lkml.org 
[lkml]   [2014]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC PATCH net-next v2 0/5] netns: allow to identify peer netns
On 9/26/14, 1:34 PM, Eric W. Biederman wrote:
> When I wrote the "ip netns" support I never expected that all
> applications would want to run in a specific network namespace. All
> that is needed is one socket per network namespace.

Sure that is another option. But for a process to create a socket or
thread in a second namespace it has to run as root -- CAP_SYS_ADMIN is
needed for setns (or perhaps there is another way to create the socket
or thread in the namespace).

Second, it still does not address the scalability problem. For example a
single daemon providing service across 2k namespaces means it needs 2k
listen sockets. From there a system could have 20, 30 or 50 services
running. Certainly lighter than a process per namespace, but not even
close to ideal when talking about something like VRFs.

David


\
 
 \ /
  Last update: 2014-09-26 22:21    [W:0.103 / U:1.316 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site