From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753343AbbBKQA1 (ORCPT ); Wed, 11 Feb 2015 11:00:27 -0500 Received: from h2.hallyn.com ([78.46.35.8]:45391 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752836AbbBKQAZ (ORCPT ); Wed, 11 Feb 2015 11:00:25 -0500 Date: Wed, 11 Feb 2015 17:00:23 +0100 From: "Serge E. Hallyn" To: Tejun Heo Cc: "Eric W. Biederman" , "Serge E. Hallyn" , Richard Weinberger , Linux API , Linux Containers , Serge Hallyn , "linux-kernel@vger.kernel.org" , Andy Lutomirski , cgroups mailinglist , Ingo Molnar Subject: Re: [PATCHv3 8/8] cgroup: Add documentation for cgroup namespaces Message-ID: <20150211160023.GA1579@mail.hallyn.com> References: <878uhe42km.fsf@x220.int.ebiederm.org> <20150107230615.GA28630@htj.dyndns.org> <87fvbm2nni.fsf@x220.int.ebiederm.org> <87y4peyxw5.fsf@x220.int.ebiederm.org> <20150107233553.GC28630@htj.dyndns.org> <20150211034616.GA25022@mail.hallyn.com> <20150211040957.GC21356@htj.duckdns.org> <20150211042942.GA27931@mail.hallyn.com> <87oap1qbv3.fsf@x220.int.ebiederm.org> <20150211051704.GB24897@mtj.duckdns.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150211051704.GB24897@mtj.duckdns.org> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Quoting Tejun Heo (tj@kernel.org): > Hey, > > On Tue, Feb 10, 2015 at 11:02:40PM -0600, Eric W. Biederman wrote: > > A slightly off topic comment, for where this thread has gone but > > relevant if we are talking about cgroup namespaces. > > > > If don't implement compatibility with existing userspace, they get a > > nack. A backwards-incompatible change should figure out how to remove > > the need for any namespaces. > > > > Because that is what namespaces are about backwards compatibility. > > Are you claiming that namespaces are soley about backwards > compatibility? ie. to trick userland into scoping without letting it > notice? That's a very restricted view and namespaces do provide > further isolation capabilties in addition to what can be achieved > otherwise and it is logical to collect simliar funtionalities there. We absolutely would love to use cgroup namespaces to run older userspace in containers. I don't know that it's actually possible to do both that and use unified hierarchy at the same time though, which is unfortunate. So an Ubuntu 12.04 container will never, afaics, be able to run inside an ubuntu 16.04 host that is using unified hierarchy, without using backported newer versions of lxc (etc) in the container.