LDP
/
man-pages
mirror of https://github.com/mkerrisk/man-pages
0
1
Fork 0
Code Releases Activity

cgroup_namespaces.7: wfix 

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
This commit is contained in:
Michael Kerrisk 2016-05-07 09:06:21 +02:00
parent 3ab5cbdabf
commit a2b7dba58c
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
man7/cgroup_namespaces.7
View File

@ -156,10 +156,9 @@ Such leakages could, for example,
reveal information about the container framework
to containerized applications.
.IP *
It allows easier and more flexible
confinement of container root tasks, because they can mount
their own cgroup filesystems without gaining access to ancestor
cgroup directories.
It allows better confinement of containererized processes,
because it is possible to mount the container's cgroup filesystems such that
the container processes can't gain access to ancestor cgroup directories.
Consider, for example, the following scenario:
.RS 4
.IP \(bu 2