4 ms·
Hm, interesting. I'm certainly largely ignorant of how cgroups works, but I was wishing for a tool like "chroot" that could also "ch-network-namespace" or somet
by pmahoney 12y ago
Hm, interesting. I'm certainly largely ignorant of how cgroups works, but I was wishing for a tool like "chroot" that could also "ch-network-namespace" or something. I've skimmed over cgroups documentation [1] several times, but never quite gotten a solid mental model of how everything fits together.
[1] https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt
- geofft 12y agoYou're probably looking for the "unshare" command and corresponding system call (or the same flags to the "clone" system call). Specifically, running "sudo unshare -n bash" will get you a shell with no network devices other than lo. You can then find the pid and use "ip link set dev eth0 netns 1234" from outside to move eth0 into the new namespace (more practically, you might make a virtual network device and move one end into the new namespace). http://man7.org/linux/man-pages/man2/unshare.2.html http://man7.org/linux/man-pages/man2/unshare.2.html http://man7.org/linux/man-pages/man2/clone.2.html http://man7.org/linux/man-pages/man2/clone.2.html http://man7.org/linux/man-pages/man1/unshare.1.html http://man7.org/linux/man-pages/man1/unshare.1.html Loosely a "container" (in the LXC or Docker sense) is a combination of making new namespaces, which isolate the process tree from the rest of the system in various ways (filesystem, network, hostname as returned by "uname", etc.), and making a cgroup, which allows for process tracking and resource allocation.
- pmahoney 12y agoAh, great stuff, thanks! This small piece of the whole set of container features may be exactly what I want.