Messages in this thread | | | Date | Thu, 13 Mar 2014 14:02:24 -0400 | From | Vivek Goyal <> | Subject | Re: [PATCH 2/2] net: Implement SO_PEERCGROUP |
| |
On Thu, Mar 13, 2014 at 01:51:17PM -0400, Simo Sorce wrote:
[..] > > 1. Fix Docker to use user namespaces and use the uid of the requesting > > process via SCM_CREDENTIALS. > > This is not practical, I have no control on what UIDs will be used > within a container,
I guess uid to container mapping has to be managed by somebody, say systemd. Then there systemd should export an API to query the container a uid is mapped into. So that should not be the real problem.
> and IIRC user namespaces have severe limitations > that may make them unusable in some situations. Forcing the use of user > namespaces on docker to satisfy my use case is not in my power.
I think that's the real practical problem. Adoption of user name space.
Thanks Vivek
| |