, kernel-team@fb.com Subject: Re: [PATCH RFC bpf-next 0/6] bpf: introduce cgroup-bpf bind, connect, post-bind hooks Message-ID: <20180314180038.o3lm7hkbe5ollehz@ast-mbp> References: <20180314033934.3502167-1-ast@kernel.org> <0edde01a-c9bb-7de2-ede1-dc52996c12c2@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <0edde01a-c9bb-7de2-ede1-dc52996c12c2@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: On Wed, Mar 14, 2018 at 10:13:22AM -0700, David Ahern wrote: > On 3/13/18 8:39 PM, Alexei Starovoitov wrote: > > For our container management we've been using complicated and fragile setup > > consisting of LD_PRELOAD wrapper intercepting bind and connect calls from > > all containerized applications. > > The setup involves per-container IPs, policy, etc, so traditional > > network-only solutions that involve VRFs, netns, acls are not applicable. > > Why does VRF and the cgroup option to bind sockets to the VRF not solve > this problem for you? The VRF limits the source address choices. answered in reply to Eric. Pls follow up there if it's still not clear.