Can we allow mounting some emulated proc files

[chenchun]

We want to get actual resource stats in containers. Currently some commands like top, free displays total resource stats on host. So we wrote a program called cgroupfs which uses fuse to create emulated /proc/meminfo, /proc/cpuinfo, /proc/diskstats, /proc/stats files. We want to mount those files into containers, but I can't do it now cause runc prevents bind mounting files under /proc. Can we allow mounting some files under proc?

Steps to produce https://github.com/chenchun/cgroupfs#usage

I propose to remove the restriction, like chenchun/docker@0613757#diff-6c6ccfc7b791fef9380cbfae0a91e3b4L308. If maintainers agree, I'd like to push a PR.

[hqhq]

Your usage makes sense, but the implementation you linked doesn't look good to me, it'll invalid all bind mount check under /proc, which makes the restriction meaningless. Maybe a white list would be better?

Since @crosbymichael added this restriction for security consideration. We should wait for his input.

[mrunalp]

@chenchun I like the idea! @crosbymichael @LK4D4 wdyt? BTW, cgroups namespaces patch has also been revived so that should be considered as well http://lists.linuxfoundation.org/pipermail/containers/2015-November/036378.html

[chenchun]

@mrunalp @crosbymichael @LK4D4 @hqhq How about porting our project https://github.com/chenchun/cgroupfs natively into runc?

[hqhq]

@mrunalp I don't think cgroup namespace can handle proc info isolation, can it? I think we still need something like fuse to handle this.

[dqminh]

i think cgroup namespace cant handle /proc isolation. We still need to bind mount cgroup-aware proc file over