From: David Ahern <dsahern@xxxxxxxxx> Date: Tue, 17 Jul 2018 13:02:18 -0600 > I understand the concern about global resource and limits: as it stands > you have to increase the limits in init_net to the max expected and hope > for the best. With per namespace limits you can lower the limits of each > namespace better control the total impact on the total memory used. > Perhaps the defaults for namespaces after init_net could have really low > defaults (e.g., 16 / 32 / 64 for gc_thresh 1/2/3) requiring admin > intervention. How does this work when a namespace creates another namespace? Changing the defaults for non-init_net namespaces could work, but that could be a surprise to some people. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
