Repository navigation
docs(r08): Part 9 — Containers and Virtualization - #8
Merged
Merged
Conversation
pmon v6 (namespaces + cgroup v2 memory.max/cpu.max + PSI, OOM negative control), fwatch v3 (Landlock + seccomp sandbox, EACCES/EPERM controls), multi-stage UBI10 Containerfiles under rootless podman (pid-1 duties, container-aware CPU/mem detection — GOMAXPROCS/available_parallelism vs hardware_concurrency trap), overheadbench (host vs VM vs container). 10 diagram pairs. Also adds podman requires-gate to the runner. Adversarial validation confirmed every enforcing control live. 102/102.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Chapters 32-35 + 4 examples. Namespaces/cgroups (pmon v6, OOM negative control), seccomp + Landlock sandbox (fwatch v3, EACCES/EPERM controls), our daemons in multi-stage UBI10 Containerfiles under rootless podman (pid-1, container-aware resource detection — the hardware_concurrency trap shown concretely), overheadbench host-vs-VM-vs-container. Covers the containers-vs-VMs trade-offs with measured evidence. 102/102 matrix PASS incl. two VM lanes + podman lane. Runner gains a podman requires-gate.