On Mon, Jul 13, 2009 at 7:42 PM, Tim Newsham<news...@lava.net> wrote:
>> Could we solve this by making private mounts the default (or only
>> allowed) behavior?
>
> I've wondered if there's enough context information
> that the fs driver could "fake" per-process mount points
> directly.
>
Lucho's v9fs auth mechanisms allow for per-user namespaces (sort-of)
as they force a new-attach ever time a new user crosses the mount
point. I think there's enough knowledge (in Linux anyways) to obtain
the current process. The hard bit is, as you say, managing
inheritance and other namespace process controls. This is why its
probably best implemented in a more integrated fashion.
I have been playing with using Inferno to construct dynamic namespaces
for me in Linux and MacOSX. The idea is to setup the namespace and
then back mount it (with v9fs and FUSE) in either a private namespace
or a chroot. I'm using this to implement an xcpu2-like environment
purely with Inferno (remote threads get their own private namespace
sandboxes to run in with an Inferno crafted namespace). Not as
powerful as the whole enchilada, but it provides a container
environment with composable namespaces.
-eric
