cgroup

For example, the current change in CGroup's namespaces are because kernel is mandating that the current cgroup access mechanism be deprecated.

You can never be in more than one cgroup of the same type, and you cannot pass your capabilties on.

If the container is not running inside a pid namespace (started with an earlier slave version), the launcher will fall back to the prior behavior and use the freezer cgroup.

And as systemd did both init and cgroup management, it ended up being favored...

But cgroup/jails type isolation is lightweight enough that we can easily apply it at a much finer-grained level.

That's a lot better than one, though it makes you wonder how they schedule client slash client cgroup association across physical hardware (ie.

This avoids known kernel bugs and race conditions when using the freezer cgroup.

You can get process monitoring as long as your tools are cgroup aware.

Google employees incepted the cgroup feature way back in 2006, to solve problems that were already being felt acutely at that time within Google.

How do you know it's not cgroup isolation with a chroot jail?

The per-unit cgroup and the ability to kill it is rather nice too, without delving in the container-related features where the systemd server-side support really shines.

One major thing that we get from systemd is cgroup management, that gives resource and namespace management at a per process level.

:) The "right" way of doing this (calling lynx in a network-restricted cgroup/chroot/container) sounds like a pain.

From the paper: "We use a Linux chroot jail as the primary security isolation mechanism between multiple tasks on the same machine… all Borg tasks run inside a Linux cgroup-based resource container."