|
|
|
|
|
|
by JdeBP
3281 days ago
|
|
|
No-one defended cgroups. What you said about a single global management process was just plain wrong. I do find it amusing that you erroneously think that other people are lecturing you, by the way. (-: A control group on the machine in front of me tells me that you are wrong about two more things. jdebp %ll -a /sys/fs/cgroup/service-manager.slice/user-services@.service/user-services@jdebp.service
total 0
drwxr-xr-x 6 jdebp root 0 Jun 29 18:17 .
drwxr-xr-x 3 root root 0 Jun 29 18:17 ..
-r--r--r-- 1 root root 0 Jun 29 18:18 cgroup.controllers
-r--r--r-- 1 root root 0 Jun 29 18:18 cgroup.events
-rw-r--r-- 1 jdebp root 0 Jun 29 18:17 cgroup.procs
-rw-r--r-- 1 root root 0 Jun 29 18:18 cgroup.subtree_control
drwxr-xr-x 2 jdebp jdebp 0 Jun 29 18:17 me.slice
drwxr-xr-x 2 jdebp jdebp 0 Jun 29 18:17 per-user-manager-log.slice
drwxr-xr-x 3 jdebp jdebp 0 Jun 29 18:17 service-manager.slice
drwxr-xr-x 2 jdebp jdebp 0 Jun 29 18:17 system-control.slice
jdebp %
Unprivileged subtree delegation exists, that being a control group delegated to my account which has a whole subtree of further control groups in it, managed by multiple unprivileged processes. Your problem with "rootless" containers is not because of the non-existence, because Tejun Heo "isn't interested", of something that visibly exists. That's clearly not a correct description of the situation at all. Furthermore, https://lkml.org/lkml/2017/6/25/4 and https://lkml.org/lkml/2017/6/25/6 tell me that far from "isn't interested", Tejun Heo is interested in subtree delegation to unprivileged users. After all, xe is fidding with it right now.systemd is not the sole user of version 2 control groups. |
|
|
But the problem is that the slices you showed are given to you by systemd. If systemd didn't want to give them to you for whatever reason, you couldn't use cgroups.
And you've not responded to any other part of my comments that relate to how the design of cgroupv2 is clearly geared towards management processes controlling subtrees as opposed to programs controlling themselves (the key point being that the root tree has to be controlled by someone).
> Unprivileged subtree delegation exists
But it requires a privileged user to "allow" it, making it less useful in most cases because it has to be automated (allowing for possible exploits) or done manually (not useful).
> Tejun Heo is interested in subtree delegation to unprivileged users
That's very odd, and is not the impression I got after discussing these issues with him last year. In particular I proposed something like his "nsdelegate" patch in early 2016 so it's nice to see that he's come around on that topic. But if he's changed his mind, that's great! Note though that the first patch is not directly related to unprivileged subtree delegation.
> systemd is not the sole user of version 2 control groups.
Can you give an example? I'm also fairly certain they're the only user of "hybrid" cgroup versions.