Contents
Does Docker use Cgroup?
Docker uses cgroups to limit the system resources. When you install Docker binary on a linux box like ubuntu it will install cgroup related packages and create subsystem directories. You can list all the subsystems that you can manage using cgroups via the lscgroup command.
What is Namespacing in Docker?
Docker uses a technology called namespaces to provide the isolated work space called the container. When you run a container, Docker creates a set of namespaces for that container. Each aspect of a container runs in a separate namespace and its access is limited to that namespace.
What is eBPF XDP?
Such is the case with XDP (eXpress Data Path). This technology allows developers to attach eBPF programs to a low-level hook, implemented by the network device driver, within the Linux kernel. XDP is similar to the Data Plane Development Kit (dpdk), but will not be detached from the driver.
How to use seccomp _ set _ mode _ filter operation?
In order to use the SECCOMP_SET_MODE_FILTER operation, either the calling thread must have the CAP_SYS_ADMIN capability in its user namespace, or the thread must already have the no_new_privs bit set.
When to use close on exec flag in seccomp?
SECCOMP_FILTER_FLAG_NEW_LISTENER (since Linux 5.0) After successfully installing the filter program, return a new user-space notification file descriptor. (The close-on-exec flag is set for the file descriptor.) When the filter returns SECCOMP_RET_USER_NOTIF a notification will be sent to this file descriptor.
Is there a seccomp filter for prctl ( 2 )?
If prctl (2) or seccomp () is allowed by the attached filter, further filters may be added. This will increase evaluation time, but allows for further reduction of the attack surface during execution of a thread. The SECCOMP_SET_MODE_FILTER operation is available only if the kernel is configured with CONFIG_SECCOMP_FILTER enabled.
What does seccomp ( 2 ) do in Linux?
The seccomp () system call operates on the Secure Computing (seccomp) state of the calling process. Currently, Linux supports the following operation values: SECCOMP_SET_MODE_STRICT The only system calls that the calling thread is permitted to make are read (2), write (2), _exit (2) (but not exit_group (2) ), and sigreturn (2).