| 123456789101112131415 |
- There are a lot of kinds of objects in the kernel that don't have
- individual limits or that have limits that are ineffective when a set
- of processes is allowed to switch user ids. With user namespaces
- enabled in a kernel for people who don't trust their users or their
- users programs to play nice this problems becomes more acute.
- Therefore it is recommended that memory control groups be enabled in
- kernels that enable user namespaces, and it is further recommended
- that userspace configure memory control groups to limit how much
- memory user's they don't trust to play nice can use.
- Memory control groups can be configured by installing the libcgroup
- package present on most distros editing /etc/cgrules.conf,
- /etc/cgconfig.conf and setting up libpam-cgroup.
|
