Sep 12 – 14, 2022
Europe/Dublin timezone

Networking resource control with per-cgroup LSM

Sep 13, 2022, 12:30 PM
"Pembroke" (Clayton Hotel on Burlington Road)


Clayton Hotel on Burlington Road

eBPF & Networking Track eBPF & Networking


Stanislav Fomichev (Google)


Google's container management system runs different workloads on the same host. To effectively manage networking resources, the kernel has to apply different networking policies to different containers.

Historically, most of the networking resource control happened inside proprietary Google networking cgroup. That cgroup is an interesting cross between upstream net_cls and net_prio, has a lot of Google-specific business logic and has no chance of being accepted upstream.

In this talk I'm going to talk about what we'd like to manage on the networking resource side and which BPF mechanisms were added to achieve this (lsm_cgroup).

I agree to abide by the anti-harassment policy Yes

Primary author

Stanislav Fomichev (Google)


Mahesh Bandewar‎

Presentation materials