container cgroup isolation?

[BarryLhm]

(this is a new function proposal)

1. for complete stop

on devices where pid ns is unsupported, kill a container completely seemed impossible

but then i found cgroup capable of doing this.

just attach ruri itself to a new cgroup (v2 for group killer) (and optionally drop related privileges/mounts) before starting the container, then all processes in container could be killed with a single write(2).

2. property storage

cgroup also allows temporary (runtime) storage of non-paired properties
by making directories (with a prefix such as "_" to avoid confliction with controller files) under the container's main cgroup dir.

3. process list

if cgroup is used, the "--ps" function would be available even without pid ns.

a pid list could be fetched from cgroup.procs controller.

4. freezing?

as above, with cgroup.freeze controller

[Moe-hacker]

Seems it can be implemented, I'll introduce it in next version.

[BarryLhm]

i may try to implement this :)

[BarryLhm]

working on #46

[BarryLhm]

@Moe-hacker
does "backward compatibility" include cgroup path?
this would only affect some external scripts/programs that uses ruri's internal convention but not ruri itself

[Moe-hacker]

@Moe-hacker
does "backward compatibility" include cgroup path?
this would only affect some external scripts/programs that uses ruri's internal convention but not ruri itself

Nope, I don't think anyone will use that, as that's even undocumented part.

[BarryLhm]

then i'll go ahead to change that lol