Container Kernel Development
summary
Kernel 5.9 adds the close_range syscall, replacing slow proc-based loops and giving a striking performance win for mass-closing fds; a new close-on-exec flag handles racey loader/credential patterns. The seccomp user notifier gains an add-fd ioctl and pairs with pidfd_getfd so supervisors can fetch or inject fds and emulate syscalls safely. mount_setattr becomes atomic and recursive so changing bind/mount flags (read-only, propagation) works in one call; idmap mounts, cgroup.kill, cap_checkpoint_restore and unprivileged overlayfs also land.
AI-written summary · about
chapters (9)
- 0:00Start
- 3:26close_range(CLOSE_RANGE_UNSHARE)
- 9:37close_range(CLOSE_RANGE_CLOEXEC)
- 21:24cgroup.kill
- 24:33mount_setattr()
- 30:53Idmapped Mounts
- 37:45PIDFD_NONBLOCK
- 39:05CAP CHECKPOINT_RESTORE
- 40:52Unprivileged overlayfs
related talks
48mState of Linux Kernel Container Features
08mSubsystem Update: Seccomp, Yama, and LoadPin
50mImproving Container Security with System Call Interception
53mWhat's up in Linux-Kernel land
23mOverview and Recent Developments: seccomp and Small Linux Security Modules
19mSeecomp
34mHow can we make procfs safe?
28mExtreme OS Kernel Testing