"Serge E. Hallyn" <serge@xxxxxxxxxx> writes: > Quoting Eric W. Biederman (ebiederm@xxxxxxxxxxxx): >> >> In the help text describing user namespaces recommend use of memory >> control groups. In many cases memory control groups are the only >> mechanism there is to limit how much memory a user who can create >> user namespaces can use. >> >> Signed-off-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx> > > Acked-by: Serge Hallyn <serge.hallyn@xxxxxxxxxxxxx> > > nit: > I have fixed you nit and added the following text, so people know have a clue where to look to configure cgroups in userspace. diff --git a/Documentation/namespaces/resource-control.txt b/Documentation/namespaces/resource-control.txt index 3d8178a..abc13c3 100644 --- a/Documentation/namespaces/resource-control.txt +++ b/Documentation/namespaces/resource-control.txt @@ -7,4 +7,8 @@ users programs to play nice this problems becomes more acute. Therefore it is recommended that memory control groups be enabled in kernels that enable user namespaces, and it is further recommended that userspace configure memory control groups to limit how much -memory users they don't trust to play nice can use. +memory user's they don't trust to play nice can use. + +Memory control groups can be configured by installing the libcgroup +package present on most distros editing /etc/cgrules.conf, +/etc/cgconfig.conf and setting up libpam-cgroup. _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
