[
https://issues.apache.org/jira/browse/MESOS-4262?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15094209#comment-15094209
]
Avinash Sridharan commented on MESOS-4262:
------------------------------------------
Hi Cong,
The net_cls cgroup is provided by the linux kernel and allows for tagging
packets within the kernel. There are tools (tc and iptables for e.g) that use
these tags to enforce network policies. This is a much more generic way of
allowing external tools (which are very mature and flexible) to be used for
traffic enforcement.
You can go through the link posted in the description
(https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt) to better
understand what net_cls cgroups offers.
Can you point out the code you are referring to ?
> Enable net_cls subsytem in cgroup infrastructure
> ------------------------------------------------
>
> Key: MESOS-4262
> URL: https://issues.apache.org/jira/browse/MESOS-4262
> Project: Mesos
> Issue Type: Improvement
> Components: containerization
> Reporter: Avinash Sridharan
> Assignee: Avinash Sridharan
> Labels: container, mesosphere
>
> Currently the control group infrastructure within mesos supports only the
> memory and CPU subsystems. We need to enhance this infrastructure to support
> the net_cls subsystem as well. Details of the net_cls subsystem and its
> use-cases can be found here:
> https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt
> Enabling the net_cls will allow us to provide operators to, potentially,
> regulate framework traffic on a per-container basis.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
