From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <netdev-owner@vger.kernel.org>
Received: from mail-pf0-f195.google.com ([209.85.192.195]:41699 "EHLO
        mail-pf0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751000AbeCNSBM (ORCPT
        <rfc822;netdev@vger.kernel.org>); Wed, 14 Mar 2018 14:01:12 -0400
Received: by mail-pf0-f195.google.com with SMTP id f80so1733591pfa.8
        for <netdev@vger.kernel.org>; Wed, 14 Mar 2018 11:01:12 -0700 (PDT)
Date: Wed, 14 Mar 2018 11:01:08 -0700
From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
To: Mahesh Bandewar
         =?utf-8?B?KOCkruCkueClh+CktiDgpKzgpILgpKHgpYfgpLXgpL4=?=
         =?utf-8?B?4KSwKQ==?= <maheshb@google.com>
Cc: Alexei Starovoitov <ast@kernel.org>,
        David Miller <davem@davemloft.net>, daniel@iogearbox.net,
        linux-netdev <netdev@vger.kernel.org>, kernel-team@fb.com
Subject: Re: [PATCH RFC bpf-next 0/6] bpf: introduce cgroup-bpf bind,
 connect, post-bind hooks
Message-ID: <20180314180106.dhvdtaspx5kjkb4a@ast-mbp>
References: <20180314033934.3502167-1-ast@kernel.org>
 <CAF2d9jimTh3LnVGwDQ-MsK7nVY=g5bVSk+=RTp0Qwz4-ZF0-jg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <CAF2d9jimTh3LnVGwDQ-MsK7nVY=g5bVSk+=RTp0Qwz4-ZF0-jg@mail.gmail.com>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

On Wed, Mar 14, 2018 at 10:22:03AM -0700, Mahesh Bandewar (महेश बंडेवार) wrote:
> On Tue, Mar 13, 2018 at 8:39 PM, Alexei Starovoitov <ast@kernel.org> wrote:
> > For our container management we've been using complicated and fragile setup
> > consisting of LD_PRELOAD wrapper intercepting bind and connect calls from
> > all containerized applications.
> > The setup involves per-container IPs, policy, etc, so traditional
> > network-only solutions that involve VRFs, netns, acls are not applicable.
> You can keep the policies per cgroup but move the ip from cgroup to
> net-ns and then none of these ebpf hacks are required since cgroup and
> namespaces are orthogonal you can use cgroups in conjunction with
> namespaces.

answered in reply to Eric. Pls follow up there if it's still not clear.