IBM Proposing A CPU Namespace For The Linux Kernel - Phoronix
IBM Proposing A CPU Namespace For The Linux Kernel Written by Michael Larabel in Linux Kernel on 9 October 2021 at 06:56 PM EDT. 10 Comments IBM engineer Pratik Sampat published an early prototype of a CPU namespace interface for the Linux kernel. This CPU namespace was devised to address coherency issues with current means of viewing available CPU resources as well as addressing possible security
[RFC PATCH v3 0/8] Count rlimits in each user namespace [LWN.net]
Alexey Gladkov <legion-AT-kernel.org>, Andrew Morton <akpm-AT-linux-foundation.org>, Christian Brauner <christian.brauner-AT-ubuntu.com>, "Eric W . Biederman" <ebiederm-AT-xmission.com>, Jann Horn <jannh-AT-google.com>, Jens Axboe <axboe-AT-kernel.dk>, Kees Cook <keescook-AT-chromium.org>, Linus Torvalds <torvalds-AT-linux-foundation.org>, Oleg Nesterov <oleg-AT-redhat.com> Preface ------- These p
Time namespaces [LWN.net]
Did you know...?LWN.net is a subscriber-supported publication; we rely on subscribers to keep the entire operation going. Please help out by buying a subscription and keeping LWN on the net. The kernel's namespace abstraction allows different groups of processes to have different views of the system. This feature is most often used with containers; it allows each container to have its own view of
Time namespace を試す - ローファイ日記
Time namespace と聞くと、Guitar Freaks & Drum Mania の名曲「Timepiece Phase II」を思い出してしまうんですが、僕だけでしょうか？僕だけですね...。 今日はLinux 5.6 でマージされたらしい、 Time namespace を触ってみることにしました。 git.kernel.org この辺りでマージされた機能ですね。 Linux namespace って？ Linux のコンテナは、ホストから様々なリソースを独立させて切り離された「名前空間」に所属します。リソースの種類ごとに名前空間があり、例えばネットワークのNamespace、マウントポイント情報のNamespace、ホスト名などUTSのNamespaceなどなど、5.5までで7つのドラゴンボールこと名前空間が実装されていました。詳細は コンテナの基礎 tenforward
Audit, namespaces, and containers
Richard Guy Briggs works on the kernel's audit subsystem for Red Hat and has run into some problems with the interaction between the audit daemon (auditd) and namespaces. He gave a report on those difficulties to the Linux Security Summit in Toronto. In the talk, he also looked at containers and what they might mean in the context of audit. Audit was started in 2004, around the same time that the
Mount namespaces, mount propagation, and unbindable mounts [LWN.net]
Mount namespaces, mount propagation, and unbindable mounts In the previous installment of our article series on namespaces, we looked at the key concepts underlying mount namespaces and shared subtrees, including the notions of mount propagation types and peer groups. In this article, we provide some practical demonstrations of the operation of the various propagation types: MS_SHARED, MS_PRIVATE,
Mount namespaces and shared subtrees [LWN.net]
Did you know...?LWN.net is a subscriber-supported publication; we rely on subscribers to keep the entire operation going. Please help out by buying a subscription and keeping LWN on the net. Mount namespaces are a powerful and flexible tool for creating per-user and per-container filesystem trees. They are also a surprisingly complex feature; in this continuation of our series on namespaces we unr
General unprivileged mount support [LWN.net]
Linux Containers <containers@lists.linux-foundation.org>, <linux-fsdevel@vger.kernel.org>, Linux API <linux-api@vger.kernel.org>, James Bottomley <James.Bottomley@HansenPartnership.com>, Djalal Harouni <tixxdz@gmail.com>, "Serge E. Hallyn" <serge@hallyn.com>, Andy Lutomirski <luto@amacapital.net>, Jan Kara <jack@suse.cz>, Jann Horn <jannh@google.com>, Michael Kerrisk <mtk.manpages@gmail.com> As we
namespaces: add transparent user namespaces [LWN.net]
This allows the admin of a user namespace to mark the namespace as transparent. All other namespaces, by default, are opaque. While the current behavior of user namespaces is appropriate for use in containers, there are many programs that only use user namespaces because doing so enables them to do other things (e.g. unsharing the mount or network namespace) that require namespaced capabilities. F
Net Namespace: copy_net_ns()めも - φ(・・*)ゞ ｳｰﾝ カーネルとか弄ったりのメモ
Net Namespaceのcopy_net_ns()の処理を読みます。カーネルのバージョンはv4.5。 まずはデータ構造で、Net Namespaceを表現するデータ構造はstruct net。定義はinlude/net/net_namespace.hにあります。この構造体にuser_namespace構造体とかns_common構造体みたいな名前空間の機能が使うデータもあれば、IPv4のnetns_ipv4構造体、パケットフィルタリングのnetns_nftables構造体などネットワーク関連のデータも諸々あります。 では、本題のcopy_net_ns()を読んでいきます。 351 struct net *copy_net_ns(unsigned long flags, 352 struct user_namespace *user_ns, struct net *old_net) 35
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
ubuntu xenialでnetnsの追加処理を40倍早くする | ten-snapon.com
Container Interfaces for Storage - Are we There Yet?
Filesystem mounts in user namespaces — one year later [LWN.net]
userns: sysctl limits for namespaces [LWN.net]
userns: sysctl limits for namespaces [LWN.net]
Inotify limits per usernamespace [LWN.net]
CGroup Namespaces (v6) [LWN.net]
Support fuse mounts in user namespaces [LWN.net]
isolation.pdf - Google ドライブ
CGroup Namespaces (v5) [LWN.net]