On 6/14/21 4:43 PM, Tejun Heo wrote:

Hello,

On Mon, Jun 14, 2021 at 11:23:02AM -0400, Waiman Long wrote:

quoted

The current container management system is able to create the illusion
that applications running within a container have limited resources and
devices available for their use. However, one thing that is hard to hide
is the number of CPUs available in the system. In fact, the container
developers are asking for the kernel to provide such capability.

There are two places where cpu information are available for the
applications to see - /proc/cpuinfo and /sys/devices/system/cpu sysfs
directory.

This patchset introduces a new sysctl parameter cpuset_bound_cpuinfo
which, when set, will limit the amount of information disclosed by
/proc/cpuinfo and /sys/devices/system/cpu.

The goal of cgroup has never been masquerading system information so that
applications can pretend that they own the whole system and the proposed
solution requires application changes anyway. The information being provided
is useful but please do so within the usual cgroup interface - e.g.
cpuset.stat. The applications (or libraries) that want to determine its
confined CPU availability can locate the file through /proc/self/cgroup.

Thanks for your comment. I understand your point making change via 
cgroup interface files. However, this is not what the customers are 
asking for. They are using tools that look at /proc/cpuinfo and the 
sysfs files. It is a much bigger effort to make all those tools look at 
a new cgroup file interface instead. It can be more efficiently done at 
the kernel level.

Anyway, I am OK if the consensus is that it is not a kernel problem and 
have to be handled in userspace.

BTW, do you have any comment on another cpuset patch that I sent a week 
earlier?

https://lore.kernel.org/lkml/20210603212416.25934-1-longman@redhat.com/ (local)

I am looking forward for your feedback.

Cheers,
Longman