The following pull request was submitted through Github.
It can be accessed and reviewed at: https://github.com/lxc/lxc/pull/3355
This e-mail was sent by the LXC bot, direct replies will not reach the author
unless they happen to be subscribed to this list.
=== Description (from pull-request) ===
Signed-off-by: Christian Brauner <christian.brau...@ubuntu.com>
From 6723dcc892fd54bd56241ae7f2825a219b44e95f Mon Sep 17 00:00:00 2001
From: Christian Brauner <christian.brau...@ubuntu.com>
Date: Sat, 4 Apr 2020 12:07:43 +0200
Subject: [PATCH] api-extensions: add and document cgroup_advanced_isolation
Signed-off-by: Christian Brauner <christian.brau...@ubuntu.com>
---
doc/api-extensions.md | 14 ++++++++++++++
src/lxc/api_extensions.h | 1 +
2 files changed, 15 insertions(+)
diff --git a/doc/api-extensions.md b/doc/api-extensions.md
index 5767583af9..341ae00dee 100644
--- a/doc/api-extensions.md
+++ b/doc/api-extensions.md
@@ -118,3 +118,17 @@ This adds a new API function `init_pidfd()` which allows
to retrieve a pidfd for
## pidfd
When running on kernels that support pidfds LXC will rely on them for most
operations. This makes interacting with containers not just more reliable it
also makes it significantly safer and eliminates various races inherent to
PID-based kernel APIs. LXC will require that the running kernel at least
support `pidfd_send_signal()`, `CLONE_PIDFD`, `P_PIDFD`, and pidfd polling
support. Any kernel starting with `Linux 5.4` should have full support for
pidfds.
+
+## cgroup\_advanced\_isolation
+
+Privileged containers will usually be able to override the cgroup limits given
+to them. This introduces three new configuration keys `lxc.cgroup.dir.monitor`,
+`lxc.cgroup.dir.container`, and `lxc.cgroup.dir.container.inner`. The
+`lxc.cgroup.dir.monitor` and `lxc.cgroup.dir.container` keys can be used to
+set to place the `monitor` and the `container` into different cgroups. The
+`lxc.cgroup.dir.container.inner` key can be set to a cgroup that is
+concatenated with `lxc.cgroup.dir.container`. When
+`lxc.cgroup.dir.container.inner` is set the container will be placed into the
+`lxc.cgroup.dir.container.inner` cgroup but the limits will be set in the
+`lxc.cgroup.dir.container` cgroup. This way privileged containers cannot escape
+their cgroup limits.
diff --git a/src/lxc/api_extensions.h b/src/lxc/api_extensions.h
index 9ff071edf3..71931e3e21 100644
--- a/src/lxc/api_extensions.h
+++ b/src/lxc/api_extensions.h
@@ -38,6 +38,7 @@ static char *api_extensions[] = {
"cgroup2_devices",
#endif
"cgroup2",
+ "cgroup_advanced_isolation",
};
static size_t nr_api_extensions = sizeof(api_extensions) /
sizeof(*api_extensions);
_______________________________________________
lxc-devel mailing list
lxc-devel@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
