cats4256·6 年前·議論Have you shared bug reports / reproductions with LKML? I think facebook was going a bunch of work in this space. There were a bunch of improvements in 5.9, esp. with cgroup2.
cats4256·6 年前·議論In traditional Docker installs, you (can) run as real UID 0 (and many containers do) with CAP_KILL [https://docs.docker.com/engine/reference/run/].