| |||||||||||
Process IDs in a multi-namespace worldProcess IDs in a multi-namespace worldPosted Nov 7, 2007 6:18 UTC (Wed) by flewellyn (subscriber, #5047)Parent article: Process IDs in a multi-namespace world
As usual, Linus manages to cut through a whole Gordian knot of confusion over how to solve a problem by asking "Why do we even care?" In this case, why do they even care about sharing userspace resources like pids, futexes, filesystem mounts, and the like between containers, when the whole point of containers is that each container appears to the contained processes to be its own separate system? I think he's right. Disallow this sharing and treat each container as a completely separate userspace, which means each one has its own set of every resource from the userspace point of view. Let the kernel uses namespaces in-kernel, and take care of the translating; if containers want to communicate with each other, we have well-defined means of doing that, namely TCP/IP sockets, network file systems, distributed systems, and the like. Linux could speed things up a bit by using in-kernel "zero-copy" communication between containers, so that TCP/IP sockets between containers would be as fast as Unix domain sockets, but userspace should not have to care or even know about it.
(Log in to post comments)
|
|||||||||||