*: add support for cgroup namespace

cyphar · cyphar · commit a021e638fd00 · 2016-05-27T22:00:23.000+10:00
The cgroup namespace is a new kernel feature available in 4.6+ that
allows a container to isolate its cgroup hierarchy. This is invaluable
for hiding information from /proc/self/cgroup. In the future, this
namespace may allow for subtree management by a container.

Signed-off-by: Aleksa Sarai &lt;asarai@suse.de&gt;
diff --git a/config-linux.md b/config-linux.md
@@ -27,17 +27,17 @@ Namespaces are specified as an array of entries inside the `namespaces` root fie
 The following parameters can be specified to setup namespaces:
 
 * **`type`** *(string, required)* - namespace type. The following namespaces types are supported:
-    * **`pid`** processes inside the container will only be able to see other processes inside the same container
-    * **`network`** the container will have its own network stack
-    * **`mount`** the container will have an isolated mount table
-    * **`ipc`** processes inside the container will only be able to communicate to other processes inside the same container via system level IPC
-    * **`uts`** the container will be able to have its own hostname and domain name
-    * **`user`** the container will be able to remap user and group IDs from the host to local users and groups within the container
+    * **`pid`** processes inside the container will only be able to see other processes inside the same container. Support for this was added in Linux 2.6.24.
+    * **`network`** the container will have its own network stack. Support for this was added in Linux 2.6.24.
+    * **`mount`** the container will have an isolated mount table. Support for this was added in Linux 2.4.19.
+    * **`ipc`** processes inside the container will only be able to communicate to other processes inside the same container via system level IPC. Support for this was added in Linux 2.6.19.
+    * **`uts`** the container will be able to have its own hostname and domain name. Support for this was added in Linux 2.6.19.
+    * **`user`** the container will be able to remap user and group IDs from the host to local users and groups within the container. Support for this was added in Linux 3.8.
+    * **`cgroup`** the container will have an isolated view of the cgroup hierarchy. Support for this was added in Linux 4.6.
 
 * **`path`** *(string, optional)* - path to namespace file in the [runtime mount namespace](glossary.md#runtime-namespace)
 
 If a path is specified, that particular file is used to join that type of namespace.
-Also, when a path is specified, a runtime MUST assume that the setup for that particular namespace has already been done and error out if the config specifies anything else related to that namespace.
 
 ###### Example
 
@@ -62,6 +62,9 @@ Also, when a path is specified, a runtime MUST assume that the setup for that pa
         },
         {
             "type": "user"
+        },
+        {
+            "type": "cgroup"
         }
     ]
 ```
diff --git a/config.md b/config.md
@@ -643,6 +643,12 @@ Here is a full example `config.json` for reference.
             },
             {
                 "type": "mount"
+            },
+            {
+                "type": "user"
+            },
+            {
+                "type": "cgroup"
             }
         ],
         "maskedPaths": [
diff --git a/schema/defs-linux.json b/schema/defs-linux.json
@@ -224,7 +224,8 @@
                 "network",
                 "uts",
                 "ipc",
-                "user"
+                "user",
+                "cgroup"
             ]
         },
         "NamespaceReference": {
diff --git a/specs-go/config.go b/specs-go/config.go
@@ -169,6 +169,8 @@ const (
 	UTSNamespace = "uts"
 	// UserNamespace for isolating user and group IDs
 	UserNamespace = "user"
+	// CgroupNamespace for isolating cgroup hierarchies
+	CgroupNamespace = "cgroup"
 )
 
 // IDMapping specifies UID/GID mappings

Original file line number	Diff line number	Diff line change
@@ -643,6 +643,12 @@ Here is a full example `config.json` for reference.
`643`	`643`	`},`
`644`	`644`	`{`
`645`	`645`	`"type": "mount"`
	`646`	`+ },`
	`647`	`+ {`
	`648`	`+ "type": "user"`
	`649`	`+ },`
	`650`	`+ {`
	`651`	`+ "type": "cgroup"`
`646`	`652`	`}`
`647`	`653`	`],`
`648`	`654`	`"maskedPaths": [`
Original file line number	Diff line number	Diff line change
`@@ -169,6 +169,8 @@ const (`
`169`	`169`	`UTSNamespace = "uts"`
`170`	`170`	`// UserNamespace for isolating user and group IDs`
`171`	`171`	`UserNamespace = "user"`
	`172`	`+ // CgroupNamespace for isolating cgroup hierarchies`
	`173`	`+ CgroupNamespace = "cgroup"`
`172`	`174`	`)`
`173`	`175`
`174`	`176`	`// IDMapping specifies UID/GID mappings`