Daniel,
On Wed, Jun 28, 2006 at 03:51:32PM +0200, Daniel Lezcano wrote:
Daniel Lezcano wrote:
quoted
Andrey Savochkin wrote:
quoted
Structures related to IPv4 rounting (FIB and routing cache)
are made per-namespace.
Hi Andrey,
if the ressources are private to the namespace, how do you will handle
NFS mounted before creating the network namespace ? Do you take care of
that or simply assume you can't access NFS anymore ?
This is a question that brings up another level of interaction between
networking and the rest of kernel code.
Solution that I use now makes the NFS communication part always run in
the root namespace. This is discussable, of course, but it's a far more
complicated matter than just device lists or routing :)
Best regards
Andrey
quoted
quoted
quoted
Structures related to IPv4 rounting (FIB and routing cache)
are made per-namespace.
Hi Andrey,
if the ressources are private to the namespace, how do you will handle
NFS mounted before creating the network namespace ? Do you take care of
that or simply assume you can't access NFS anymore ?
This is a question that brings up another level of interaction between
networking and the rest of kernel code.
Solution that I use now makes the NFS communication part always run in
the root namespace. This is discussable, of course, but it's a far more
complicated matter than just device lists or routing :)
if we had containers (not namespaces) then it would be also possible to
run NFS in context of the appropriate container and thus each user could
mount NFS itself with correct networking context.
it's another thing which ties subsytems and makes namespaces ugly :/
Kirill
Kirill Korotaev wrote:
quoted
quoted
quoted
quoted
Structures related to IPv4 rounting (FIB and routing cache)
are made per-namespace.
Hi Andrey,
if the ressources are private to the namespace, how do you will
handle NFS mounted before creating the network namespace ? Do you
take care of that or simply assume you can't access NFS anymore ?
This is a question that brings up another level of interaction between
networking and the rest of kernel code.
Solution that I use now makes the NFS communication part always run in
the root namespace. This is discussable, of course, but it's a far more
complicated matter than just device lists or routing :)
if we had containers (not namespaces) then it would be also possible to
run NFS in context of the appropriate container and thus each user could
mount NFS itself with correct networking context.
I was asking the question because in some case, we want a lightweight
container for running applications (aka application container) who need
to share the filesystem and it will be too bad to have a network
namespace which brings isolation and prevents to implement application
containers. By the way, I agree from a point of view of a system
container, a complete network isolation is perfect.
Regards.
Daniel.
Daniel Lezcano wrote:
Kirill Korotaev wrote:
quoted
quoted
quoted
quoted
quoted
Structures related to IPv4 rounting (FIB and routing cache)
are made per-namespace.
Hi Andrey,
if the ressources are private to the namespace, how do you will
handle NFS mounted before creating the network namespace ? Do you
take care of that or simply assume you can't access NFS anymore ?
This is a question that brings up another level of interaction between
networking and the rest of kernel code.
Solution that I use now makes the NFS communication part always run in
the root namespace. This is discussable, of course, but it's a far more
complicated matter than just device lists or routing :)
if we had containers (not namespaces) then it would be also possible
to run NFS in context of the appropriate container and thus each user
could mount NFS itself with correct networking context.
With a relatively small patch, I was able to make NFS bind to a particular
local IP (poor man's namespace with existing code). I also changed it so
that multiple mounts to the same destination (and with unique local mount
points) are treated as unique mounts. This patch was done so that I could
stress test NFS servers, but similar logic might work for namespace isolation
as well...
Ben
--
Ben Greear [off-list ref]
Candela Technologies Inc http://www.candelatech.com