search for: zhongjj

OOPS: "If I do not want to disable the cgroup in container" ==> "If I do want to disable the cgroup in container" I meant if the user namespace not enabled in kernel ... thx ,I will try user namespace later. I am not working on x86 and not suer wheather the usernamespace is ok in the kernel I am going to use. I would try to disable the cgroup in lxc first.

...want to disable the cgroup in container , is there any config file ? or do i have to do something to the libvirt source code to skip it ? ------------------ 原始邮件 ------------------ 发件人: "Gao feng"<gaofeng@cn.fujitsu.com>; 发送时间: 2013年8月26日(星期一) 下午4:06 收件人: "止语"<zhongjj@foxmail.com>; 抄送: "libvirt-users"<libvirt-users@redhat.com>; 主题: Re: [libvirt-users] How to deal with LXC cgroup access control withapparmor ? On 08/26/2013 03:42 PM, 止语 wrote: > I am playing with libvirt 1.1.1 (lxc) > when I was starting a LXC container, the process...

I am playing with libvirt 1.1.1 (lxc) when I was starting a LXC container, the process location of cgroup is pretty , just the root directory from the process. But I could tune the cgroup in a container as an user that logged, This is not accepted... I wonder how to restrict it with apparmor ,so one can not modify files in the cgroup fs, e.g the cpus or mem, if i restrict it with "deny

I am running lxc via libvirt1.1.1, the cpu usage is heavy of process libvirt_lxc. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 2384 root 20 0 10480 2048 1200 R 99.6 0.1 1291:39 libvirt_lxc