[MESOS-5410] Support cgroup namespace in unified container

• Type: Improvement
• Status: Reviewable
• Priority: Major
• Resolution: Unresolved
• Component/s: containerization
• Epic Link: Unified Container
• Assignee: haosdent
• Reporter: Qian Zhang
• Shepherd: Jie Yu
• Created: 18/May/16 02:39
• Updated: 26/Apr/17 16:53

Description

In Linux 4.6 kernel, a new namespace (cgroup namespace) was introduced to make a process can be created in its own cgroup namespace so that the global cgroup hierarchy will not be leaked to the process. See the following link for more details about this namespace:
http://man7.org/linux/man-pages/man7/cgroup_namespaces.7.html

We need to support this namespace in unified container to provide better isolation for the containers created by Mesos.

Issue Links

• is related to: MESOS-5446 NsTest.ROOT_setns and NsTest.ROOT_getns failed in Linux 4.6
• is related to: MESOS-6414 cgroups isolator cleanup failed when the hierarchy is cleanup by docker daemon
• is related to: MESOS-5991 Support running docker daemon inside a container using unified containerizer.
• relates to: MESOS-4697 Consolidate cgroup isolators into one single isolator.
• relates to: MESOS-5668 Add CGROUP namespace to linux ns helper.
• relates to: MESOS-6489 Better support for containers that want to manage their own cgroup.
• mentioned in: Page Loading...