Before I forget about all this, let's write it down :) Idea: ---- The general idea of this approach is to make the barrier unnecessary and providing a clean and secure namespace to the vservers. As a final result, I think that we could have a 3-namespace-architecture: Namespace 1 is the host's namespace, nothing new here. Namespace 2 is cloned from 1 and inherits mounts from it, but not vice versa. Namespace 3 is cloned from 2, cleaned up, gets /vservers/foo as / and inherits mounts from 2 and vice versa. Gains: ---- This accomplishes several things (in part already accomplished by the current namespace approach): 1) The host's namespace stays clean 2) VServers are captured in their namespace, without any barrier or other things that users might forget to setup, the namespace just does not contain anything except what belongs to the vserver anyway. 3) Mounts to the vservers are still possible using the secure tools of the host, because we can do all that work in namespace 2. 4) No bind mount to / with unknown/dangerous semantics anymore. 5) No more "cannot unmount, is in use" stuff, just unmount it in namespace 1 and it's gone (unless you explicitly gave it to a vserver). 6) Only a single maintainance namespace. 7) Bind mounts of newly mounted filesystems into vservers. Current status: ---- 1 and 3 are available in current namespace-enabled vservers. 3, 4, 5, 6, 7 are available with non-namespace vservers. 7 should be possible with namespaces-enabled vservers with minimal changes to util-vserver. (Maybe 5 as well) A start... ---- As the full change as mentioned above would need a lot of work, here's an idea that does a little less, but is a step into the right direction. The main reason for starting this way, is that it accomplishes quite a few of the above points, to be exact we should cover: 1, 2, 3, 4, 7 and maybe 5. The first step that I propose is that we use the same namespaces as above, but have not only one NS3 per vserver, but also a NS2. Basically we just enhance the current setup. First, we spawn a NS2-type namespace, store that as administration context in the vx_info (kernel). Then clone a namespace and make that type 3, which is stored as the vserver namespace in vx_info. The type 2 namespace is used as long as we need something from that namespace, and just before we exec() the vserver's process from the tools, we switch to the type 3 namespace. Inherit mounts?! ---- Since 2.6.15(?) the kernel supports different kinds of mounts: shared, slave, private, unbindable Private are the known ones. Shared are mounts that if cloned (bind, new namespace) share all mounts that are created on top of them or their copies to appear on all their copies. Slaves are one-way, the only receive mounts but don't propagate them. Unbindable is just that ;) see Documentation/sharedsubtree.txt in your friendly kernel source tree for details. So, you tell us all this stuff, what did you do already? ---- I started figuring out the basic steps required to get a type 3 namespace which needs some "trick" as certain things are forbidden for shared mounts to avoid loops. Getting a type 2 ns should be trivial, but I decided to write this down first... How do I get such a type 3 namespace then? ---- Simple :) You have util-vserver and a Linux-VServer kernel at hand, right? Then you need smount (from the shared subtree docs), screen and this: clean.c: #include #include #include #include #include #include #include #include #define MNT_DETACH 2 #define MS_MOVE 8192 main(int argc, char **argv) { pivot_root(".", "tmp"); chroot("/"); chdir("/"); umount2("tmp", MNT_DETACH); execl("/bin/sh", "sh", "-i", (char*)0); 0); } We start by getting a namespace to play with: vnamespace -n bash then we create a bind mount for our vserver: mount --bind /vservers/foo /vservers/foo and another one on its tmp, this is needed because pivot_root needs a non-shared mount for the old-root: mount --bind /vservers/foo/tmp /vservers/foo/tmp now we make the vserver's root bind mount shared: smount /vservers/foo/ shared now we start screen, we do this to have access to our temporary namespace as well as the one we'll clone: screen Create a second screen window C-a c Fork off the new namespace: vnamespace -n bash change into the desired root: cd /vservers/foo clean it up: /path/to/clean_from_above Removing the temporary bind mount on /tmp umount /tmp Use the other screen window: C-a n See that the /tmp mount is gone there as well: grep vservers /proc/mounts Mount proc for the vserver: mount -t proc none /vservers/foo/proc Change to the other screen window: C-a n See that proc was mounted here as well: ls /proc See that the namespace is clean: cat /proc/mounts You're done :) We probably still don't have a _really_ clean namespace, as I didn't care to close all fds and such stuff, but it shows that the idea works.