On Tue, Apr 17, 2012 at 12:34:48PM +0200, Jan Engelhardt wrote: > > On Tuesday 2012-04-17 04:56, Gao feng wrote: > > >Currently the sysctl of netfilter proto is not isolated, so when > >changing proto's sysctl in container will cause the host's sysctl > >be changed too. it's not expected. > > I wonder if it made sense to do the configuration of NFCT via > netlink as well, and deprecate the sysctl interface. Good point Jan. However, we're in inconsistent state now and removing interfaces is not easy / fast. So I think we have to fix it first and then, if we decide to do so, deprecate them. It seems to me like a good idea to target to providing netlink interfaces for all netfilter tweaks and use iptables (or whatsoever. command line tool we'll have in the future) to attach specific configurations to flow. Thus, having no more sysctl stuff and module parameters tweaks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
