johnkoepi

"seccomp containers" sounds weird... like what is a container in Linux anyway :D

I love ideas behind Landlock but I don't fully see the struggle currently without taking into considerations issues with io_uring api. Seccomp nowadays with AppArmor|SElinux is enough even for Nested rootless containers. Nested even into std runc things. Both AppArmor and Seccomp profiles are stackable. If you don't need to generate unique profiles per each container you should be fine...

way too different things, everyone using seccomp when they don't have AppArmor only profile. sometimes even do both.

+1

An example of debugging mount(2) issues when mounting sysfs filesystem inside of the user namespace to demonstrate practical usage of ftrace (perf) and eBPF (bpftrace) in addition to reading of the Kernel source code for debugging syscalls behavior.

> 3) Transferring data from one host to another when you need to bring up a stateful process does not scale. Above a few gigs, the transfer process creates significant load on both the source and destination host, and will easily saturate the link between the two...

It depends. @falcolas, could you point out a few other solutions then that? (for resharding live, other then replication / copy / rsync / ...)