8K ! whow ! :)
Yes, I think so.
Maybe I misunderstanding but you are trying to save some syscalls, you
should use socketat only and keep app control namespace0 socket for it.
The process will be in the last netns you unshared (maybe you can use
here one setns syscall to return back to the namespace0).
(1) socketat :
* pros : 1 syscall to create a socket
* cons : a file descriptor per namespace, namespace is only
manageable via a socket
(2) setns :
* pros : namespace is fully manageable with a generic code
* cons : 2 syscall (or 3 if we want to return to the initial
netns) to create a socket(setns + socket [ + setns ]), a file descriptor
per namespace
(3) setns + bind mount :
* pros : no file descriptor need to be kept opened
* cons : startup longer, (unshare + mount --bind), 4 syscalls
to create a socket in the namespace (open, setns, socket, close), (may
be 5 syscalls if we want to return to the initial netns).
Depending of the scheme you choose the startup will be for:
(1) socketat :
* open /proc/self/ns/net (one time to 'save' and pin the
initial netns)
and then
int create_ns(void)
{
unshare(CLONE_NEWNET);
return socket(...)
}
and,
for (i = 0; i < 8192; i++)
mynsfd[i] = create_ns();
(2) setns :
* open /proc/self/ns/net (one time to 'save' and pin the
initial netns)
and then
int create_ns(void)
{
unshare(CLONE_NEWNET);
return open("/proc/self/ns/net");
}
and,
for (i = 0; i < 8192; i++)
mynsfd[i] = create_ns();
(3) setns + mount :
* open /proc/self/ns/net (one time to 'save' and pin the
initial netns)
and then
int create_ns(const char *nspath)
{
unshare(CLONE_NEWNET);
creat(nspath);
mount("/proc/self/ns/net", nspath, MS_BIND);
}
for (i = 0; i < 8192; i++)
create_ns(mynspath[i]);
Hope that helps.
-- Daniel
--
