Paul Menage mentionned, a few weeks ago, he wanted a bind filtering for containers. Here it is :)
The following patches are a proposition to bring IP isolation to a container. After looking more closely at the code I found that security hooks are at the right place to catch socket calls. The IP isolation relies on the security hooks and that has the advantage of not having the kernel code modified, (expect container.h and makefile/kconfig), the patchset provide just a new file container_network.c Roughly, a container has a subsystem for the network (only ipv4). This subsystem contains the list of the addresses allowed to be used by the container. If a container tries to bind to an address not contained into this list, the bind will fail with EPERM. Of course the bind is allowed to INADDR_ANY. If this approach is ok for everyone, I can extend the bind filtering to consolidate the IP isolation. Regards. -- _______________________________________________ Containers mailing list [EMAIL PROTECTED] https://lists.linux-foundation.org/mailman/listinfo/containers _______________________________________________ Devel mailing list Devel@openvz.org https://openvz.org/mailman/listinfo/devel