Eric W. Biederman <ebiederm@xxxxxxxxxxxx> wrote: > > Further attempts to fork into the container will be rejected. > > There are no technical reasons to disallow this, and may good practical > reasons to allow this. Fair enough; that can be done. Could even emulate /sbin/request-key upcalling that way, with the manager spawning the daemon into the container with it. > So you are breaking nsenter, and it's like. It shouldn't stop nsenter() from working. David
