Vasily Averin <vasily.averin@xxxxxxxxx> wrote: > nftables replaces iptables, but it lacks memcg accounting. > > This patch account most of the memory allocation associated with nft > and should protect the host from misusing nft inside a memcg restricted > container. LGTM. Acked-by: Florian Westphal <fw@xxxxxxxxx>
