On Mon, 16 Nov 2020 12:50:22 -0800 Mahesh Bandewar (महेश बंडेवार) wrote: > On Mon, Nov 16, 2020 at 12:17 PM Jakub Kicinski <k...@kernel.org> wrote: > > On Mon, 16 Nov 2020 12:02:48 -0800 Mahesh Bandewar (महेश बंडेवार) wrote: > > > On Sat, Nov 14, 2020 at 10:17 AM Jakub Kicinski <k...@kernel.org> wrote: > > > > On Wed, 11 Nov 2020 12:43:08 -0800 Jian Yang wrote: > > > > > From: Mahesh Bandewar <mahe...@google.com> > > > > > > > > > > Traditionally loopback devices comes up with initial state as DOWN for > > > > > any new network-namespace. This would mean that anyone needing this > > > > > device (which is mostly true except sandboxes where networking in not > > > > > needed at all), would have to bring this UP by issuing something like > > > > > 'ip link set lo up' which can be avoided if the initial state can be > > > > > set > > > > > as UP. Also ICMP error propagation needs loopback to be UP. > > > > > > > > > > The default value for this sysctl is set to ZERO which will preserve > > > > > the > > > > > backward compatible behavior for the root-netns while changing the > > > > > sysctl will only alter the behavior of the newer network namespaces. > > > > > > > Any reason why the new sysctl itself is not per netns? > > > > > > > Making it per netns would not be very useful since its effect is only > > > during netns creation. > > > > I must be confused. Are all namespaces spawned off init_net, not the > > current netns the process is in? > The namespace hierarchy is maintained in user-ns while we have per-ns > sysctls hanging off of a netns object and we don't have parent (netns) > reference when initializing newly created netns values. One can copy > the current value of the settings from root-ns but I don't think > that's a good practice since there is no clear way to affect those > values when the root-ns changes them. Also from the isolation > perspective (I think) it's better to have this behavior (sysctl > values) stand on it's own i.e. have default values and then alter > values on it's own without linking to any other netns values.
To be clear, what I meant was just to make the sysctl per namespace. That way you can deploy a workload with this sysctl set appropriately without changing the system-global setting. Is your expectation that particular application stacks would take advantage of this, or that people would set this to 1 across the fleet?
