Re: [PATCH] iptables: Per-net ns lock

2018-04-23 Thread Kirill Tkhai
On 21.04.2018 02:06, Andrei Vagin wrote: > On Fri, Apr 20, 2018 at 04:42:47PM +0300, Kirill Tkhai wrote: >> Containers want to restore their own net ns, >> while they may have no their own mnt ns. >> This case they share host's /run/xtables.lock >> file, but they may not have permission to open >>

Re: [PATCH] iptables: Per-net ns lock

2018-04-20 Thread Andrei Vagin
On Fri, Apr 20, 2018 at 04:42:47PM +0300, Kirill Tkhai wrote: > Containers want to restore their own net ns, > while they may have no their own mnt ns. > This case they share host's /run/xtables.lock > file, but they may not have permission to open > it. > > Patch makes /run/xtables.lock to be per

[PATCH] iptables: Per-net ns lock

2018-04-20 Thread Kirill Tkhai
Containers want to restore their own net ns, while they may have no their own mnt ns. This case they share host's /run/xtables.lock file, but they may not have permission to open it. Patch makes /run/xtables.lock to be per-namespace, i.e., to refer to the caller task's net ns. Signed-off-by: Kiri