The foundation of the design for containers in the kernel is that there isn't one; there is no container abstraction that the kernel recognizes. Instead, the kernel provides a long list of components — namespaces, control groups, sandboxing mechanisms, and more — along with a note that says, in effect, "some assembly required". There have been <a href="https://lwn.net/Articles/723477/">attempts</a> (<a href="https://lwn.net/Articles/780364/">repeatedly</a>) over the years to turn containers into first-class objects with kernel support, but they have never gotten far. Now Josef Bacik is <a href="https://lwn.net/ml/all/[email protected]">making a try</a> with a concept that he calls "cells".
Continue to LWN.net →You are being forwarded in 6s — stay on this page