linux-namespaces

Does Kubernetes POD have namespace and cgroup associated with it?

由 时光怂恿深爱的人放手 提交于 2020-12-15 03:51:38
问题 Docker Containers have cgroups and namespaces associated with them, whether they are running in a pod or vm or host machine. Similarly, does a Kubernetes Pod's have namespaces and cgroups associated with them, or it's just the containers within the pod have these(cgroup & namespace) associations. If they do, how can I find this info from the host? 回答1: group of whales is called a pod. Consider a pod of two humpback whales. One whale is grey in color and other is blue. What is the color of the

Containers and syscall.CLONE_NEWNS

由 混江龙づ霸主 提交于 2020-08-08 04:06:28
问题 I'm running the golang code on this repo https://github.com/lizrice/containers-from-scratch/blob/master/main.go and I'm having a problem with the mount namespace. What the code should do is creating a process within its own mount namespace. So if I run the code with sudo go run main.go run /bin/bash and I create a file inside the directory mytemp , I should be able to see that file from within the new started process, but if I try to view that file moving to the rootfs directory on the host,

unshare user namespace and set uid mapping with newuidmap

由 痞子三分冷 提交于 2020-07-06 13:42:12
问题 I'm trying to gain a better understanding of user namespaces by experimenting with the unshare and newuidmap commands. These are the commands I ran: [root@host ~]$ ls -l /usr/bin/newuidmap -rwsr-xr-x 1 root root 32944 May 16 19:37 /usr/bin/newuidmap [root@host ~]$ unshare -U bash namespace [nobody@host ~]$ echo $$ 7134 [nobody@host ~]$ newuidmap 7134 65534 5000 1 newuidmap: write to uid_map failed: Operation not permitted /etc/subuid: nobody:5000:1 root:5000:1 Any idea why this is failing? I

Mount filesystem after clone with CLONE_NEWNS flag

由 泪湿孤枕 提交于 2020-05-12 01:42:11
问题 I'm trying to implement the following scenario: clone() main process with CLONE_NEWNS flag (it means new mount namespace) mount() new filesystem in child process child process finished and all created in this process filesystems are unmounted But it doesn't work as I expected and I still see mounted filesystems in main process. What am I doing wrong? Sources are here https://github.com/dmitrievanthony/sprat/blob/master/src/container.c#L47 System is default AWS Ubuntu, ubuntu@ip-172-31-31-112:

How to launch container with user namespace configuration?

由 筅森魡賤 提交于 2020-02-25 05:56:58
问题 In the below docker file, base image( jenkins/jenkins ) is providing a user jenkins with UID 1000 and GID 1000 , within container. FROM jenkins/jenkins # Install some base packages # Use non-privileged user provided by base image USER jenkins # with uid 1000 and GID 1000 # Copy plugins and other stuff On the docker host(EC2 instance), we also have similar UID & GID created, $ groupadd -g 1000 jenkins $ useradd -u 1000 -g jenkins jenkins $ mkdir -p /abc/home_folder_for_jenkins $ chown -R

Linux - understanding the mount namespace & clone CLONE_NEWNS flag

由 余生长醉 提交于 2019-12-29 18:43:36
问题 I am reading the mount & clone man page. I want to clarify how CLONE_NEWNS effects the view of file system for the child process. (File hierarchy) Lets consider this tree to be the directory hierarchy. Lets says 5 & 6 are mount points in the parent process. I clarified mount points in another question. So my understanding is : 5 & 6 are mount points means that the mount command was used previously to 'mount' file systems (directory hierarchies) at 5 & 6 (which means there must be directory

What is the relation between `task_struct` and `pid_namespace`?

由 谁说我不能喝 提交于 2019-12-06 02:10:29
问题 I'm studying some kernel code and trying to understand how the data structures are linked together. I know the basic idea of how a scheduler works, and what a PID is. Yet I have no idea what a namespace is in this context, and can't figure out how all of those work together. I have read some explanations (including parts of O'Reilly "Understanding the Linux Kernel") and understand that it could be that the same PID got to two processes because one has terminated and the ID got reallocated.

What is the relation between `task_struct` and `pid_namespace`?

由 孤街醉人 提交于 2019-12-04 07:38:54
I'm studying some kernel code and trying to understand how the data structures are linked together. I know the basic idea of how a scheduler works, and what a PID is. Yet I have no idea what a namespace is in this context, and can't figure out how all of those work together. I have read some explanations (including parts of O'Reilly "Understanding the Linux Kernel") and understand that it could be that the same PID got to two processes because one has terminated and the ID got reallocated. But I can't figure out how all this is done. So: What is a namespace in this context? What is the

Linux - understanding the mount namespace & clone CLONE_NEWNS flag

由 青春壹個敷衍的年華 提交于 2019-11-30 03:30:46
I am reading the mount & clone man page. I want to clarify how CLONE_NEWNS effects the view of file system for the child process. (File hierarchy) Lets consider this tree to be the directory hierarchy. Lets says 5 & 6 are mount points in the parent process. I clarified mount points in another question . So my understanding is : 5 & 6 are mount points means that the mount command was used previously to 'mount' file systems (directory hierarchies) at 5 & 6 (which means there must be directory trees under 5 & 6 as well). From mount man page : A mount namespace is the set of filesystem mounts that

How to create multiple network namespace from a single process instance

由 半腔热情 提交于 2019-11-29 20:52:19
I am using following C function to create multiple network namespaces from a single process instance : void create_namespace(const char *ns_name) { char ns_path[100]; snprintf(ns_path, 100, "%s/%s", "/var/run/netns", ns_name); close(open(ns_path, O_RDONLY|O_CREAT|O_EXCL, 0)); unshare(CLONE_NEWNET); mount("/proc/self/ns/net", ns_path, "none", MS_BIND , NULL); } After my process creates all the namspaces and I add a tap interface to any of the one network namespace (with ip link set tap1 netns ns1 command), then I actually see this interface in all of the namespaces (presumably, this is actually
订阅 linux-namespaces