A global namespace some system resources into a package abstraction, the abstraction global resource instances have their own isolated for the present process is the namespace. These global resources to change the namespace of the process is visible, while the other process is not visible.
Linux provides about several Namespaces:
the Namespace Constant Isolates
- Cgroup CLONE_NEWCGROUP Cgroup root Directory
- IPC CLONE_NEWIPC System V IPC, the POSIX the Message Queues
- Network CLONE_NEWNET Network Devices, Stacks, the ports, etc.
- Mount CLONE_NEWNS Mount Points
- PID CLONE_NEWPID Process IDs
- the User the User IDs and Group CLONE_NEWUSER
- UTS CLONE_NEWUTS Hostname Domain name and NIS
It can be seen cgroup a domain name, Cgroups is the abbreviation of control groups, originally proposed by google engineer, it was later integrated into the Linux kernel. Cgroups is a Linux kernel may provide limited recording, a physical resource isolation process group (process groups) used: mechanisms (such as CPU, memory, IO, etc.). Cgroups 7 by the sub-systems: namely cpuset, cpu, cpuacct, blkio, devices, freezer, memory. Assign and manage different types of resources is responsible for the completion of each cgroup subsystems.
- blkio This subsystem is set as a block device input / output restriction, such as physical devices (disk, solid state disk, USB, etc.).
- The cpu subsystem uses the scheduler to provide cgroup tasks access to the CPU.
- cpuacct the CPU subsystem automatically generates reports cgroup tasks used.
- The cpuset subsystem allocates independent CPU (multi-core system) and the memory node cgroup tasks.
- This subsystem devices may be allowed or denied access to the device task in cgroup.
- The freezer subsystem suspends or recovery tasks in the cgroup.
- The memory subsystem memory limit set in cgroup tasks and automatically generate reports memory resources used by those tasks.
- This subsystem uses net_cls class identifier (ClassID) labeled network packets, flow control procedure may allow Linux (tc) generated from identification packet cgroup in particular.
- ns namespace subsystem.
Docker is the use cgroup resource partitioning, each container are up and running as a process, each business will have a container-based pause POD container that is used as the base container. pause container provides content into namespace and communicates all containers under the same POD, shared network resources.
View the vessel PID, corresponding to / proc / pid / down run of the container resource.