<div dir="ltr">Hi Serge,<div><br><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 22, 2013 at 2:21 PM, Serge Hallyn <span dir="ltr"><<a href="mailto:serge.hallyn@ubuntu.com" target="_blank">serge.hallyn@ubuntu.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>Quoting Oren Laadan (<a href="mailto:orenl@cellrox.com" target="_blank">orenl@cellrox.com</a>):<br>
> Hi everyone!<br>
><br>
> We [1] have been working on bringing lightweight virtualization to<br>
> Linux-based mobile devices like Android (or other Linux-based devices with<br>
> diverse I/O) and want to share our solution: device namespaces.<br>
><br>
> Imagine you could run several instances of your favorite mobile OS or other<br>
> distributions in isolated containers, each under the impression of having<br>
> exclusive access to device drivers; Interact and switch between them within<br>
> a blink, no flashing, no reboot.<br>
><br>
> Device namespaces are an extension to existing Linux kernel namespaces that<br>
> brings lightweight virtualization to Linux-based end-user devices,<br>
> primarily mobile devices.<br>
> Device namespaces introduce a private and virtual namespace for device<br>
> drivers to create the illusion for a process group that it interacts<br>
> exclusively with a set of drivers. Device namespaces also introduce the<br>
> concepts of an “active” namespace with which a user interacts, vs<br>
> “non-active” namespaces that run in the background, and the ability to<br>
> switch between them.[2]<br>
<br>
</div>Note that unless I'm misunderstanding what you're saying here, this is<br>
also what net_ns does. A netns can exist with no processes so long as<br>
you've bound its /proc/$$/ns/net somewhere. You can then re-enter that<br>
ns using ns_attach. I haven't looked closely enough yet to see whether<br>
you should be (or are) using the same interface.<br>
<div><br></div></blockquote><div><br></div><div>To illustrate the need for device namespaces, consider the use case of running two containers of your favorite OS (say, Android), on a single physical phone. As a user, you either work in one container, or in the other, and you will want to be able to switch between them (just like with apps on mobile devices: you interact with one application at a time, and switch between them).</div>
<div><br></div><div>See here for a demo of how it works: <a href="http://vimeo.com/60113683">http://vimeo.com/60113683</a></div><div><br></div><div>To accomplish this, device namespaces solve two shortcomings of existing namespaces:<br>
</div><div><br></div><div>1. A namespace for device drivers: each (Android) container needs a private view of all devices. This includes logical drivers, like binder (in Android) but also loop device; and physical devices, like the framebuffer and the touch-screen.</div>
<div><br></div><div>In other words, device namespaces virtualize the _major/minor_ and the _state_ of device drivers. With the exception of VFS, network, and PTY (note: all three offer/are virtual devices), device drivers are otherwise not isolated between containers.</div>
<div><br></div><div>2. A namespace for interactive scenarios: a namespace can be "active" - it has access to the hardware, e.g. display and touch-screen. This will be the container with which the user is interacting right now. Otherwise a namespace is "non-active" - it still runs in the background, but can neither alter the display nor receive input from the touch-screen. Switching to another container means a context switch in the relevant drivers, so that they restore the state and now "obey" the other namespace.</div>
<div><br></div><div>You can also think about the "active" namespace as foreground, and the "non-active" as background, akin to foreground/background processes in a terminal with job-control. Similar to how a terminal delivers input to the foreground task only but not to the background tasks - this is enforced by the new device namespace.</div>
<div><br></div><div>More details on this use-case are in the wiki: <a href="https://github.com/Cellrox/devns-patches/wiki/Thinvisor">https://github.com/Cellrox/devns-patches/wiki/Thinvisor</a>).<br></div><div><br></div><div>
<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>> We are planning to prepare individual patches to be submitted to the<br>
<br>
</div>Looking forward to it, and seeing you at the containers track :)<br></blockquote><div><br></div><div>Same here!</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div><br>
> 2: <a href="https://github.com/Cellrox/devns-patches/wiki/DeviceNamespace" target="_blank">https://github.com/Cellrox/devns-patches/wiki/DeviceNamespace</a><br>
> 3: <a href="https://github.com/Cellrox/devns-patches" target="_blank">https://github.com/Cellrox/devns-patches</a><br>
> 4: <a href="https://github.com/Cellrox/devns-demo" target="_blank">https://github.com/Cellrox/devns-demo</a><br>
<br>
</div>(Have looked over the wiki, will look over the patches as well)<br>
<span><font color="#888888"><br>
-serge<br>
</font></span></blockquote></div><br><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr" style="display:inline!important"><div dir="ltr" style="display:inline!important"><div dir="ltr" style="display:inline!important">
<div dir="ltr"><div dir="ltr" style="display:inline!important"><div dir="ltr" style="display:inline!important"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr" style="display:inline!important">
<div dir="ltr" style="display:inline!important"><div dir="ltr" style="display:inline!important"><div dir="ltr" style="display:inline!important"></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div></div></div></div></div></div></div>
</div></div><div class="gmail_extra"><br></div><div class="gmail_extra"><div>Thanks,</div><div><br></div><div>Oren.</div><div><span style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px"><br></span></div>
<div><span style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px">-- </span><div style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px"> Oren Laadan</div><div style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px">
Cellrox Ltd.</div></div><div><br></div></div></div>