Arch Linux

And dwight didn't add this :) http://lxc.teegra.net/

Shridhar

We won't enable SMACK again - we tried once and several machines didn't work right for reasons I didn't bother to investigate.

As for the rest, I never knew what they were about - are there any drawbacks in enabling them?

Alright on the SMACK issue. For typical Linux container setups it is not needed, it is only necessary when trying to really lock down a container. And yes a quick search shows that others have had issues with CONFIG_SECURITY_SMACK=y as well. If I really needed that kind of security I would not mind maintaining a separate kernel PKGBUILD.

As far as drawbacks of enabling the configs required for LXC, I'm not aware of any. As far as I know the only thing that uses them is the LXC userspace tools to setup containers. I have these enabled on 2 machines and have not had any issues, I'm about to them to 4 or 5 more as I plan to start using Linux containers a lot more. I was using OpenVZ, but it is unlikely that will ever make it to recent kernels any time soon or ever make into into the mainstream kernel code as Linux containers is already in there and is a lot more flexible.

Prior to 2.6.29 most of these features were only available as patches to the mainstream kernel.

I'll ask about any potential drawbacks on the Linux Containers mailing list.

From the linux container's mailing list on this subject. See https://lists.linux-foundation.org/pipermail/containers/2009-October/021403.html for the rest of the thread.

On Sun, Oct 18, 2009 at 10:44 AM, Daniel Lezcano <daniel.lezcano@free.fr> wrote:
In general the cgroup adds a small overhead at fork/exit when a subsystem make use of the cgroup_callbacks, for example the freezer. But that can be considered as negligeable.

CONFIG_GROUP_SCHED=y
CONFIG_FAIR_GROUP_SCHED=y
CONFIG_RT_GROUP_SCHED=y
CONFIG_CGROUP_SCHED=y
CONFIG_CGROUPS=y
CONFIG_CGROUP_NS=y
CONFIG_CGROUP_FREEZER=y

This one does not add any overhead.

CONFIG_CGROUP_DEVICE=y

For these ones, I don't know.

CONFIG_CPUSETS=y
CONFIG_PROC_PID_CPUSET=y

AFAIR these following options add some overhead especially the memory resource controller.

CONFIG_CGROUP_CPUACCT=y
CONFIG_RESOURCE_COUNTERS=y
CONFIG_CGROUP_MEM_RES_CTLR=y
CONFIG_CGROUP_MEM_RES_CTLR_SWAP=y
CONFIG_MM_OWNER=y


The overhead and footprint of the following options are neligeable

CONFIG_NAMESPACES=y
CONFIG_UTS_NS=y
CONFIG_IPC_NS=y
CONFIG_USER_NS=y
CONFIG_PID_NS=y
CONFIG_NET_NS=y
CONFIG_NET_CLS_CGROUP=y


This one, no overhead.
CONFIG_SECURITY_FILE_CAPABILITIES=y

CONFIG_DEVPTS_MULTIPLE_INSTANCES=y

Would also be useful: Support multiple instances of devpts

http://cateee.net/lkddb/web-lkddb/DEVPTS_MULTIPLE_INSTANCES.html
http://blog.flameeyes.eu/2009/08/10/some-more-notes-about-linux-containers

FYI, more from the Linux containers maling list concerning some of these configuration options.
https://lists.linux-foundation.org/pipermail/containers/2009-October/021616.html

On Tue, Oct 27, 2009 at 3:42 AM, KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> wrote:
> On Sun, 18 Oct 2009 17:44:31 +0200
> Daniel Lezcano <daniel.lezcano@free.fr> wrote:
>
>> AFAIR these following options add some overhead especially the memory resource controller.
>>
>> CONFIG_CGROUP_CPUACCT=y
>> CONFIG_RESOURCE_COUNTERS=y
>> CONFIG_CGROUP_MEM_RES_CTLR=y
>> CONFIG_CGROUP_MEM_RES_CTLR_SWAP=y
>> CONFIG_MM_OWNER=y
>>
>>
> sorry, memcg's performance fix is now tested under -mm kernel.
> plz wait for 2.6.33 ;(
>
> Thanks,
> -Kame

Will this be added to 2.6.32?

Shridhar

due to permormance issue it will be added to .33 series.

CONFIG_DEVPTS_MULTIPLE_INSTANCES is needed.

So archlinux kernel26 version 2.6.33 will be lxc enabled?

Would now be a good time to add the options for LXC to the kernel26 2.6.33 package?

Here are a summary of the needed LXC options that would be nice if they made it into the 2.6.33 kernel package.

CONFIG_GROUP_SCHED=y
CONFIG_FAIR_GROUP_SCHED=y
CONFIG_RT_GROUP_SCHED=y
CONFIG_CGROUP_SCHED=y
CONFIG_CGROUPS=y
CONFIG_CGROUP_NS=y
CONFIG_CGROUP_FREEZER=y
CONFIG_CGROUP_DEVICE=y
CONFIG_CPUSETS=y
CONFIG_PROC_PID_CPUSET=y
CONFIG_CGROUP_CPUACCT=y
CONFIG_RESOURCE_COUNTERS=y
CONFIG_CGROUP_MEM_RES_CTLR=y
CONFIG_CGROUP_MEM_RES_CTLR_SWAP=y
CONFIG_MM_OWNER=y
CONFIG_NAMESPACES=y
CONFIG_UTS_NS=y
CONFIG_IPC_NS=y
CONFIG_USER_NS=y
CONFIG_PID_NS=y
CONFIG_NET_NS=y
CONFIG_NET_CLS_CGROUP=y
CONFIG_DEVPTS_MULTIPLE_INSTANCES=y

# The following should already be turned on.
CONFIG_SECURITY_FILE_CAPABILITIES=y