Sep 12 – 14, 2022
Europe/Dublin timezone

Networking resource control with per-cgroup LSM

Sep 13, 2022, 12:30 PM
30m
"Pembroke" (Clayton Hotel on Burlington Road)

"Pembroke"

Clayton Hotel on Burlington Road

262
eBPF & Networking Track eBPF & Networking

Speaker

Stanislav Fomichev (Google)

Description

Google's container management system runs different workloads on the same host. To effectively manage networking resources, the kernel has to apply different networking policies to different containers.

Historically, most of the networking resource control happened inside proprietary Google networking cgroup. That cgroup is an interesting cross between upstream net_cls and net_prio, has a lot of Google-specific business logic and has no chance of being accepted upstream.

In this talk I'm going to talk about what we'd like to manage on the networking resource side and which BPF mechanisms were added to achieve this (lsm_cgroup).

I agree to abide by the anti-harassment policy Yes

Primary author

Stanislav Fomichev (Google)

Co-author

Mahesh Bandewar‎

Presentation materials