1CGROUP_NAMESPACES(7)       Linux Programmer's Manual      CGROUP_NAMESPACES(7)
2
3
4

NAME

6       cgroup_namespaces - overview of Linux cgroup namespaces
7

DESCRIPTION

9       For an overview of namespaces, see namespaces(7).
10
11       Cgroup  namespaces  virtualize  the  view  of  a process's cgroups (see
12       cgroups(7)) as seen via /proc/[pid]/cgroup and /proc/[pid]/mountinfo.
13
14       Each cgroup namespace has its  own  set  of  cgroup  root  directories.
15       These  root  directories are the base points for the relative locations
16       displayed in the corresponding records in the /proc/[pid]/cgroup  file.
17       When  a  process  creates  a new cgroup namespace using clone(2) or un‐
18       share(2) with the CLONE_NEWCGROUP flag, its current cgroups directories
19       become the cgroup root directories of the new namespace.  (This applies
20       both for the cgroups version 1 hierarchies and the  cgroups  version  2
21       unified hierarchy.)
22
23       When  reading  the  cgroup  memberships  of  a  "target"  process  from
24       /proc/[pid]/cgroup, the pathname shown  in  the  third  field  of  each
25       record will be relative to the reading process's root directory for the
26       corresponding cgroup hierarchy.  If the cgroup directory of the  target
27       process lies outside the root directory of the reading process's cgroup
28       namespace, then the pathname will show ../ entries  for  each  ancestor
29       level in the cgroup hierarchy.
30
31       The  following  shell session demonstrates the effect of creating a new
32       cgroup namespace.
33
34       First, (as superuser) in a shell in the initial  cgroup  namespace,  we
35       create  a child cgroup in the freezer hierarchy, and place a process in
36       that cgroup that we will use as part of the demonstration below:
37
38           # mkdir -p /sys/fs/cgroup/freezer/sub2
39           # sleep 10000 &     # Create a process that lives for a while
40           [1] 20124
41           # echo 20124 > /sys/fs/cgroup/freezer/sub2/cgroup.procs
42
43       We then create another child cgroup in the freezer  hierarchy  and  put
44       the shell into that cgroup:
45
46           # mkdir -p /sys/fs/cgroup/freezer/sub
47           # echo $$                      # Show PID of this shell
48           30655
49           # echo 30655 > /sys/fs/cgroup/freezer/sub/cgroup.procs
50           # cat /proc/self/cgroup | grep freezer
51           7:freezer:/sub
52
53       Next,  we use unshare(1) to create a process running a new shell in new
54       cgroup and mount namespaces:
55
56           # PS1="sh2# " unshare -Cm bash
57
58       From  the  new  shell  started  by  unshare(1),  we  then  inspect  the
59       /proc/[pid]/cgroup  files  of,  respectively,  the new shell, a process
60       that is in the initial cgroup namespace (init, with  PID  1),  and  the
61       process in the sibling cgroup (sub2):
62
63           sh2# cat /proc/self/cgroup | grep freezer
64           7:freezer:/
65           sh2# cat /proc/1/cgroup | grep freezer
66           7:freezer:/..
67           sh2# cat /proc/20124/cgroup | grep freezer
68           7:freezer:/../sub2
69
70       From  the  output  of the first command, we see that the freezer cgroup
71       membership of the new shell (which is in the same cgroup as the initial
72       shell)  is  shown defined relative to the freezer cgroup root directory
73       that was established when the new cgroup namespace  was  created.   (In
74       absolute  terms,  the  new shell is in the /sub freezer cgroup, and the
7