>From conversations at Linux Plumbers Converence it became fairly clear that one if not the roughest edge on containers today is dealing with devices. - Hotplug does not work. - There seems to be no implementation that does a much beyond creating setting up a static set of /dev entries today. - Containers do not see the appropriate uevents for their container. One of the more compelling cases I heard was of someone who was running the a Linux Desktop in container and wanted to just let that container see the devices needed for his desktop, and not everything else. Talking with the OpenVZ folks it appears that preserving device numbers across checkpoint/restart is not currently an issue. However they reuse the same loopback minor number when they can which would hide this issue. So while it is clear we don't need to worry about migrating an application that cares about major/minor numbers of filesystems right now as the set of application that are migrated increases that situation may change. As the case with the network device ifindex has shown it is possible to implement filtering now and later when there is a usecase it is possible to expand filtering to actual namespace local identifiers. Thinking about it for the case of container migration the simplest solution for the rare application that needs something more may be to figure out how to send a kernel hotplug event. Something to think about when we encounter them. So the big issues for a device namespace to solve are filtering which devices a container has access to and being able to dynamically change which devices those are at run time (aka hotplug). After having thought about this for a bit I don't know if a pure userspace solution is sufficient or actually a good idea. - We can manually manage a tmpfs with device nodes in userspace. (But that is deprecated functionality in the mainstream kernel). - We can manually export a subset of sysfs with bind mounts. (But that feels hacky, and is essentially incompatible with hotplug). - We can relay a call of /sbin/hotplug from outside of a container to inside of a container based on policy. (But no one uses /sbin/hotplug anymore). - There is no way to fake netlink uevents for a container to see them. (The best we could do is replace udev everywhere with something that listens on a unix domain socket). - It would be nice to replace the device cgroup with a comprehensive solution that really works. (Among other things the device cgroup does not work in terms of struct device the underlying kernel abstraction for devices). We must manage sysfs entries as well device nodes because: - Seeing more than we should has the real potential to confuse userspace, especially a userspace that replays uevents. - Some device control must happens through writing to sysfs files and if we don't remove all root privileges from a container only by exporting a subset of sysfs to that container can we limit which sysfs nodes can be written to. The current kernel tagged sysfs entry support does not look like a good match for the impelementing device filtering. The common case will be allowing devices like /dev/zero, and /dev/null that live in /sys/devices/virtual and are the devices we are most likely to care about. Those devices need to live in multiple device namespaces so everyone can use them. Perhaps exclusive assignment will be the more common paradigm for device namespaces like it is for network devices in the network namespace but from what little I can of this problem right now I don't think so. I definitely think we should hold off on a kernel level implementation until we really understand the issues and are ready to implement device namespaces correctly. A userspace implementation looks like it can only do about 95% of what is really needed, but at the same time looks like an easy way to experiment until the problem is sufficiently well understood. At the end of the day we need to filter the devices a set of userspace processes can use and be able to change that set of devices dynamically. All of the rest of the infrastructure for that lives in the kernel, and keeping all of the infrastructure in one place where it can be maintained together is likely to be most maintainable. It looks like the code is just complicated enough and the use cases just boring enough that spreading the code to perform container device hotplug and container device filtering between a dozen userspace tools, and a hadful of userspace device managers will not be particularly managable at the end of the day. In summary the situation with device hoptlug and containers sucks today, and we need to do something. Running a linux desktop in a container is a reasonably good example use case. Having one standard common maintainable implementation would be very useful and the most logical place for that would be in the kernel. For now we should focus on simple device filtering and hotplug. Eric _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
