5 ms·
Drop them into cgroup so the new pids can't run away is I think only reliable one
by xani_ 4y ago
Drop them into cgroup so the new pids can't run away is I think only reliable one
- teddyh 4y agoAs explained in the link, although constrained processes can not escape the cgroup, they can fork off another PID indefinitely. Also, the old PID the forking leaves behind might be re-used by some other new process in another cgroup, and now you’ve killed the wrong process. Oops!
- nrclark 4y agoSolid approach for desktop Linux. Not possible on Unix in a general sense, because cgroups are a Linux-specific thing. They also depend on having certain kernel options enabled. So if you want to write software that can target MacOS or any of the BSDs, then you can't use cgroups.