<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">My understanding is that the unprivileged user owning the container can still alter the cgroups, right?</div><div class=""><br class=""></div><div class="">The use case that we have in mind is to allow an unprivileged user run a preconfigured container, which configuration is only writable for power users. Ideally the unprivileged user should not be able to meddle with the cgroups or even create new containers.</div><div class=""><br class=""></div><div class="">Is such a scenario feasible to implement using LXC and cgroups?</div><div class=""><br class=""></div><div class="">Todor</div><br class=""><div><blockquote type="cite" class=""><div class="">On 16. May 2017, at 05:31, Fajar A. Nugraha <<a href="mailto:list@fajar.net" class="">list@fajar.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="gmail_extra"><div class="gmail_quote">On Tue, May 16, 2017 at 1:18 AM, Dr. Todor Dimitrov <span dir="ltr" class=""><<a href="mailto:dimitrov@technology.de" target="_blank" class="">dimitrov@technology.de</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hallo,<br class="">
<br class="">
LXC automatically creates the "/sys/fs/cgroup/*/lxc/some-<wbr class="">container-name" cgroups, which are setup to reflect the restrictions as defined in the container configuration file. I was wondering whether it would be possible to use a predefined cgroups hierarchy, which is not writable by LXC. Thus it would be possible for a super-user to place resource restrictions for the containers run by the unprivileged users. Is it possible to implement such a scenario using cgroups?<br class="">
<br class=""></blockquote><div class=""><br class=""></div><div class=""><div class="">It should already does what you want. IIRC unpriv containers are unable to increase their limits by writing to the cgroup. And if needed, root on the host could always write values to the desired cgroups. </div></div><div class=""><br class=""></div><div class=""><div class="">Any particular use case in mind?</div></div><div class=""><br class=""></div><div class="">-- </div><div class="">Fajar</div></div></div></div>
_______________________________________________<br class="">lxc-users mailing list<br class=""><a href="mailto:lxc-users@lists.linuxcontainers.org" class="">lxc-users@lists.linuxcontainers.org</a><br class="">http://lists.linuxcontainers.org/listinfo/lxc-users</div></blockquote></div><br class=""></body></html>