[libvirt] LXC: making the private root filesystem more secure

[Daniel Veillard]

On Thu, Sep 04, 2008 at 12:50:35PM -0700, Dan Smith wrote:
> DV> I just checked the libcgroup heaer file available under Fedora 9
> DV> and I'm a bit afraid of the dependancy. They expose a lot of
> DV> structure, some clearly incomplete, which means liking to it in its
> DV> current state may turn into a problematic dependency.
> 
> I've become increasingly concerned about the likelihood of converging on
> something stable that will work for libvirt in this area.  I hate to
> ignore an abstraction layer that may help reduce the amount of knowledge
> of cgroups that has to be present in libvirt.  However, I'm not sure
> that libcgroup is really going to provide such a layer, and thus would
> (as you put it) become nothing but a problematic dependency.
> 
> Perhaps it makes the most sense to implement a bit of cgroup support
> directly into libvirt to satisfy our current needs while we wait to see
> if libcgroup matures?

  Yes I don't want to presume the ability of the libcgroup to become
cleaner and more stable, we can probably go with a small internal API
and when/if things become nicer, then reuse libcgroup,

  thanks for the insights,

Daniel

-- 
Daniel Veillard      | libxml Gnome XML XSLT toolkit  http://xmlsoft.org/
daniel at veillard.com  | Rpmfind RPM search engine http://rpmfind.net/
http://veillard.com/ | virtualization library  http://libvirt.org/