0001 ===========================
0002 Namespaces research control
0003 ===========================
0004
0005 There are a lot of kinds of objects in the kernel that don't have
0006 individual limits or that have limits that are ineffective when a set
0007 of processes is allowed to switch user ids. With user namespaces
0008 enabled in a kernel for people who don't trust their users or their
0009 users programs to play nice this problems becomes more acute.
0010
0011 Therefore it is recommended that memory control groups be enabled in
0012 kernels that enable user namespaces, and it is further recommended
0013 that userspace configure memory control groups to limit how much
0014 memory user's they don't trust to play nice can use.
0015
0016 Memory control groups can be configured by installing the libcgroup
0017 package present on most distros editing /etc/cgrules.conf,
0018 /etc/cgconfig.conf and setting up libpam-cgroup.
