Hacker News new | past | comments | ask | show | jobs | submit login

Namespaces do that, not cgroups.



Containers need both namespaces and groups. While created for different purposes, both serve the same purpose within the container world: Giving processes within a container a limited set of actual host capabilities. If cgroups hadn't already existed, we likely would have a namespace that did the same thing; as it is, we had cgroups, so we didn't that namespace.


This similarity is constructed. Namespacing is largely about entry points into kernel data structures, while cgroups are a form of active accounting. They are orthogonal, and the existence of the cgroups namespace (=the intersection of both) illustrates that.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: