From mboxrd@z Thu Jan 1 00:00:00 1970 MIME-Version: 1.0 In-Reply-To: References: <140e7ec30907130124g1a0e4c90m6d83a08516d95463@mail.gmail.com> <3aaafc130907131518y74523ef8rf9ddb92fb3d3d105@mail.gmail.com> <13426df10907131616k203f0676yb181157cac24d179@mail.gmail.com> Date: Mon, 13 Jul 2009 19:56:33 -0500 Message-ID: From: Eric Van Hensbergen To: Fans of the OS Plan 9 from Bell Labs <9fans@9fans.net> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [9fans] v9fs question Topicbox-Message-UUID: 1e561908-ead5-11e9-9d60-3106f5b1d025 On Mon, Jul 13, 2009 at 7:42 PM, Tim Newsham wrote: >> Could we solve this by making private mounts the default (or only >> allowed) behavior? > > I've wondered if there's enough context information > that the fs driver could "fake" per-process mount points > directly. > Lucho's v9fs auth mechanisms allow for per-user namespaces (sort-of) as they force a new-attach ever time a new user crosses the mount point. I think there's enough knowledge (in Linux anyways) to obtain the current process. The hard bit is, as you say, managing inheritance and other namespace process controls. This is why its probably best implemented in a more integrated fashion. I have been playing with using Inferno to construct dynamic namespaces for me in Linux and MacOSX. The idea is to setup the namespace and then back mount it (with v9fs and FUSE) in either a private namespace or a chroot. I'm using this to implement an xcpu2-like environment purely with Inferno (remote threads get their own private namespace sandboxes to run in with an Inferno crafted namespace). Not as powerful as the whole enchilada, but it provides a container environment with composable namespaces. -eric