On 08/19/2013 10:51 PM, Tobias Kunze wrote:
> In openshift-pep-007.md:
> 
>> +# Open Issues
>> +
>> +* Disk quotas don’t work because processes inside a container can’t see the host-wide quota db.
>> +
>> +* Gear move needs to be flushed out as UIDs may change and require connection hooks to be re-run.
>> +
>> +* The memory cgroups controller is not in Fedora. As a result, a container's memory usage can not be fully controlled. As of kernel 3.8.2, the memory cgroups controller appears to be still WIP. Dan Berrange says it should be available in F19, but at least Tobias hasn't been able to get it turned on. /Documentation/cgroups/memory.txt claims it to be only a matter of enabling CONFIG_CGROUP_MEM_RES_CTLR and CONFIG_CGROUP_MEM_RES_CTLR_SWAP. From a Fedora perspective, Justin Forbes says that both MEMCG and MEMCG_SWAP are enabled in Fedora now, but that it is missing HUGETLB. Issue with HUGETLB is that it doesn't support page reclaim, i.e. containers would have to set page limits per application statically before launch and if apps would attempt to use more, they'd simply get a bus error.
>> +
>> +* Kernel user namespaces are not yet in any released kernel, albeit there are patches that can be applied to newest kernels beyond the current stable 3.8.2. Dan Walsh suggest to hold off on user namespaces and thinks they are highly experimental. Justin also pointed out that they are incompatible with xfs. The solution is to fix xfs, but I'm not aware of any work in that area. As a result, though, Fedora will not enable it until xfs is fixed.
>> +
>> +* Security in general is an issue.
>> +
>> +* Package upgrades are not generally supported inside containers, due to a variety of differences from real systems such as bind-mounting of files (that thus can't be replaced), bad interactions between udev and device mounting, security rules, dropped capabilities (Ubuntu), etc. This means that security updates would either require QA upfront to determine if they succeed or the container needs to be shut down.
>> +
>> +**Note:** in-container package upgrades or package isolation is out of scope for now.
>> +
> 
> Agree with rob's reasoning, but in this case, in-container package
> upgrades and package isolation are not yet in scope. They are future
> goals, not past ones.

I checked with Eric Sandeen about xfs support of kernel name spaces -
his reply is:

"xfs patches are on the list and were just sent to linus, I think.  We
pulled them into rhel7 too, but userns is disabled at a higher level in
rhel7 still, for now."


> 
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/openshift/openshift-pep/pull/8/files#r5860090>.
>