Stepping closer to practical containers: "syslog" namespaces

You will already need to do that if you do it on the kernel, and it would be more difficult to modify the mapping (and puts policy on the kernel). The only difference is the kernel now doesn't need to have a default policy (it doesn't break anything because it's a new feature). The default can just be that all containers start in the same "syslog" namespace (like now).

As for not being transparent, I'm talking of a ring-buffer per container, so it's fully transparent for the applications. dmesg will output the namespace ring-buffer contents.

The initial namespace "syslog" daemon would dispatch messages from the unfiltered ring-buffer to the other namespaces ring-buffers. The difference would be that the syslog(2) syscall would be namespace aware and return messages only from the current namespace ring-buffer.