3 ms·

There isn’t really a thing called a memory namespace, in Linux or the BSDs at least. In Linux there are cgroups that deal with accounting and you can share VM s

There isn’t really a thing called a memory namespace, in Linux or the BSDs at least. In Linux there are cgroups that deal with accounting and you can share VM space among cloned processes (which we then typically refer to as threads). Neither of these affect the ability to share memory among processes. The only namespace that matters here is the filesystem/mount namespace. There is no reason you can’t access the same shared SQLite database on a common volume between containers on Linux for instance.

kuschku 4y ago
If you're using a system with SELinux, your containers won't be able to use the same shared memory file. Which is relatively common, as CoreOS nowadays has SELinux by default.
- fuckstick 4y ago
  > If you're using a system with SELinux, your containers won't be able to use the same shared memory file. That is false. Whether you mmap the same file is dependent on the specific SELinux policy - which is by design, highly configurable. I am also surprised/skeptical that the default configuration for those OSes for a shared volume/mount point would disallow mmaping by default (which is all that is required) - since what is the attack vector they’re preventing? If you can exfiltrate via memory you could just do so via read/write.