4 ms·
If running as a privileged user, you can run the process in just a PID namespace with no other container features enabled using the unshare command. Systemd ca
by paulfurtado 5y ago
If running as a privileged user, you can run the process in just a PID namespace with no other container features enabled using the unshare command.
Systemd can also handle it by killing the processes by cgroup i believe, and for non services you could take advantage of that with systemd-run.
- Joker_vD 5y agoAre these things properly "nested"? Imagine a scenario like this: A process is started with "unshare A" or "cgexec A" or whatever, then it creates children one of which does "unshare B" or "cgexec B", then the first process, "A", is killed, or its cgroup is signalled, whatever. Will the process "B", that was put into a new namespace/cgroup, be terminated too or not? With traditional pgroups/sessions the answer is "no", and I'd like it to be "yes", so no runaway processes should be possible. I personally think the only way to make a "detached" process should be by asking some process from an entirely different "group" (over RPC, presumably) to launch something for you: so that the newly created process would technically be a children of this other "launcher" process.