Il giorno 08/mar/2011, alle ore 12.51, Damjan Georgievski ha scritto: >>> - first of all, the for(;;) endless loop for starting a namespace is too >>> aggressive. If there's any error in the namespaced child, it'll take >>> 100% of a cpu. Some kind of backoff would be required here (although >>> that comes close to an implementation of an init system) >> >> The only thing coming to my mind is having a sleeping system (similar to >> anti-fork-bombing in the master) where the more errors appear the more >> sleep time will be used. Other ideas ? > > That seems good enough.
For now, i have modified the waitpid() cycle to stop if the jailed process exit with 1 (in uWSGI this signal an unrecoverable error) > > >>> - the second problem is that uwsgi first unmounts all the mount points, >>> and if the wanted ns root is on a separate filesystem (say /home) it'll >>> get unmounted, before it's bind mounted on ns_tmp_mountpoint. >>> (a chdir(uwsgi.ns) before unmount all, helps) >> >> this will leave the original /home mounted in the jail or am i missing >> something ? > > I think it should be reorganized a bit. Maybe, move the unmounting > after the pivot_root. > you remount /proc explicitly and the namespace root will stay mounted. > I will try to find how other projects do this dance. moving unmount cycle after pivot_root seems to have solved the issue (remember that the virtual fs rootfs cannot be umounted, but this is not a problem as it is only e entrypoint for mount namespace and has nothing to do with the original / filesystem) Check the latest tip -- Roberto De Ioris http://unbit.it _______________________________________________ uWSGI mailing list [email protected] http://lists.unbit.it/cgi-bin/mailman/listinfo/uwsgi
