On Thu, Mar 24, 2022 at 09:05:50PM +0300, Vasily Averin wrote: > nftables replaces iptables, but it lacks memcg accounting. > > This patch account most of the memory allocation associated with nft > and should protect the host from misusing nft inside a memcg restricted > container. Applied to nf, thanks I think nft_*.c files whose NFT_EXPR_STATEFUL flag is set on need to use this _ACCOUNT flag variant for objects that are dinamically allocated from the packet path.
