How do you use cgroups from within a network namespace
Clash Royale CLAN TAG#URR8PPP
I just discovered that mount | grep cgroup returns nothing when you are not in the default network namespace. I can't really find any documentation on this except for that "network namespaces isolate the UNIX domain abstract socket namespace". That's in the man page for network namespaces.
Cgroups are mounted as type cgroup. Is this a socket? Is that why they are unaccessible from a network namespace?
This is quite a limitation, because I cannot run things like runc or any other program that uses cgroups in a specific network namespace.
Is there a way to work around this? Is this an intented feature? Documented anywhere?
cgroups network-namespaces
asked Jan 2 at 17:40
bonanzabonanza
61
add a comment |
I just discovered that mount | grep cgroup returns nothing when you are not in the default network namespace. I can't really find any documentation on this except for that "network namespaces isolate the UNIX domain abstract socket namespace". That's in the man page for network namespaces.
Cgroups are mounted as type cgroup. Is this a socket? Is that why they are unaccessible from a network namespace?
This is quite a limitation, because I cannot run things like runc or any other program that uses cgroups in a specific network namespace.
Is there a way to work around this? Is this an intented feature? Documented anywhere?
cgroups network-namespaces
asked Jan 2 at 17:40
bonanzabonanza
61
How are you entering the network namespace? Are you sure it's not also entering other namespaces (eg mount namespace)?
– Stephen Harris
Jan 2 at 17:59
ip netns add otherns; ip netns exec otherns mount | grep cgroup. That's all.
– bonanza
Jan 2 at 18:28
A few other things are missing,debugfs,configfspstore,sysfs,selinuxfsandsecurityfs
– bonanza
Jan 2 at 18:37
Aha, thanks for the hint. It seems thatip netns execcreates a mount namespace in order to give every namespace specific network configuration files. I suppose they do not propagate all mounts to this new namespace. Found it thanks to: stackoverflow.com/questions/45629002/…
– bonanza
Jan 2 at 18:44
add a comment |
I just discovered that mount | grep cgroup returns nothing when you are not in the default network namespace. I can't really find any documentation on this except for that "network namespaces isolate the UNIX domain abstract socket namespace". That's in the man page for network namespaces.
Cgroups are mounted as type cgroup. Is this a socket? Is that why they are unaccessible from a network namespace?
This is quite a limitation, because I cannot run things like runc or any other program that uses cgroups in a specific network namespace.
Is there a way to work around this? Is this an intented feature? Documented anywhere?
cgroups network-namespaces
asked Jan 2 at 17:40
bonanzabonanza
61
I just discovered that mount | grep cgroup returns nothing when you are not in the default network namespace. I can't really find any documentation on this except for that "network namespaces isolate the UNIX domain abstract socket namespace". That's in the man page for network namespaces.
Cgroups are mounted as type cgroup. Is this a socket? Is that why they are unaccessible from a network namespace?
This is quite a limitation, because I cannot run things like runc or any other program that uses cgroups in a specific network namespace.
Is there a way to work around this? Is this an intented feature? Documented anywhere?
cgroups network-namespaces
cgroups network-namespaces
asked Jan 2 at 17:40
bonanzabonanza
61
asked Jan 2 at 17:40
bonanzabonanza
61
asked Jan 2 at 17:40
bonanzabonanza
61
asked Jan 2 at 17:40
bonanzabonanza
61
asked Jan 2 at 17:40
bonanzabonanza
61
61
How are you entering the network namespace? Are you sure it's not also entering other namespaces (eg mount namespace)?
– Stephen Harris
Jan 2 at 17:59
ip netns add otherns; ip netns exec otherns mount | grep cgroup. That's all.
– bonanza
Jan 2 at 18:28
A few other things are missing,debugfs,configfspstore,sysfs,selinuxfsandsecurityfs
– bonanza
Jan 2 at 18:37
Aha, thanks for the hint. It seems thatip netns execcreates a mount namespace in order to give every namespace specific network configuration files. I suppose they do not propagate all mounts to this new namespace. Found it thanks to: stackoverflow.com/questions/45629002/…
– bonanza
Jan 2 at 18:44
add a comment |
How are you entering the network namespace? Are you sure it's not also entering other namespaces (eg mount namespace)?
– Stephen Harris
Jan 2 at 17:59
ip netns add otherns; ip netns exec otherns mount | grep cgroup. That's all.
– bonanza
Jan 2 at 18:28
A few other things are missing,debugfs,configfspstore,sysfs,selinuxfsandsecurityfs
– bonanza
Jan 2 at 18:37
Aha, thanks for the hint. It seems thatip netns execcreates a mount namespace in order to give every namespace specific network configuration files. I suppose they do not propagate all mounts to this new namespace. Found it thanks to: stackoverflow.com/questions/45629002/…
– bonanza
Jan 2 at 18:44
How are you entering the network namespace? Are you sure it's not also entering other namespaces (eg mount namespace)?
– Stephen Harris
Jan 2 at 17:59
How are you entering the network namespace? Are you sure it's not also entering other namespaces (eg mount namespace)?
– Stephen Harris
Jan 2 at 17:59
ip netns add otherns; ip netns exec otherns mount | grep cgroup. That's all.– bonanza
Jan 2 at 18:28
ip netns add otherns; ip netns exec otherns mount | grep cgroup. That's all.– bonanza
Jan 2 at 18:28
A few other things are missing,
debugfs, configfs pstore, sysfs, selinuxfs and securityfs– bonanza
Jan 2 at 18:37
A few other things are missing,
debugfs, configfs pstore, sysfs, selinuxfs and securityfs– bonanza
Jan 2 at 18:37
Aha, thanks for the hint. It seems that
ip netns exec creates a mount namespace in order to give every namespace specific network configuration files. I suppose they do not propagate all mounts to this new namespace. Found it thanks to: stackoverflow.com/questions/45629002/…– bonanza
Jan 2 at 18:44
Aha, thanks for the hint. It seems that
ip netns exec creates a mount namespace in order to give every namespace specific network configuration files. I suppose they do not propagate all mounts to this new namespace. Found it thanks to: stackoverflow.com/questions/45629002/…– bonanza
Jan 2 at 18:44
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f492056%2fhow-do-you-use-cgroups-from-within-a-network-namespace%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f492056%2fhow-do-you-use-cgroups-from-within-a-network-namespace%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
How are you entering the network namespace? Are you sure it's not also entering other namespaces (eg mount namespace)?
– Stephen Harris
Jan 2 at 17:59
ip netns add otherns; ip netns exec otherns mount | grep cgroup. That's all.– bonanza
Jan 2 at 18:28
A few other things are missing,
debugfs,configfspstore,sysfs,selinuxfsandsecurityfs– bonanza
Jan 2 at 18:37
Aha, thanks for the hint. It seems that
ip netns execcreates a mount namespace in order to give every namespace specific network configuration files. I suppose they do not propagate all mounts to this new namespace. Found it thanks to: stackoverflow.com/questions/45629002/…– bonanza
Jan 2 at 18:44