On Thu, 14 Apr 2016, Olga Kornievskaia wrote: > Hi folks, > > Does somebody know if it's possible to do secure mounts within linux > containers? I seem to recall that gssd is not container-aware. Or is > container-magic makes it so that gssd runs per container and has its > own dedicated krb5.conf+keytab configurations? > > Thank you. Hi Olga, As far as I know there's no good way to run multiple gssd inside containers. There's only one global upcall mechanism, so even if we could keep track of which container is doing IO, there doesn't exist a way to upcall to the appropriate gssd. Additionally, containers are a collection of shared namespaces. A gssd could share one or more of those namespaces with a process doing IO, so what sort of rules do we use to pick the right gssd? Ian Kent has led some discussion on solving this, and right now the thinking is to always upcall into whichever namespace collection created the mount, but the bet way to preserve those namespaces has not been agreed upon yet. Ben -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
