One more bit aside, I've a python script which does a little cgroup wrangling that accomplishes some cgroup nesting for me. It can successfully do things like limit the memory of processes using that inner cgroup. This of course doesn't rely on apparmor, as it just manipulates the cgroup definitions for the target process a bit. This is what leads me to wonder if/why apparmor is strictly necessary for the lxc nesting, or if there are other alternatives (even if those alternatives are trickier.)
_______________________________________________ lxc-users mailing list [email protected] http://lists.linuxcontainers.org/listinfo/lxc-users
