Pid namespaces
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest20 patches 7 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/20 | Reowrk forget_original_parent()kernel/ | +21 | 0 replies | |
| 2/20 | Move exit_task_namespaces()kernel/ | +1 | 0 replies | |
| 3/20 | Introduce MS_KERNMOUNT flagfs/ fs/ include/ | +8 | 3 replies | |
| 4/20 | Prepare proc_flust_task() to flush entries from multiple proc treesfs/ include/ kernel/ | +24 | 0 replies | |
| 5/20 | Introduce struct upidinclude/ include/ | +22 | 2 replies | |
| 6/20 | Add support for pid namespaces hierarchyinclude/ kernel/ | +4 | 0 replies | |
| 7/20 | Make alloc_pid(), free_pid() and put_pid() work with struct upidinclude/ kernel/ kernel/ | +36 | 0 replies | |
| 8/20 | Helpers to obtain pid numbersinclude/ include/ kernel/ | +134 | 0 replies | |
| 9/20 | Helpers to find the task by its numerical idsfs/ include/ include/ +1 more | +69 | 0 replies | |
| 10/20 | Move alloc_pid() lower in copy_process()kernel/ | +16 | 0 replies | |
| 11/20 | Make proc have multiple superblocks - one for each namespacefs/ fs/ include/ +1 more | +69 | 0 replies | |
| 12/20 | Miscelaneous preparations for pid namespacesinclude/ include/ kernel/ | +25 | 0 replies | |
| 13/20 | Allow cloning of new namespaceinclude/ kernel/ kernel/ +1 more | +119 | 0 replies | |
| 14/20 | Make proc_flush_task() actually from entries from multiple namespacesfs/ | +16 | 0 replies | |
| 15/20 | Initialize the namespace's proc_mntfs/ fs/ include/ +1 more | +39 | 0 replies | |
| 16/20 | Create a slab-cache for 'struct pid_namespace'kernel/ | +6 | 0 replies | |
| 17/20 | Allow signalling container-initkernel/ | +2 | 0 replies | |
| 18/20 | Destroy pid namespace on init's deathinclude/ kernel/ kernel/ | +65 | 0 replies | |
| 19/20 | Changes to show virtual ids to userarch/ arch/ arch/ +25 more | +212 | 2 replies | |
| 20/20 | Remove the struct pid unneeded fieldsinclude/ include/ kernel/ | +0 | 0 replies |
Reviews trailers per patch
2 of 20 patches have a Reviewed-by or Acked-by.
| Patch | Pavel Emelyanov |
|---|---|
| 1/20 | |
| 2/20 | |
| 3/20 | |
| 4/20 | |
| 5/20 | |
| 6/20 | |
| 7/20 | |
| 8/20 | |
| 9/20 | |
| 10/20 | |
| 11/20 | |
| 12/20 | |
| 13/20 | |
| 14/20 | |
| 15/20 | |
| 16/20 | |
| 17/20 | A-b |
| 18/20 | A-b |
| 19/20 | |
| 20/20 |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH 0/20] Pid namespaces
A pid namespace is a "view" of a particular set of tasks on the system. They work in a similar way to filesystem namespaces. A file (or a process) can be accessed in multiple namespaces, but it may have a different name in each. In a filesystem, this name might be /etc/passwd in one namespace, but /chroot/etc/passwd in another.
For processes, a process may have pid 1234 in one namespace, but be pid 1 in another. This allows new pid namespaces to have basically arbitrary pids, and not have to worry about what pids exist in other namespaces. This is essential for checkpoint/restart where a restarted process's pid might collide with an existing process on the system's pid.
In this particular implementation, pid namespaces have a parent-child relationship, just like processes. A process in a pid namespace may see all of the processes in the same namespace, as well as all of the processes in all of the namespaces which are children of its namespace. Processes may not, however, see others which are in their parent's namespace, but not in their own. The same goes for sibling namespaces.
The know issue to be solved in the nearest future is signal handling in the namespace boundary. That is, currently the namespace's init is treated like an ordinary task that can be killed from within an namespace. Ideally, the signal handling by the namespace's init should have two sides: when signaling the init from its namespace, the init should look like a real init task, i.e. receive only those signals, that is explicitly wants to; when signaling the init from one of the parent namespaces, init should look like an ordinary task, i.e. receive any signal, only taking the general permissions into account.
The pid namespace was developed by Pavel Emlyanov and Sukadev Bhattiprolu
and we eventually came to almost the same implementation, which differed
in some details. This set is based on Pavel's patches, but it includes comments and patches that from Sukadev.
Many thanks to Oleg, who reviewed the patches, pointed out many BUGs and made valuable advises on how to make this set cleaner.