> Anyway, if you don't trust a container you'd better set the hard memory > limit so that it can't hurt others no matter what it runs and how it > tweaks its sub-tree knobs.
If you don't trust it put it in a VM. If it's got access to GEM graphics ioctls/nodes or some other kernel interfaces then it can blow up the kernel without trying hard unless its constrained within a VM. VMs can be extremely light weight if you avoid KVM emulating an entire PC. Alan -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
