Overview and Recent Developments: Namespaces and Capabilities
summary
Covers concrete kernel work from roughly 4.10–4.18: libcap adds libcap ambient capability support and namespace filesystem-capability handling; UID/GID map limit jumps from 5 to 340; capabilities become namespace-aware and filesystem capabilities become per-user-namespace; fixes add per-namespace inotify limits, nsget/ioctls to inspect owning namespaces, and unprivileged mounts from user namespaces including FUSE and device-event injection; ongoing patches propose time namespaces, a new mount API and recursive read-only bind semantics, plus netlink ops to query many network namespaces efficiently.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:22What are Capabilities
- 1:24Namespaces
- 3:40User Namespace
- 4:42User Namespace Requirements
- 7:31What has happened
- 9:09I Octal
- 19:34Unprivileged Mounts
- 21:48Unprivileged Fuse
- 23:51Current Patch Sets
- 26:50Future Patch Sets
related talks
42mWhat's New in the User Namespace
57mNamespaces for Security
46mCurrent State of Kernel Audit and Linux Namespaces, Looking Ahead to Containers
39mLinux User Namespaces: A Blessing and a Curse
29mFilesystem mounts in user namespaces
54mUnderstanding user namespaces
54mContainers unplugged: understanding user namespaces
47mLinux user namespaces: a blessing and a curse