You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by ji...@apache.org on 2017/09/18 19:04:50 UTC
[05/16] mesos git commit: Moved pid namespace isolator doc to the
isolators folder.
Moved pid namespace isolator doc to the isolators folder.
Review: https://reviews.apache.org/r/62297
Project: http://git-wip-us.apache.org/repos/asf/mesos/repo
Commit: http://git-wip-us.apache.org/repos/asf/mesos/commit/74593230
Tree: http://git-wip-us.apache.org/repos/asf/mesos/tree/74593230
Diff: http://git-wip-us.apache.org/repos/asf/mesos/diff/74593230
Branch: refs/heads/master
Commit: 74593230ac580ed1a31e4977acf333f582f3393b
Parents: e80aaa7
Author: Jie Yu <yu...@gmail.com>
Authored: Wed Sep 13 11:21:47 2017 -0700
Committer: Jie Yu <yu...@gmail.com>
Committed: Mon Sep 18 12:04:38 2017 -0700
----------------------------------------------------------------------
docs/isolators/namespaces-pid.md | 29 +++++++++++++++++++++++++++++
docs/mesos-containerizer.md | 21 ---------------------
2 files changed, 29 insertions(+), 21 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/mesos/blob/74593230/docs/isolators/namespaces-pid.md
----------------------------------------------------------------------
diff --git a/docs/isolators/namespaces-pid.md b/docs/isolators/namespaces-pid.md
new file mode 100644
index 0000000..bf4dadc
--- /dev/null
+++ b/docs/isolators/namespaces-pid.md
@@ -0,0 +1,29 @@
+---
+title: Apache Mesos - Pid Namespace Isolator in Mesos Containerizer
+layout: documentation
+---
+
+# Pid Namespace Isolator in Mesos Containerizer
+
+The `namespaces/pid` isolator can be used to isolate each container in
+a separate pid namespace with two main benefits:
+
+1. Visibility: Processes running in the container (executor and
+ descendants) are unable to see or signal processes outside the
+ namespace.
+
+2. Clean termination: Termination of the leading process in a pid
+ namespace will result in the kernel terminating all other processes
+ in the namespace.
+
+You can turn on this isolator by specifying the `--isolation` agent
+flag (i.e., `--isolation=namespaces/pid,...`). Note that
+`filesystem/linux` isolator is required for turning on pid namespace
+isolator.
+
+The Launcher will use (2) during destruction of a container in
+preference to the freezer cgroup, avoiding known kernel issues related
+to freezing cgroups under OOM conditions.
+
+`/proc` will be mounted for containers so tools such as `ps` will work
+correctly.
http://git-wip-us.apache.org/repos/asf/mesos/blob/74593230/docs/mesos-containerizer.md
----------------------------------------------------------------------
diff --git a/docs/mesos-containerizer.md b/docs/mesos-containerizer.md
index fc8a9ec..e174785 100644
--- a/docs/mesos-containerizer.md
+++ b/docs/mesos-containerizer.md
@@ -13,27 +13,6 @@ can selectively enable different isolators.
It also provides basic support for POSIX systems (e.g., OSX) but
without any actual isolation, only resource usage reporting.
-### Pid Namespace
-
-The Pid Namespace isolator can be used to isolate each container in
-a separate pid namespace with two main benefits:
-
-1. Visibility: Processes running in the container (executor and
- descendants) are unable to see or signal processes outside the
- namespace.
-
-2. Clean termination: Termination of the leading process in a pid
- namespace will result in the kernel terminating all other processes
- in the namespace.
-
-The Launcher will use (2) during destruction of a container in
-preference to the freezer cgroup, avoiding known kernel issues related
-to freezing cgroups under OOM conditions.
-
-/proc will be mounted for containers so tools such as 'ps' will work
-correctly.
-
-
### Posix Disk Isolator
The Posix Disk isolator provides basic disk isolation. It is able to