Gao feng <gaofeng@xxxxxxxxxxxxxx> writes: > right now I only take note of the unix socket /run/systemd/private, > but there may have many similar unix sockets, they can exist in any > path. the strange problems will still happen. It could just as easily have been a fifo in the filesystem, and the result would have been the same. The network namespace are all about communicating between network namespaces and that is what was allowed here. If you don't want a socket or a fifo or any other file to be used by a container don't give it access to it. It really is that simple. Eric -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list