Question: How to switch a process namespace by nsfs "device" and inode number directly?

Question: How to switch a process namespace by nsfs "device" and inode number directly?

[Chengdong Li]

Hi folks,

I am getting stuck by the lack of approach to switch process namespace 
by nsfs "device" and inode number in user-space,  for example (mnt: 
0xf0000000)

 From my best understanding, the normal way to do that is by setns 
system call. But setns only accept fd that refer to a opened namespace, 
sometimes we couldn't get it.

For example:  After perf record, perf report couldn't work well once the 
process that runs inside a container has exited, as the /proc/pid/ns 
doesn't exist anymore after process exit.

Any comments are welcome!


Thanks,

Chengdong

Re: Question: How to switch a process namespace by nsfs "device" and inode number directly?

[Andi Kleen]

On Mon, Sep 10, 2018 at 04:50:42PM +0800, Chengdong Li wrote:
> Hi folks,
> 
> I am getting stuck by the lack of approach to switch process namespace by
> nsfs "device" and inode number in user-space,  for example (mnt: 0xf0000000)
> 
> From my best understanding, the normal way to do that is by setns system
> call. But setns only accept fd that refer to a opened namespace, sometimes
> we couldn't get it.
> 
> For example:  After perf record, perf report couldn't work well once the
> process that runs inside a container has exited, as the /proc/pid/ns doesn't
> exist anymore after process exit.

The kernel name space doesn't exist anymore at this point, so there is simply no way
to reconstruct it.

Perhaps would need some higher level side band data for perf, similar as what
is done for JITed code. Somehow the container run time needs to tell perf
where to find the code.

-Andi

Re: Question: How to switch a process namespace by nsfs "device" and inode number directly?

[Chengdong Li]

Thank you, Andi!

Yes, that's a situation, also it's an important one I guess.

Another case is that a process running inside a container has exited but 
the container still alive.I think this is also a common case. The 
potential fix solutions I am thinking are following:

- Using nsfs "device" and inum. This is why I am asking for your help. 
As we already have nsfs "device" and inum of each thread at least.

- If the current thread has exited, it's probably the parent thread and 
the leader thread of that container are still alive. If we could have 
those threads' pid, then we could use setns.


If the first item is not doable, I would like to try the second one.


Thanks,

Chengdong

在 2018/9/11 上午12:02, Andi Kleen 写道:
> On Mon, Sep 10, 2018 at 04:50:42PM +0800, Chengdong Li wrote:
>> Hi folks,
>>
>> I am getting stuck by the lack of approach to switch process namespace by
>> nsfs "device" and inode number in user-space,  for example (mnt: 0xf0000000)
>>
>>  From my best understanding, the normal way to do that is by setns system
>> call. But setns only accept fd that refer to a opened namespace, sometimes
>> we couldn't get it.
>>
>> For example:  After perf record, perf report couldn't work well once the
>> process that runs inside a container has exited, as the /proc/pid/ns doesn't
>> exist anymore after process exit.
> The kernel name space doesn't exist anymore at this point, so there is simply no way
> to reconstruct it.
>
> Perhaps would need some higher level side band data for perf, similar as what
> is done for JITed code. Somehow the container run time needs to tell perf
> where to find the code.
>
> -Andi

Re: Question: How to switch a process namespace by nsfs "device" and inode number directly?

[Andi Kleen]

On Wed, Sep 12, 2018 at 10:05:27AM +0800, Chengdong Li wrote:
> Thank you, Andi!
> 
> Yes, that's a situation, also it's an important one I guess.
> 
> Another case is that a process running inside a container has exited but the
> container still alive.I think this is also a common case. The potential fix
> solutions I am thinking are following:
> 
> - Using nsfs "device" and inum. This is why I am asking for your help. As we
> already have nsfs "device" and inum of each thread at least.
> 
> - If the current thread has exited, it's probably the parent thread and the
> leader thread of that container are still alive. If we could have those
> threads' pid, then we could use setns.

This would require perf record to parse the data stream and do this
in time. There's no guarantee it can do that in time, and it would
cause a lot more overhead. Currently the data is just passed through.

> 
> If the first item is not doable, I would like to try the second one.

Yes I think that's needed.

-Andi