19 lines · plain
1===========================2Namespaces research control3===========================4 5There are a lot of kinds of objects in the kernel that don't have6individual limits or that have limits that are ineffective when a set7of processes is allowed to switch user ids. With user namespaces8enabled in a kernel for people who don't trust their users or their9users programs to play nice this problems becomes more acute.10 11Therefore it is recommended that memory control groups be enabled in12kernels that enable user namespaces, and it is further recommended13that userspace configure memory control groups to limit how much14memory user's they don't trust to play nice can use.15 16Memory control groups can be configured by installing the libcgroup17package present on most distros editing /etc/cgrules.conf,18/etc/cgconfig.conf and setting up libpam-cgroup.19