Open Stack

Hi Julio,

if you haven't already, you can take a look at what runc is doing.

It forks a child process that re-execute itself (exec /proc/self/exe). 
Only the child process joins the namespaces with `setns` called from C
code using cgo [1]. The child process is controlled from the parent
with commands over pipes.


Marco 

[1]: 
https://github.com/opencontainers/runc/tree/master/libcontainer/nsenter


On Thu, 2018-09-27 at 17:27 +0000, Montes, Julio wrote:
> Hi All
> 
> Currently Kata Containers only supports network namespaces in the host,
> other namespaces are not supported. This week I started to work on this
> but I faced some issues with the mount namespace in Go, the main issue
> is that a multithread process can't be reassociated with a new mount
> namespace [1] as it's reported here [2]. A solution for this might be
> to write a new binary in C to create and join namespaces and start the
> kata components (shim, qemu, etc) inside it, also this binary would be
> used to clean up (unmount, etc) the containers. Another solution might
> be to use a C constructor in Go (cgo) to create and join the namespace,
> but that means kata-runtime will run inside the namespace. 
> 
> If you are already working on this or know how to deal with this issue,
> please let me know. In the meantime I'll try to figure out how.
> 
> 
> Thank you!
> 
> --
> Julio
> 
> 
> [1] - http://man7.org/linux/man-pages/man2/setns.2.html
> [2] - https://github.com/golang/go/issues/8676
> _______________________________________________
> kata-dev mailing list
> kata-dev at lists.katacontainers.io
> http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev