On Mon, Dec 28, 2009 at 3:36 PM, Serge E. Hallyn <serue@xxxxxxxxxx> wrote: > Quoting Daniel Lezcano (daniel.lezcano@xxxxxxx): >> The ns_cgroup is an annoying cgroup at the namespace / cgroup frontier. > > True. However, it remains - apart from using smack or SELinux - the > only way to truly lock a container into a cgroup configuration. That's > unlikely to change until we finally support user namespaces in the VFS. > > Do we worry about that? I think we worry about the fact that we don't have a good way to do this. I don't think we worry about removing a bad way to do it :-) Paul _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/containers
