*: add support for cgroup namespace

cyphar · cyphar · commit 99266191ee7e · 2016-04-26T09:03:34.000+10:00
The cgroup namespace is a new kernel feature available in 4.6+ that
allows a container to isolate its cgroup hierarchy. This is invaluable
for hiding information from /proc/self/cgroup, but it also allows you to
modify your hierarchy inside a user namespace (even a rootless
container).

Signed-off-by: Aleksa Sarai &lt;asarai@suse.de&gt;
diff --git a/config-linux.md b/config-linux.md
@@ -27,12 +27,13 @@ Namespaces are specified as an array of entries inside the `namespaces` root fie
 The following parameters can be specified to setup namespaces:
 
 * **`type`** *(string, required)* - namespace type. The following namespaces types are supported:
-    * **`pid`** processes inside the container will only be able to see other processes inside the same container
-    * **`network`** the container will have its own network stack
-    * **`mount`** the container will have an isolated mount table
-    * **`ipc`** processes inside the container will only be able to communicate to other processes inside the same container via system level IPC
-    * **`uts`** the container will be able to have its own hostname and domain name
-    * **`user`** the container will be able to remap user and group IDs from the host to local users and groups within the container
+    * **`pid`** processes inside the container will only be able to see other processes inside the same container. Support for this was added in Linux 2.6.24.
+    * **`network`** the container will have its own network stack. Support for this was added in Linux 2.6.24.
+    * **`mount`** the container will have an isolated mount table. Support for this was added in Linux 2.4.19.
+    * **`ipc`** processes inside the container will only be able to communicate to other processes inside the same container via system level IPC. Support for this was added in Linux 2.6.19.
+    * **`uts`** the container will be able to have its own hostname and domain name. Support for this was added in Linux 2.6.19.
+    * **`user`** the container will be able to remap user and group IDs from the host to local users and groups within the container. Support for this was added in Linux 3.8.
+    * **`cgroup`** the container will have an isolated cgroup hierarchy that it can manage. Support for this was added in Linux 4.6.
 
 * **`path`** *(string, optional)* - path to namespace file in the [runtime mount namespace](glossary.md#runtime-namespace)
 
@@ -62,6 +63,9 @@ Also, when a path is specified, a runtime MUST assume that the setup for that pa
         },
         {
             "type": "user"
+        },
+        {
+            "type": "cgroup"
         }
     ]
 ```
diff --git a/config.md b/config.md
@@ -590,6 +590,12 @@ Here is a full example `config.json` for reference.
             },
             {
                 "type": "mount"
+            },
+            {
+                "type": "user"
+            },
+            {
+                "type": "cgroup"
             }
         ],
         "maskedPaths": [
diff --git a/schema/defs-linux.json b/schema/defs-linux.json
@@ -224,7 +224,8 @@
                 "network",
                 "uts",
                 "ipc",
-                "user"
+                "user",
+                "cgroup"
             ]
         },
         "NamespaceReference": {
diff --git a/specs-go/config.go b/specs-go/config.go
@@ -169,6 +169,8 @@ const (
 	UTSNamespace = "uts"
 	// UserNamespace for isolating user and group IDs
 	UserNamespace = "user"
+	// CgroupNamespace for isolating cgroup hierarchies
+	CgroupNamespace = "cgroup"
 )
 
 // IDMapping specifies UID/GID mappings

Original file line number	Diff line number	Diff line change
@@ -590,6 +590,12 @@ Here is a full example `config.json` for reference.
`590`	`590`	`},`
`591`	`591`	`{`
`592`	`592`	`"type": "mount"`
	`593`	`+ },`
	`594`	`+ {`
	`595`	`+ "type": "user"`
	`596`	`+ },`
	`597`	`+ {`
	`598`	`+ "type": "cgroup"`
`593`	`599`	`}`
`594`	`600`	`],`
`595`	`601`	`"maskedPaths": [`
Original file line number	Diff line number	Diff line change
`@@ -169,6 +169,8 @@ const (`
`169`	`169`	`UTSNamespace = "uts"`
`170`	`170`	`// UserNamespace for isolating user and group IDs`
`171`	`171`	`UserNamespace = "user"`
	`172`	`+ // CgroupNamespace for isolating cgroup hierarchies`
	`173`	`+ CgroupNamespace = "cgroup"`
`172`	`174`	`)`
`173`	`175`
`174`	`176`	`// IDMapping specifies UID/GID mappings`