Quoting Daniel Lezcano ([email protected]): > The ns_cgroup is an annoying cgroup at the namespace / cgroup frontier.
True. However, it remains - apart from using smack or SELinux - the only way to truly lock a container into a cgroup configuration. That's unlikely to change until we finally support user namespaces in the VFS. Do we worry about that? -serge _______________________________________________ Containers mailing list [email protected] https://lists.linux-foundation.org/mailman/listinfo/containers _______________________________________________ Devel mailing list [email protected] https://openvz.org/mailman/listinfo/devel
