[eatonphil]

Another question: do you have any numbers on the performance hit using cproxy? (I have no intuition for how cgroups performs here.)

[lian0]

I didn't do any benchmark, but the performance hit should be minimal since all the heavy work are done by kernel cgroup and iptables. They are very efficient in most cases.