[
https://issues.apache.org/jira/browse/MESOS-4343?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15174725#comment-15174725
]
Vinod Kone commented on MESOS-4343:
-----------------------------------
Can you add a blurb in the CHANGELOG describing this feature? This is one of
the few epics going into the 0.28.0 release. Great to see that there is already
a user doc for this.
> Introduce the ability to assign network handles to mesos containers
> -------------------------------------------------------------------
>
> Key: MESOS-4343
> URL: https://issues.apache.org/jira/browse/MESOS-4343
> Project: Mesos
> Issue Type: Epic
> Components: containerization
> Reporter: Avinash Sridharan
> Assignee: Avinash Sridharan
> Labels: containers, mesosphere
> Fix For: 0.28.0
>
>
> Linux provides net_cls as a cgroup subsystem. A net_cls cgroup is associated
> with a 16-bit major handle and a 16-bit minor handle. When a task is
> associated with a net_cls cgroup, the kernel tags every packet being
> generated by the task with the major and minor handle associated with the
> net_cls cgroup. These tags are then used by network performance shaping and
> firewall tools such as tc (traffic controller) and iptables.
> Currently, mesos agents do not provide any isolator that can enable
> mesos-containers in a net_cls cgroup, or assign network handles to a net_cls
> cgroup. As part of this epic we plan to achieve the following:
> a) Implement net_cls cgroup isolator for mesos agents.
> b) Implement a manager for the net_cls handles.
> c) Allow operators to set a major network handle when launching an agent.
> d) Expose the net_cls network handle allocated to a container, to entities
> such as operators and frameworks.
> Once the above goals are met operators can learn about network handles
> allocated to containers and apply them to tools such as tc and iptables to
> enforce network policies.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
