Skip to content

Latest commit

 

History

History
69 lines (49 loc) · 4.77 KB

notes.md

File metadata and controls

69 lines (49 loc) · 4.77 KB

Ideas for enabling mount namespace pool

  • Put all toaster overlay images in a folder bind mounted so shared with all mount namespaces that will be used for toaster execution. Chown each toaster images with a different non root user. You can chown toaster with the same creator and user id with the same linux user. Then when launching toasters in a user namespace, map the inside root user to the outside user corresponding to the toaster code. A toastainer should only be able to mess with the images that has its outside linux user as owner. Use shiftfs to change the owner view of the image to the inside root. This way we can have a pool of premounted and pre pivot rooted mount namespace which all have the same folder of toaster images bindmounted and then before execution just set the pre created user namespace to the right outside user id. See shiftfs for more information. Better: User namespace in the pool can have any outside user id as the inside root, just not one already attributed to a toaster image, and then just before execution, from outside the jail(so the scheduler) chow' the toaster image to the chooser user namespace outside user id. Should be less expensive than not being able to create a mount namespace before execution to feed a pool.

TODO

   Namespace lifetime
       Absent any other factors, a namespace is automatically torn down when
       the last process in the namespace terminates or leaves the namespace.
       However, there are a number of other factors that may pin a namespace
       into existence even though it has no member processes.  These factors
       include the following:

       *  An open file descriptor or a bind mount exists for the correspond‐
          ing /proc/[pid]/ns/* file.

       *  The namespace is hierarchical (i.e., a PID or user namespace), and
          has a child namespace.

       *  It is a user namespace that owns one or more nonuser namespaces.

       *  It is a PID namespace, and there is a process that refers to the
          namespace via a /proc/[pid]/ns/pid_for_children symbolic link.

       *  It is an IPC namespace, and a corresponding mount of an mqueue
          filesystem (see mq_overview(7)) refers to this namespace.

       *  It is a PID namespace, and a corresponding mount of a proc(5)
          filesystem refers to this namespace.