From: "Kazunaga Ikeno" <k-ikeno@ak.jp.nec.com>
To: "'Vivek Goyal'" <vgoyal@redhat.com>,
"'linux kernel mailing list'" <linux-kernel@vger.kernel.org>
Cc: "'Libcg Devel Mailing List'" <libcg-devel@lists.sourceforge.net>,
"'Balbir Singh'" <balbir@linux.vnet.ibm.com>,
"'Dhaval Giani'" <dhaval@linux.vnet.ibm.com>,
"'Paul Menage'" <menage@google.com>,
"'Peter Zijlstra'" <pzijlstr@redhat.com>,
<kamezawa.hiroyu@jp.fujitsu.com>,
"'Morton Andrew Morton'" <akpm@linux-foundation.org>
Subject: RE: [RFC] How to handle the rules engine for cgroups
Date: Wed, 2 Jul 2008 18:33:08 +0900 [thread overview]
Message-ID: <000d01c8dc26$a3196e80$cc7d220a@kid0000> (raw)
In-Reply-To: <20080701191126.GA17376@redhat.com>
Vivek Goyal wrote:
> Hi,
>
> While development is going on for cgroup and various controllers, we also
> need a facility so that an admin/user can specify the group creation and
> also specify the rules based on which tasks should be placed in respective
> groups. Group creation part will be handled by libcg which is already
> under development. We still need to tackle the issue of how to specify
> the rules and how these rules are enforced (rules engine).
>
> I have gathered few views, with regards to how rule engine can possibly be
> implemented, I am listing these down.
>
> Proposal 1
> ==========
> Let user space daemon hanle all that. Daemon will open a netlink socket
> and receive the notifications for various kernel events. Daemon will
> also parse appropriate admin specified rules config file and place the
> processes in right cgroup based on rules as and when events happen.
>
> I have written a prototype user space program which does that. Program
> can be found here. Currently it is in very crude shape.
>
> http://people.redhat.com/vgoyal/misc/rules-engine-daemon/user-id-based-namespaces.patch
>
> Various people have raised two main issues with this approach.
>
> - netlink is not a reliable protocol.
> - Messages can be dropped and one can loose message. That means a
> newly forked process might never go into right group as meant.
>
> - How to handle delays in rule exectuion?
> - For example, if an "exec" happens and by the time process is moved to
> right group, it might have forked off few more processes or might
> have done quite some amount of memory allocation which will be
> charged to the wring group. Or, newly exec process might get
> killed in existing cgroup because of lack of memory (despite the
> fact that destination cgroup has sufficient memory).
right.
I think it is necessary to avoid these issues.
IMO, In particular a second one (handle may delay).
This issue can always happen.
> Proposal 2
> ==========
> Implement one or more kernel modules which will implement the rule engine.
> User space program can parse the config files and pass it to module.
> Kernel will be patched only on select points to look for the rules (as
> provided by modules). Very minimal code running inside the kernel if there
> are no rules loaded.
>
> Concerns:
> - Rules can become complex and we don't want to handle that complexity in
> kernel.
>
> Pros:
> - Reliable and precise movement of tasks in right cgroup based on rules.
>
> Proposal 3
> ==========
> How about if additional parameters can be passed to system calls and one
> can pass destination cgroup as additional parameter. Probably something
> like sys_indirect proposal. Maybe glibc can act as a wrapper to pass
> additional parameter so that applications don't need any modifications.
>
> Concerns:
> ========
> - Looks like sys_indirect interface for passing extra flags was rejected.
> - Requires extra work in glibc which can also involve parsing of rule
> files. :-(
>
> Proposal 4
> ==========
> Some vauge thoughts are there regarding how about kind of freezing the
> process or thread upon fork, exec and unfreeze it once the thread has been
> placed in right cgroup.
>
> Concerns:
> ========
> - Requires reliable netlink protocol otherwise there is a possibility that
> a task never gets unfrozen.
> - On what basis does one freeze a thread. There might not be any rules to
> process for that thread we will unnecessarily delay it.
>
>
> Please provide your inputs regarding what's the best way to handle the
> rules engine.
>
> To me, letting the rules live in separate module/modules seems to be a
> reasonable way to move forward which will provide reliable and timely
> execution of rules and by making it modular, we can remove most of the
> complexity from core kernel code.
I'd agree with your opinion.
Strict movement of tasks is indispensable in enterprises scene.
Regards, Kazunaga Ikeno
next prev parent reply other threads:[~2008-07-02 9:36 UTC|newest]
Thread overview: 60+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-07-01 19:11 [RFC] How to handle the rules engine for cgroups Vivek Goyal
2008-07-02 9:33 ` Kazunaga Ikeno [this message]
2008-07-03 1:19 ` KAMEZAWA Hiroyuki
2008-07-03 15:54 ` Vivek Goyal
2008-07-04 0:34 ` KAMEZAWA Hiroyuki
2008-07-04 3:17 ` Li Zefan
2008-07-08 9:35 ` Balbir Singh
2008-07-08 13:45 ` Vivek Goyal
2008-07-10 9:23 ` Paul Menage
2008-07-10 14:30 ` Vivek Goyal
2008-07-10 15:42 ` Dhaval Giani
2008-07-10 16:51 ` Paul Menage
2008-07-10 14:48 ` Rik van Riel
2008-07-10 15:40 ` Vivek Goyal
2008-07-10 15:56 ` Ulrich Drepper
2008-07-10 17:25 ` Rik van Riel
2008-07-10 17:39 ` Ulrich Drepper
2008-07-10 18:41 ` Vivek Goyal
2008-07-10 22:29 ` Ulrich Drepper
2008-07-11 0:55 ` KAMEZAWA Hiroyuki
2008-07-14 13:57 ` Vivek Goyal
2008-07-14 14:44 ` David Collier-Brown
2008-07-14 15:21 ` Vivek Goyal
2008-07-17 7:05 ` Kazunaga Ikeno
2008-07-17 13:47 ` Vivek Goyal
[not found] ` <20080717170717.GA3718@linux.vnet.ibm.com>
2008-07-18 8:12 ` [Libcg-devel] " Dhaval Giani
2008-07-18 20:12 ` Vivek Goyal
2008-08-17 10:33 ` [RFC] [PATCH -mm] cgroup: uid-based rules to add processes efficiently in the right cgroup Andrea Righi
2008-08-18 12:35 ` Vivek Goyal
2008-08-19 14:35 ` righi.andrea
2008-08-18 21:05 ` Paul Menage
2008-08-19 12:57 ` Vivek Goyal
2008-08-26 0:54 ` Paul Menage
2008-08-26 13:41 ` Vivek Goyal
2008-08-26 14:35 ` Balbir Singh
2008-08-26 15:04 ` David Collier-Brown
2008-08-26 16:00 ` Vivek Goyal
2008-08-26 16:32 ` David Collier-Brown
2008-08-26 16:08 ` Vivek Goyal
2008-09-04 18:25 ` Paul Menage
2008-08-19 15:12 ` righi.andrea
2008-08-26 0:55 ` Paul Menage
2008-07-14 15:07 ` Re: [RFC] How to handle the rules engine for cgroups kamezawa.hiroyu
2008-07-10 9:07 ` Paul Menage
2008-07-10 14:06 ` Vivek Goyal
2008-07-10 16:41 ` Paul Menage
2008-07-10 17:19 ` Vivek Goyal
2008-07-10 17:27 ` [Libcg-devel] " Dhaval Giani
2008-07-10 14:33 ` Vivek Goyal
2008-07-10 16:46 ` Paul Menage
2008-07-10 17:18 ` [Libcg-devel] " Dhaval Giani
2008-07-10 17:30 ` Paul Menage
2008-07-10 17:44 ` Dhaval Giani
2008-07-10 15:49 ` Dhaval Giani
2008-07-18 9:52 ` KAMEZAWA Hiroyuki
2008-07-18 15:46 ` Paul Menage
2008-07-18 16:39 ` Balbir Singh
2008-07-18 18:55 ` Vivek Goyal
2008-07-18 23:05 ` kamezawa.hiroyu
2008-07-18 23:10 ` kamezawa.hiroyu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='000d01c8dc26$a3196e80$cc7d220a@kid0000' \
--to=k-ikeno@ak.jp.nec.com \
--cc=akpm@linux-foundation.org \
--cc=balbir@linux.vnet.ibm.com \
--cc=dhaval@linux.vnet.ibm.com \
--cc=kamezawa.hiroyu@jp.fujitsu.com \
--cc=libcg-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=menage@google.com \
--cc=pzijlstr@redhat.com \
--cc=vgoyal@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).