[jira] [Commented] (MESOS-1585) Container level network isolation

["Timothy St. Clair (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/MESOS-1585?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14062159#comment-14062159 ] 

Timothy St. Clair commented on MESOS-1585:
------------------------------------------

[~benjaminhindman] & [~jieyu]
Is there a map between the native work being done here, and possible iptables mods in Docker containers?  

Arguably you can easily fudge iptables of a Docker container to get similar behavior, and I believe this is the roadmap for their QoS tiers in Kubernetes.  



> Container level network isolation
> ---------------------------------
>
>                 Key: MESOS-1585
>                 URL: https://issues.apache.org/jira/browse/MESOS-1585
>             Project: Mesos
>          Issue Type: Epic
>          Components: isolation
>            Reporter: Jie Yu
>
> The goal here is to provide network isolation between containers so that one container cannot saturate the entire network, affecting the performance of other containers.
> There are many options here. With the current network monitoring code (MESOS-1228, already committed), one option is to add a "tc police action" on the 'veth' of each container to drop packets when the traffic exceeds a certain limit.
> Other options include advanced shape control using tc classes (e.g., HTB, CBQ, etc.). We're gonna need to extend the current routing library to support that.



--
This message was sent by Atlassian JIRA
(v6.2#6252)